Search & Reports

Copy page

The Search & Reports page provides the Advanced Search interface for querying the entities and relations of the selected scan across all providers (Active Directory, Azure, AWS, GCP and GitHub). Built-in and custom queries return a table that can be exported or drawn on the graph.

The page has two buttons: Saved Queries opens the built-in and saved queries, New Query opens the query builder.

Search & Reports page showing the result of the Risky Admins built-in query — Search & Reports with a query result

Saved Queries

Saved Queries lists the built-in queries shipped with Forestall and the queries saved by users, in seven tabs: AD, Azure, AWS, GCP, GitHub, Hybrid (queries that cross providers) and Custom (queries saved by users). The Category column shows Builtin for the queries shipped with Forestall. The built-in queries include the SACL audit queries (Objects With Fully Audited Permissions, Objects With Partially Audited Permissions, Objects With Unaudited Permissions, Dangerous Permissions on AD Objects Without SACL Auditing, Domain Controllers Misconfigured Audit Policy) and a set of GitHub queries.

Select a query name to run it. The result opens at /advanced-search/<scan GUID>/<query ID>. You can bookmark this address or share it with users who can open the scan.
Use the search box to filter the list.
The ⋯ menu of a row offers Run on Graph for every query, and Edit and Delete for saved queries. Built-in queries cannot be edited or deleted.
To delete several saved queries at once, select them, choose Delete in Bulk Actions and select Apply. Built-in queries cannot be selected.

Saved Queries window with the AD, Azure, AWS, GCP, GitHub, Hybrid and Custom tabs — Saved Queries, AD tab

New Query

New Query opens the query builder. A query is a chain of nodes: a single node, or several nodes joined by relations (node, relation, node, and so on).

Node

Preset: the drop-down on the left fills in the entity types of a provider: None, All, AD, Azure, GCP, AWS or GitHub. It shows Custom when the types are picked by hand.
Select Entity Type: one or more entity types to search. Tier0 and Tier2 select objects by tier instead of by type.
Select Additional Fields: fields added as extra columns to the result table.
Rules: + Rule adds a condition (field, operator, value) and + Group adds a nested group of conditions. And / Or decides whether all or any of the conditions in a group must match. The fields of each entity type, with their types and operators, are listed on the entity pages.

Field type	Operators	Notes
TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	`LIKE` / `NOT_LIKE` match when the value contains / does not contain the text. The Computer `IPAddress` field also has `IP_RANGE`, which takes an IPv4 CIDR range such as `10.0.0.0/24`.
NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL
DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	A few date fields do not offer `IS_EMPTY`; the entity pages show them.
BOOLEAN	N/A (toggle)	The rule shows a switch: on matches true, off matches false.
MULTI_LIST	IN	Matches any of the selected values, for example `AceAuditState` in `None`, `Partial`.

The builder shows the operators by label: LIKE is “Like”, NOT_LIKE “Not like”, EQUAL “Equal”, NOT_EQUAL “Not equal”, IS_EMPTY “Is Empty”, BETWEEN “Between”, SMALLER “Smaller”, LARGER “Larger”, SMALLER_EQUAL “Smaller or equal”, LARGER_EQUAL “Larger or equal”, IP_RANGE “Ip Range” and IN “In”.

Relation

Add new relation and node adds a relation and a second node after the last node. The relation has these settings:

Relation preset: None, All, Hybrid Attack Paths (default), AD Attack Paths, Azure Attack Paths, GCP Attack Paths, AWS Attack Paths, GitHub Attack Paths or Custom. The preset fills in the relation types, which can then be changed.
Min Hops / Max Hops: how many relations the path between the two nodes may contain.
Shortest Path: return only the shortest path between the nodes. Min Hops is then limited to 1. Shortest path queries may take a long time.
Relation Direction: off follows the relations from the first node to the second (outgoing). On follows them in the reverse direction (incoming).
Select Additional Relation Fields and relation rules: the properties stored on relations can be added as columns and used in rules, in the same way as node fields. The operators are the same as for node fields of the same type.

Relation	Field	Type	Description
ACE (permission)	IsSuccessfullyAudited	BOOLEAN	Whether a SACL success audit rule covers the permission.
ACE (permission)	VerifiedAt	DATE	When a remediation scan last verified the permission.
ACE (permission)	IsInherited	BOOLEAN	Whether the permission is inherited from a parent object.
ACE (permission)	AccessControlType	TEXT	`Allow` or `Deny`.
ACE (permission)	ActiveDirectoryRight	TEXT	Active Directory rights granted by the ACE.
ACE (permission)	InheritanceType	TEXT	Which child objects inherit the ACE.
ACE (permission)	ObjectType	TEXT	Property, property set or extended right the ACE applies to.
ACE (permission)	InheritedObjectType	TEXT	Object class that can inherit the ACE.
ACE (permission)	PropagationFlags	TEXT	How the ACE propagates to child objects.
ACE (permission)	ObjectFlags	TEXT	Whether `ObjectType` and `InheritedObjectType` are set.
ACE (permission)	IdentityType	TEXT	Type of the identity that holds the permission.
ACE (permission)	Type	TEXT	Type of the ACE.
GPLINK	IsEnforced	BOOLEAN	Whether the GPO link is enforced.
GPLINK	LinkOrder	NUMBER	Link order of the GPO on the linked container.
Trust	TrustType	TEXT	Type of the trust.
Trust	Direction	TEXT	Direction of the trust.
Trust	TargetSID	TEXT	SID of the trusted domain.
Trust	IsActive	BOOLEAN	Whether the trust is active.
Trust	IsNonTransitive	BOOLEAN	Whether the trust is non-transitive.
Trust	UsesRC4	BOOLEAN	Whether the trust uses RC4 encryption.
Trust	UsesAES	BOOLEAN	Whether the trust uses AES encryption.
Trust	TGTDelegationEnabled	BOOLEAN	Whether TGT delegation is enabled across the trust.
Trust	WithinForest	BOOLEAN	Whether both domains are in the same forest.
Trust	IsSelectiveAuthenticationActive	BOOLEAN	Whether selective authentication is enabled.
Trust	IsSidFilteringActive	BOOLEAN	Whether SID filtering is enabled.
Trust	IsObsoleteProtocol	BOOLEAN	Whether the trust uses an obsolete protocol.
Trust	WhenCreated	DATE	When the trust was created.
Trust	WhenChanged	DATE	When the trust was last changed.
Local right	Right	TEXT	Local right the relation grants on the computer.

The cards under the builder summarize the query: each NODE card shows its Selected Types and Selected Rules, each RELATION card its Selected Relations, Selected Hops (Min Hops / Max Hops) and Selected Rules.

Query builder with a User node, a relation with IN_GROUP, GenericAll and ADMIN_TO over 1 to 3 hops, and a Tier0 node — Relation settings: relation types, Min/Max Hops, Shortest Path and Relation Direction

Buttons

Run: runs the query and shows the result table.
Run on Graph: runs the query and draws the result on the Visualize page.
Save: saves the query under the name typed in Enter a query name to save.; it appears in the Custom tab of Saved Queries.
Clear: clears the builder.
Close: closes the builder.

Results

The result table is titled Result (N), followed by the query name when a saved query was run. Its columns depend on the entity types in the query (for example Type, FSName, Enabled, Risk (%)), followed by the additional fields. Rows can be shown 10, 25, 50, 100, 250 or 500 per page.

The Search box above the table filters the rows. Export downloads the full result as an Excel file (export.xlsx).