Skip to main content

Datasource Information

This topic describes how to use the Lacework CLI and API to get information about datasources that you can access through LQL. Then you can use the datasource information to configure queries.

note

For information on available datasources, see the Datasource Metadata knowledge base article. (Requires customer login.)

Use the Lacework CLI​

If you are new to the Lacework CLI, see Get Started to learn about installing and configuring the CLI.

List All Datasources​

The easiest way to learn about the LQL datasources is to discover the names of the datasources and then get details about the one you are interested in.

To list all datasources, run this command:

lacework query list-sources

To list all AWS datasources, run:

lacework query list-sources | grep AWS

List Datasource Details​

To list the details for a specific datasource, run this command:

lacework query show-source <datasource>

Preview Events for a Datasource​

For some datasources, you can run the following command to show a preview of a sample event for the datasource.

lacework query preview-source <datasource>

Use the Lacework API​

All Lacework endpoints require an API access (bearer) token to be specified when you invoke the endpoint. If you already have a secret key, you can use the POST /api/v2/access/tokens endpoint to generate an access token. For details, see API Access Keys and Tokens.

List All Datasources​

To list all available datasources and their metadata, use the following endpoint:

GET https://YourLacework.lacework.net/api/v2/Datasources

List Datasource Details​

To list the metadata for a specific datasource based on the datasource name, use the following endpoint:

GET https://YourLacework.lacework.net/api/v2/Datasources/{datasource}