Search & Reports

The Search & Reports page provides the Advanced Search interface for querying the entities and relations of the selected scan across all providers (Active Directory, Azure, AWS, GCP and GitHub). Built-in and custom queries return a table that can be exported or drawn on the graph.

The page has two buttons: Saved Queries opens the built-in and saved queries, New Query opens the query builder.

Search & Reports with a query result

Saved Queries

Saved Queries lists the built-in queries shipped with Forestall and the queries saved by users, in seven tabs: AD, Azure, AWS, GCP, GitHub, Hybrid (queries that cross providers) and Custom (queries saved by users). The Category column shows Builtin for the queries shipped with Forestall. The built-in queries include the SACL audit queries (Objects With Fully Audited Permissions, Objects With Partially Audited Permissions, Objects With Unaudited Permissions, Dangerous Permissions on AD Objects Without SACL Auditing, Domain Controllers Misconfigured Audit Policy) and a set of GitHub queries.

• Select a query name to run it. The result opens at /advanced-search/<scan GUID>/<query ID>. You can bookmark this address or share it with users who can open the scan.

• Use the search box to filter the list.

• The ⋯ menu of a row offers Run on Graph for every query, and Edit and Delete for saved queries. Built-in queries cannot be edited or deleted.

• To delete several saved queries at once, select them, choose Delete in Bulk Actions and select Apply. Built-in queries cannot be selected.

Saved Queries, AD tab

New Query

New Query opens the query builder. A query is a chain of nodes: a single node, or several nodes joined by relations (node, relation, node, and so on).

Node

• Preset: the drop-down on the left fills in the entity types of a provider: None, All, AD, Azure, GCP, AWS or GitHub. It shows Custom when the types are picked by hand.

• Select Entity Type: one or more entity types to search. Tier0 and Tier2 select objects by tier instead of by type.

• Select Additional Fields: fields added as extra columns to the result table.

• Rules: + Rule adds a condition (field, operator, value) and + Group adds a nested group of conditions. And / Or decides whether all or any of the conditions in a group must match. The fields of each entity type, with their types and operators, are listed on the entity pages.

Field type	Operators	Notes
TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	LIKE / NOT_LIKE match when the value contains / does not contain the text. The Computer IPAddress field also has IP_RANGE, which takes an IPv4 CIDR range such as 10.0.0.0/24.
NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL
DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	A few date fields do not offer IS_EMPTY; the entity pages show them.
BOOLEAN	N/A (toggle)	The rule shows a switch: on matches true, off matches false.
MULTI_LIST	IN	Matches any of the selected values, for example AceAuditState in None, Partial.

The builder shows the operators by label: LIKE is "Like", NOT_LIKE "Not like", EQUAL "Equal", NOT_EQUAL "Not equal", IS_EMPTY "Is Empty", BETWEEN "Between", SMALLER "Smaller", LARGER "Larger", SMALLER_EQUAL "Smaller or equal", LARGER_EQUAL "Larger or equal", IP_RANGE "Ip Range" and IN "In".

Relation

Add new relation and node adds a relation and a second node after the last node. The relation has these settings:

• Relation preset: None, All, Hybrid Attack Paths (default), AD Attack Paths, Azure Attack Paths, GCP Attack Paths, AWS Attack Paths, GitHub Attack Paths or Custom. The preset fills in the relation types, which can then be changed.

• Min Hops / Max Hops: how many relations the path between the two nodes may contain.

• Shortest Path: return only the shortest path between the nodes. Min Hops is then limited to 1. Shortest path queries may take a long time.

• Relation Direction: off follows the relations from the first node to the second (outgoing). On follows them in the reverse direction (incoming).

• Select Additional Relation Fields and relation rules: the properties stored on relations can be added as columns and used in rules, in the same way as node fields. The operators are the same as for node fields of the same type.

