Tier0

Tier0 is not an entity type of its own. Selecting it in Select Entity Type returns every object that Forestall classified as Tier 0 in the selected scan, whatever its type or provider: Domain Controllers, Domain Admins, privileged Entra ID roles and their members, AWS administrators, GCP organization owners and so on. Use it to list or filter the most critical identities and resources across the whole environment in one query, instead of one query per type.

Forestall assigns the tier of each object during the scan (the Tier field on Active Directory types, AZTier, AWSTier, GCPTier and GHTier on the cloud types). An object with tier 0 carries the Tier0 label. See the Glossary for how Active Directory objects get their tier.

How to use it

1. Open Search & Reports and select New Query.

2. In Select Entity Type, select Tier0. Combine it with other types to widen the result, or use Tier0 alone.

3. Add rules as for any other type, for example IsEnabled is true, or FSName LIKE a domain name.

4. Select Run to list the objects, or Run on Graph to draw them on the Visualize page.

Tier0 can also be the second node of a relation. For example, the first node User, the relation preset Hybrid Attack Paths and the second node Tier0 returns the users that have an attack path to a Tier 0 object.

User, relation, Tier0

The Tier 0 card on the Dashboard opens the Tier 0 identities of the selected provider here, and the Show Outgoing Paths / Show Incoming Paths actions of Tier0 Analysis open their queries here with a TierGroups rule.

Fields

When Tier0 is the selected type, the field list of a rule contains the fields of every entity type of every provider (Active Directory, Azure, AWS, GCP and GitHub), plus TierGroups. A rule on a field that a matched object does not have simply does not match that object. For the meaning, type and operators of a field, see the page of the entity type that carries it:

• Active Directory Entities

• Azure Entities

• GCP Entities

• AWS Entities

• GitHub Entities

Field	Type	Possible Operators	Description
TierGroups	TEXT	IN	Names of the Tier0 Analysis groups the object belongs to: Tier0 for the Tier 0 objects themselves, Group1, Group2, … for the objects that reach them through a relation, in the order the analysis found them. Filled in when the scan policy enables the Tier0 Analysis module.

To list the objects that are not Tier 0, use Tier2.