Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Query using internal metadata - AskJ1 Community
<main> <article class="userContent"> <p>JupiterOne assigns metadata to resources and sometimes it is helpful to leverage them in queries. Here are some examples.</p> <blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">See <a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/1036-entity-and-relationship-metadata">this doc</a> for a complete list and description of each metadata property.</p> </div></blockquote> <p><strong>Identify network access to/from external resources using <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">_source</code> filter:</strong></p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find Firewall that allows as rule (Host|Network) with _source='system-mapper' Return Firewall._type, Firewall.displayName, rule.ingress, rule.egress, rule.ipProtocol, rule.fromPort, rule.toPort </pre> <p><strong>Using internal timestamps when provider timestamps are not available:</strong></p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find Host with _createdOn > date.now - 48 hours </pre> <p><strong>Count entities by integration type and instance name:</strong></p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find * as entity Return entity._integrationType, entity._integrationName, count(entity) </pre> </article> </main>