Relation	Field	Type	Description
ACE (permission)	IsSuccessfullyAudited	BOOLEAN	Whether a SACL success audit rule covers the permission.
ACE (permission)	VerifiedAt	DATE	When a remediation scan last verified the permission.
ACE (permission)	IsInherited	BOOLEAN	Whether the permission is inherited from a parent object.
ACE (permission)	AccessControlType	TEXT	Allow or Deny.
ACE (permission)	ActiveDirectoryRight	TEXT	Active Directory rights granted by the ACE.
ACE (permission)	InheritanceType	TEXT	Which child objects inherit the ACE.
ACE (permission)	ObjectType	TEXT	Property, property set or extended right the ACE applies to.
ACE (permission)	InheritedObjectType	TEXT	Object class that can inherit the ACE.
ACE (permission)	PropagationFlags	TEXT	How the ACE propagates to child objects.
ACE (permission)	ObjectFlags	TEXT	Whether ObjectType and InheritedObjectType are set.
ACE (permission)	IdentityType	TEXT	Type of the identity that holds the permission.
ACE (permission)	Type	TEXT	Type of the ACE.
GPLINK	IsEnforced	BOOLEAN	Whether the GPO link is enforced.
GPLINK	LinkOrder	NUMBER	Link order of the GPO on the linked container.
Trust	TrustType	TEXT	Type of the trust.
Trust	Direction	TEXT	Direction of the trust.
Trust	TargetSID	TEXT	SID of the trusted domain.
Trust	IsActive	BOOLEAN	Whether the trust is active.
Trust	IsNonTransitive	BOOLEAN	Whether the trust is non-transitive.
Trust	UsesRC4	BOOLEAN	Whether the trust uses RC4 encryption.
Trust	UsesAES	BOOLEAN	Whether the trust uses AES encryption.
Trust	TGTDelegationEnabled	BOOLEAN	Whether TGT delegation is enabled across the trust.
Trust	WithinForest	BOOLEAN	Whether both domains are in the same forest.
Trust	IsSelectiveAuthenticationActive	BOOLEAN	Whether selective authentication is enabled.
Trust	IsSidFilteringActive	BOOLEAN	Whether SID filtering is enabled.
Trust	IsObsoleteProtocol	BOOLEAN	Whether the trust uses an obsolete protocol.
Trust	WhenCreated	DATE	When the trust was created.
Trust	WhenChanged	DATE	When the trust was last changed.
Local right	Right	TEXT	Local right the relation grants on the computer.

The cards under the builder summarize the query: each NODE card shows its Selected Types and Selected Rules, each RELATION card its Selected Relations, Selected Hops (Min Hops / Max Hops) and Selected Rules.

Relation settings: relation types, Min/Max Hops, Shortest Path and Relation Direction

Buttons

• Run: runs the query and shows the result table.

• Run on Graph: runs the query and draws the result on the Visualize page.

• Save: saves the query under the name typed in Enter a query name to save.; it appears in the Custom tab of Saved Queries.

• Clear: clears the builder.

• Close: closes the builder.

Results

The result table is titled Result (N), followed by the query name when a saved query was run. Its columns depend on the entity types in the query (for example Type, FSName, Enabled, Risk (%)), followed by the additional fields. Rows can be shown 10, 25, 50, 100, 250 or 500 per page.

The Search box above the table filters the rows. Export downloads the full result as an Excel file (export.xlsx).

Run On Graph

Run on Graph is available for saved queries and for new queries. It draws the result on the Visualize page.

Run on Graph from the Saved Queries row menu

Query result drawn on the Visualize page

Active Directory Queries

Example 1 - Create Query - Risky Groups with No Member

Example 1: Group, risk > 50 and member_count = 0

Example 2 - Create Query - Users with Group Delegated Admin Right on more than 1 Computer

Example 2: User, group_delegated_localadmin_count > 1

Example 3 - Saving Query - Local Admin Accounts created in the last 1 month

Example 3: a named query, ready to Save

Example 4 - Using Groups - Shadow Admins in fsprotect.io or fslab.local Domains

Example 4: two groups joined with Or

Azure Queries

Example 1 - Create Query - Shadow Admins in Azure

Azure Example 1: AZUser, IsShadow true

Example 2 - Saving Query - Azure Tier 0 Users created in the last 4 months

Azure Example 2: AZUser, AZTier = 0, created in the last 4 months

Entity reference

The pages below list the fields of each entity type with their type, operators and description.

Active Directory EntitiesAzure EntitiesGCP EntitiesAWS EntitiesGitHub EntitiesVulnerabilityTier0Tier2