-
J1QL Tips and Tricks
This guide contains tips and tricks that assist in creating J1QL queries in your account. If you haven't already, check out our J1QL Tutorial as well as our J1QL Language Specs articles for helpful context. Before creating your own query, we recommend starting with our wide-array of pre-packaged questions, tweaking them as…
-
JupiterOne Query Language Tutorial
Querying can be the most challenging yet the most rewarding part of the JupiterOne experience. After you become familiar with the query language, you will uncover numerous previously undiscovered insights into your data. The JupiterOne Query Language (J1QL) is a query language for finding the assets and relationships…
-
Network Connections and Zones
What network traffic is allowed between internal and external (i.e. between trusted and untrusted) networks? Find Firewall as fw that ALLOWS as r (Network|Host) with internal=undefined or internal=false as nreturn fw.tag.AccountName, fw._type, fw.displayName, fw.description, r.ipProtocol, r.fromPort, r.toPort,…
-
Query related FAQs
How do I search/filter on all entities from an integration without enumerating all types? For example, you may want to identify if a certain tag is present across all entities from AWS. You can do this by using the special metadata _integrationType, like this: Find * with _integrationType="aws" and tag.ABC=undefined You…
-
Query Resources with/without Specific Tags
Tagging is highly recommended for resources in cloud environments such as AWS, Azure, and GCP. For example, it is common to use tags to track cost-center or project. It is recommended that you assign classification tag to all databases and data stores, such as buckets, blobs, disks. Tags you apply in JupiterOne remain…
-
Query using internal metadata
JupiterOne assigns metadata to resources and sometimes it is helpful to leverage them in queries. Here are some examples. Identify network access to/from external resources using _source filter: Find Firewall that allows as rule (Host|Network) with _source='system-mapper'Return Firewall._type, Firewall.displayName,…
-
Risks and Vulnerability Management
Which applications or code repos are vulnerable? Requires at least one application scanner integration such as Veracode or WhiteHat. Find (Application|CodeRepo) as app that has (Finding|Vulnerability) as vulnreturn app._type, app.displayName, vuln._type, vuln.displayName, vuln.severity, vuln.numericSeverity Which…
-
Sample J1QL Queries for Hardware and Software Inventory and Configuration
What Workloads are in my environment? Find Workload Find Workload with tag.AccountName='{accountName}' What are my production systems and servers? (and what are those systems there to do?) Find (Host|Database) with tag.Production=true Find (Host|Database) with tag.AccountName='{accountName}' What are my production…
-
Secrets and key management
What SSH keys exist on system {}? Find all SSH keys in an AWS account: Find aws_key_pair with tag.AccountName='{accountName}' You can also use the abstract class: Find AccessKey with usage='ssh' and tag.AccountName='{accountName}' Find key usage and return a graph: Find aws_key_pair that relates to Host return tree Find…
-
Servers and Endpoints
Who is responsible for patching a system in account/zone/tier/layer/VPC/SG? Returns the owner of hosts in a particular account: Find Host with tag.AccountName = '{AccountName}' as h return h.displayName, h.owner Returns the owner of images used by hosts in a particular account: Find Host with tag.AccountName =…
.png)