Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Troubleshooting and Reporting Common Data Issues - AskJ1 Community
<main> <article class="userContent"> <p>This guide walks through troubleshooting common issues in JupiterOne related to entities, properties, and relationships returned from queries. If these suggestions don’t resolve your issue, reach out to the JupiterOne team by following the steps under <strong>Reporting an Issue</strong>!</p> <h2 data-id="troubleshooting-an-issue">Troubleshooting an Issue</h2> <h3 data-id="1-i-don-t-see-recent-changes-made-to-my-environment">1. I don't see recent changes made to my environment</h3> <p><strong>Example:</strong> You recently updated a rule in a security group attached to an EC2 instance to not allow access to the internet. However, the EC2 instance is still being returned by the query because the updated configuration in AWS hasn’t yet been retrieved by the JupiterOne integration.</p> <p>Depending on the polling frequency of your data, your most recent changes may not have been ingested. You can check your polling interval and manually trigger a job by following these steps:</p> <ol><li>Navigate to the Integrations page under Settings.</li> <li>Select the integration type where the change was made.</li> <li>Select the account where the change was made.</li> <li>Your Polling Interval can be found on this page and ranges from thirty minutes to one week. It is also possible that polling is set to disabled.</li> <li>Click the Run Integration button to trigger the job.</li> </ol><p><img src="https://us.v-cdn.net/6035534/uploads/3G6OG35Y4TBJ/troubleshoot-integration-configuration.png" alt="troubleshoot-integration-configuration" class="embedImage-img importedEmbed-img"></img></p> <ol start="6"><li>Wait for the job to complete. Click on the View Jobs button to check the status.</li> </ol><p><strong>NOTE</strong>: if the build fails, take a screenshot and follow the steps under <strong>Reporting an Issue</strong>.</p> <ol start="7"><li>Rerun the query and check the results.</li> </ol><h3 data-id="2-i-m-not-sure-if-my-query-is-written-correctly-or-not">2. I’m not sure if my query is written correctly or not</h3> <p>For a general query guide, refer to our <a rel="nofollow" href="../jupiterOne-query-language_(J1QL)\tutorial-j1ql.md">J1QL Query Tutorial</a>.</p> <p>For queries written against any JupiterOne managed integrations, visit our <a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/825-configure-managed-integrations">Integrations</a> <br> guides to understand which entities and properties are ingested along with the relationships that are configured.</p> <p>For queries written against custom integrations, ensure your integration has been configured properly referring to the <a rel="nofollow" href="../j1-client-and-cli.md">Node.js Client and CLI</a> guide.</p> <p>For queries written against all integration types, refer to the <a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/846-jupiterone-data-model">JupiterOne Graph Data Model</a> <br> to understand the class and relationship model.</p> <h3 data-id="3-i-deleted-some-entities-that-are-still-being-returned">3. I deleted some entities that are still being returned</h3> <p><strong>First</strong>, check if you have configured JupiterOne to return recently deleted entities.</p> <p>While on the landing page, when you click into the query bar, make sure that <em>Include recently deleted entities in query/search</em> is not checked.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/ROIMA26IMDCV/troubleshoot-deleted-checkbox.png" alt="troubleshoot-deleted-checkbox" class="embedImage-img importedEmbed-img"></img></p> <p><strong>Second</strong>, verify the entity was actually deleted at the source.</p> <p>If a deleted entity/relationship is still being returned after you have verified that <em>Include recently deleted entities in query/search</em> is unchecked, there is one final check.</p> <ol><li>Click on an entity/relationship in the list view or the info icon in the graph view to see more details.</li> <li>Click on the Metadata tab.</li> <li>Look for the property _deleted.</li> </ol><ul><li>If the value is equal to true, continue to the section <strong>Reporting an Issue</strong>.</li> <li>If the value is equal to false, verify that the entity was deleted at the source.</li> </ul><p><img src="https://us.v-cdn.net/6035534/uploads/RXGCVY3TYJ7B/troubleshoot-metadata-deleted.png" alt="troubleshoot-metadata-deleted" class="embedImage-img importedEmbed-img"></img></p> <h3 data-id="4-my-query-with-a-date-comparison-does-not-return-anything">4. My query with a date comparison does not return anything</h3> <p>J1QL can only perform a date comparison on a property's value if that value is stored as an epoch number in milliseconds.</p> <p>To verify that the date value is stored in JupiterOne correctly, use the following query as an example way to find out:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find {Entity class or type} as x return x.createdOn, x.createdOn as storedValue </pre> <p><img src="https://us.v-cdn.net/6035534/uploads/PNOOAQGU1CUR/troubleshoot-date-filter.png" alt="troubleshoot-date-filter" class="embedImage-img importedEmbed-img"></img></p> <ol><li><p>The first column shows the date time value formatted for the UI. If the value is being returned in the syntax <em>yyyy-mm-ddThh:mm:ss.sssZ</em> then we know that the stored value is an epoch number.</p></li> <li><p>The second column shows the value stored in the database. This value should be returned as a 13 digit number.</p></li> </ol><p>If either of the above conditions are not true, then the values uploaded to the JupiterOne platform should be updated.</p> <h3 data-id="5-i-have-a-different-issue-or-the-previous-suggestions-did-not-resolve-my-issue">5. I have a different issue or the previous suggestions did not resolve my issue</h3> <p>For all other issues, see the section below on <strong>Reporting an Issue</strong>, providing the JupiterOne team with as much detail as possible.</p> <h2 data-id="reporting-an-issue">Reporting an Issue</h2> <p>To report an issue, please reach out to the JupiterOne team via Slack or Email and provide the following information:</p> <ul><li>Your name</li> <li>Your JupiterOne account ID (found in the <strong>Account Management</strong> view under <strong>Settings</strong>) or your company name</li> <li>Description of the issue</li> <li>Steps to reproduce</li> <li>Any error/warnings (if applicable)</li> <li>Failing integration build logs (if applicable)</li> <li>Any helpful screenshots/screengrab</li> </ul> </article> </main>
.png)