lacework query
Run and manage queries
Synopsis
Run and manage Lacework Query Language (LQL) queries.
LQL is a SQL-like query language for specifying the selection, filtering, and manipulation of data. Queries let you interactively request information from specified curated datasources.
Lacework ships a set of default LQL queries that are available in your account.
For more information about LQL, visit:
https://docs.lacework.com/lql-overview
To view all LQL queries in your Lacework account.
lacework query ls
To show a query.
lacework query show <query_id>
To execute a query.
lacework query run <query_id>
Note: LQL syntax may change.
Options
-h, --help help for query
Options inherited from parent commands
-a, --account string account subdomain of URL (i.e. <ACCOUNT>.lacework.net)
-k, --api_key string access key id
-s, --api_secret string secret access key
--api_token string access token (replaces the use of api_key and api_secret)
--debug turn on debug logging
--json switch commands output from human-readable to json format
--nocache turn off caching
--nocolor turn off colors
--noninteractive turn off interactive mode (disable spinners, prompts, etc.)
--organization access organization level data sets (org admins only)
-p, --profile string switch between profiles configured at ~/.lacework.toml
--subaccount string sub-account name inside your organization (org admins only)
SEE ALSO
- lacework - A tool to manage the Lacework cloud security platform.
- lacework query create - Create a query
- lacework query delete - Delete a query
- lacework query list - List queries
- lacework query list-sources - List Lacework query datasources
- lacework query preview-source - Preview Lacework query datasource
- lacework query run - Run a query
- lacework query show - Show a query
- lacework query show-source - Show Lacework query datasource
- lacework query update - Update a query
- lacework query validate - Validate a query