Back
Query system
Read-only SPARQL: SELECT, ASK, CONSTRUCT, DESCRIBE
Example
Custom query
List 10 triples
Count by rdf:type
ASK if any triples exist
Describe first subject
Any detections on endpoint (ASK)
Count detections by level on endpoint
Users for high-severity detections on endpoint
Suspicious processes executed on endpoint
First detection time on endpoint
Where did detection X originate?
Files supporting detection X
Events sharing the same value (possible correlation)
Attack tactic for an artifact
Attack technique for an artifact
Detections associated with tactic X
Endpoints showing lateral movement evidence
Number of techniques and tactics
Events near a specific detection (time window)
Source tool / raw record provenance for entity
Entities missing critical attributes
Run
Clear
Ready
Available prefixes
No results yet.