SIQL Query Components

A SIQL query, also known as a filter, consists of a combination of an expression, stanza, function, attribute, operator, argument, and, in some cases, a pipe. The following graphic lists the components in a SIQL query example.

 

The following table defines the components of a SIQL query.

Component Name Description Position in Filter Example
Filter The combination of stanza, function, operator, argument and, optionally, pipe that are used to tell the system what data to find and where to find it. A SIQL query can consist of one or more filters. n/a

rule{created ~ date('last 30 days')}
Stanza

The logical entity that is being queried. The stanza identifies what kind of data you want to find and, by implication, where to find it in the database.

If you use multiple filters, you must enter the filters hierarchically by stanza. The following list shows the stanza hierarchy:

  • Domain
  • Device Group
  • Device
  • Policy
  • Rule
  • Natrule
  • Assessment
  • Control
 The first part of every filter, and is placed in front of the curly brackets. rule{}
Attribute The specific type of information within a stanza that is queried. Attribute choices vary based on the stanza type. The second part of every filter, and the first part of every expression. The attribute is placed directly after the opening curly bracket.
  • The Device stanza includes an ID attribute.
  • The Policy stanza includes a name attribute.
  • The Rule stanza includes a created attribute.
Operator The symbol or words that control how the attribute should act on the argument that follows the operator. Operator choices vary based on the data type of the function. After the attribute and before the function. =
Function

The value being searched for within a stanza, such as a date or zone. The function is placed after the operator and before the argument in an expression. Function choices vary by on the stanza type.

In some cases, you can use the pipe delimiter to add an extra function to an expression to return additional information for a stanza. Piped function choices vary by stanza type.

 After the operator and before the argument. date()
Argument The argument is the value you are searching for in the database for a particular function. Unless they are Boolean arguments, numbers, or dates, arguments must be entered in single quotes. Argument choices vary based on the function and attribute type for a field. After the operator and before the closing curly bracket.
  • The argument '192.168.20.2' for the managementIp function.
  • The argument From 'Trust to Untrust' for the name function.
  • The argument '22' for the service.port function.
  • The argument FALSE for the active function.
Expression The combination of attribute, operator, function, and argument that appears inside of curly brackets. You can include one or more expressions in a single filter. After the stanza.

{created ~ date('last 30 days')}