lacework query

Run and manage queries

Synopsis

Run and manage Lacework Query Language (LQL) queries.

LQL is a SQL-like query language for specifying the selection, filtering, and manipulation of data. Queries let you interactively request information from specified curated datasources.

Lacework ships a set of default LQL queries that are available in your account.

For more information about LQL, visit:

https://docs.lacework.com/lql-overview

To view all LQL queries in your Lacework account.

lacework query ls

To show a query.

lacework query show <query_id>

To execute a query.

lacework query run <query_id>

Note: LQL syntax may change.

Options

  -h, --help   help for query

Options inherited from parent commands

  -a, --account string      account subdomain of URL (i.e. <ACCOUNT>.lacework.net)
  -k, --api_key string      access key id
  -s, --api_secret string   secret access key
      --api_token string    access token (replaces the use of api_key and api_secret)
      --debug               turn on debug logging
      --json                switch commands output from human-readable to json format
      --nocache             turn off caching
      --nocolor             turn off colors
      --noninteractive      turn off interactive mode (disable spinners, prompts, etc.)
      --organization        access organization level data sets (org admins only)
  -p, --profile string      switch between profiles configured at ~/.lacework.toml
      --subaccount string   sub-account name inside your organization (org admins only)

See also

• lacework - A tool to manage the Lacework cloud security platform.
• lacework query create - Create a query
• lacework query delete - Delete a query
• lacework query list - List queries
• lacework query list-sources - List Lacework query datasources
• lacework query preview-source - Preview Lacework query datasource
• lacework query run - Run a query
• lacework query show - Show a query
• lacework query show-source - Show Lacework query datasource
• lacework query update - Update a query
• lacework query validate - Validate a query