-
Applications and Processes
We plan to add deeper integration with endpoint protection and device management solutions to obtain services and processes information on hosts. Note that you can also add custom data by writing a script to call the J1 APIs. What certificates are installed/being used? Host level certificates details to be added later. You…
-
AWS Access Permissions and Trusts
IAM Policy Permissions Which policies allow access to production data? find AccessPolicy as policy that allows as permission (aws_s3|aws_dynamodb|aws_rds|DataStore) with tag.Production=true as resourcereturn policy._type, policy.name, resource._type, resource.name, resource.tag.AccountName, permission.actions,…
-
Changes and attribution
What changes were made in environment, SG or VPC in last time period {}? Find all changes in the last 24 hours: Find * with _beginOn > date.now - 24 hours Changes in the last 24 hours related to a particular VPC: Find * with _beginOn > date.now - 24 hours that relates to aws_vpc with vpcId='{vpcId}' or name='{vpcName}'…
-
Common Questions and Corresponding J1QL Queries
Here are some commonly asked questions and their corresponding J1QL queries. You can easily modify the properties and tags used in each query to customize it for your own specific scenario. Many of these are packaged in the Query Library directly accessible in the landing page in JupiterOne. Here is a catalog of the…
-
Creating Relationships Between Assets You Own and Assets You Do Not
Overview If you want to form a relationship using a _key, you must include the _source and _scope of the entity that already exists in the graph. If the entity you are uploading is the to, then the entity that you are forming a relationship with, which already exists in the graph, is, therefore, the from: This does NOT…
-
Development
Queries below require integration with either Github or Bitbucket. Were there any Code Repos added in the last 24 hours? Find CodeRepo with _beginOn > date.now-24hr and _version=1 Which PRs did this developer open in the last 5 days? For a developer whose first name is Charlie: 'Charlie' that OPENED PR with _createdOn >…
-
Example Data Security J1QL Queries
Show all resources without a data classification tag {}? Find (Host|DataStore) with classification = undefined Returns a count instead: Find (Host|DataStore) with classification = undefined as e return count(e) Show all resources without a data classification tag in VPC with tag {}? Filter by a tag on the VPC: Find…
-
Identity, People and Privileged access
Most of these queries depend on proper mapping of custom properties or profile attributes from your HR system or identity provider to the Person/employee entities. Who are the new hires within the last 12 months? If you have been using JupiterOne for more than a year: Find employee with _createdOn > date.now-12months If…
-
Introduction to JupiterOne Query Language (J1QL)
The JupiterOne Query Language (J1QL) is a query language for querying data stored by JupiterOne. The execution of a J1QL query seamlessly queries a full text search, entity-relationship graph, and any other future data stores, as needed. By design, the query language does not intend to make these data store boundaries…
-
J1 Query Builder
J1 Query Builder is a tool that provides a visual way to build a query in J1QL without having to know the language. To create a query in Query Builder: * At the top of the J1 homepage, click the Query Builder tab. * Click query anything if you want to query all of your assets or click specific entities to select the exact…
.png)