Perform Config Search

POST 
/search/config

Returns the results of an RQL config query. With config queries, you can retrieve resource information, identify misconfigurations, gain operational insights, and uncover policy and compliance violations.

Download Config Search CSV

In addition to performing a config search, this endpoint can perform the config search and download the results as a CSV file. To download the config search CSV, add the request HTTP header Accept: text/csv.

An example request body is:

{
  "query":"config where api.name = 'aws-iam-get-account-summary' ",
  "timeRange":{
     "type":"relative",
     "value":{
        "unit":"hour",
        "amount":24
     }
  }
}

Request

application/json; charset=UTF-8

Body

required

Config rule search parameters model

searchName string

Search name. For asynchronouse search jobs only.

searchDescription string

Search description. For asynchronouse search jobs only.

withResourceJson boolean

true = include resource JSON. Default is true.

timeRange object

Model for TimeRangeConfig

value object

Model for RelativeTimeDuration

unit string

Possible values: [minute, hour, day, week, month, year]

Time unit

amount int32

Number of time units

sort object[]
Sort field data
Array [
field string
Possible values: [ID, TIME, API_NAME, CUSTOMER_ID, INSERT_TS, JSON, CLOUD_ACCOUNT, CLOUD_REGION, STATE_ID]
direction string
Possible values: [asc, desc]
Direction
]
limit int32

Results per page. Does not apply to asynchronous search jobs.

id string

Search ID

query string

RQL query

Responses

200

success

application/json; charset=UTF-8

Schema

Schema

groupBy string[]

Group By

filters object[]
View Order
Array [
name string
Name
value string
Value
operator string
Possible values: [=]
Operator
]
timeGranularity string

Time Granularity

alertId string

Alert ID

cloudType string

Possible values: [aws, azure, gcp, alibaba_cloud, oci]

Cloud Type

id string

Search ID

name string

Search Name

description string

Search Description

searchType string

Possible values: [network, audit_event, config, asset]

Search Type

asyncResultUrl string

Async Result Url

saved boolean

Search Exists

timeRange objectrequired

Model for TimeRangeConfig

value object

Model for RelativeTimeDuration

unit string

Possible values: [minute, hour, day, week, month, year]

Time unit

amount int32

Number of time units

query stringrequired

RQL Query

cursor int32

Cursor

data object
totalRows int64
items object[]
Array [
rrn string
RRN
stateId string
State ID
assetId string
Asset ID
id string
ID
name string
Name
url string
URL
accountId string
Account ID
accountName string
Account name
accountGroupName string
Account group name
cloudType string
Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, OTHER, IBM]
Cloud Type
regionId string
Region ID
regionName string
Region name
service string
Service
resourceType string
Resource type
insertTs int64
Insertion timestamp
createdTs int64
Creation timestamp
deleted boolean
Deleted
vpcId string
Virtual private cloud ID
vpcName string
Virtual private cloud name
tags object
Tags
property name* string
riskGrade string
Risk grade
data object
Raw JSON data for the resource
dynamicData object
Dynamic data
property name* object
hasNetwork boolean
Has network
hasExternalFinding boolean
Has external finding
hasExternalIntegration boolean
Has external integration
allowDrillDown boolean
allowDrillDown
hasExtFindingRiskFactors boolean
Has risk factors
resourceConfigJsonAvailable boolean
allowDrillDown
]
dynamicColumns string[]
nextPageToken string
infoMsg string
sortAllowedColumns string[]
default boolean
async boolean

true = Is Async

Example (from schema)

{
  "groupBy": [
    "string"
  ],
  "filters": [
    {
      "name": "string",
      "value": "string",
      "operator": "="
    }
  ],
  "timeGranularity": "string",
  "alertId": "string",
  "cloudType": "aws",
  "id": "string",
  "name": "string",
  "description": "string",
  "searchType": "network",
  "asyncResultUrl": "/search/config/jobs/2df49d4f72e842b582b123bc2b7826b3/download",
  "saved": true,
  "timeRange": {
    "type": "relative",
    "value": {
      "unit": "minute",
      "amount": 0
    }
  },
  "query": "string",
  "cursor": 0,
  "data": {
    "totalRows": 0,
    "items": [
      {
        "rrn": "string",
        "stateId": "string",
        "assetId": "string",
        "id": "string",
        "name": "string",
        "url": "string",
        "accountId": "string",
        "accountName": "string",
        "accountGroupName": "string",
        "cloudType": "ALL",
        "regionId": "string",
        "regionName": "string",
        "service": "string",
        "resourceType": "string",
        "insertTs": 0,
        "createdTs": 0,
        "deleted": true,
        "vpcId": "string",
        "vpcName": "string",
        "tags": {},
        "riskGrade": "string",
        "data": {},
        "dynamicData": {},
        "hasNetwork": true,
        "hasExternalFinding": true,
        "hasExternalIntegration": true,
        "allowDrillDown": true,
        "hasExtFindingRiskFactors": true,
        "resourceConfigJsonAvailable": true
      }
    ],
    "dynamicColumns": [
      "string"
    ],
    "nextPageToken": "string",
    "infoMsg": "string",
    "sortAllowedColumns": [
      "string"
    ]
  },
  "default": true,
  "async": true
}

400

conflict_saved_search

404

not_found

Loading...