> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/tier0.md).

# Tier0

**Tier0** is not an entity type of its own. Selecting it in **Select Entity Type** returns every object that Forestall classified as Tier 0 in the selected scan, whatever its type or provider: Domain Controllers, Domain Admins, privileged Entra ID roles and their members, AWS administrators, GCP organization owners and so on. Use it to list or filter the most critical identities and resources across the whole environment in one query, instead of one query per type.

Forestall assigns the tier of each object during the scan (the `Tier` field on Active Directory types, `AZTier`, `AWSTier`, `GCPTier` and `GHTier` on the cloud types). An object with tier 0 carries the Tier0 label. See the [Glossary](/forestall/introduction/glossary/glossary.md) for how Active Directory objects get their tier.

## How to use it

1. Open **Search & Reports** and select **New Query**.
2. In **Select Entity Type**, select `Tier0`. Combine it with other types to widen the result, or use `Tier0` alone.
3. Add rules as for any other type, for example `IsEnabled` is true, or `FSName` `LIKE` a domain name.
4. Select **Run** to list the objects, or **Run on Graph** to draw them on the Visualize page.

`Tier0` can also be the second node of a relation. For example, the first node `User`, the relation preset **Hybrid Attack Paths** and the second node `Tier0` returns the users that have an attack path to a Tier 0 object.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-f63834fda7ad2fa02af51ebd0f2de07d726dd7a4%2Fsearch-new-query-relation.gif?alt=media" alt="Query builder with a User node, a relation and a Tier0 node"><figcaption><p>User, relation, Tier0</p></figcaption></figure>

The Tier 0 card on the [Dashboard](/forestall/dashboard.md) opens the Tier 0 identities of the selected provider here, and the **Show Outgoing Paths** / **Show Incoming Paths** actions of [Tier0 Analysis](/forestall/visualize/tier0-analysis.md) open their queries here with a `TierGroups` rule.

## Fields

When **Tier0** is the selected type, the field list of a rule contains the fields of **every** entity type of every provider (Active Directory, Azure, AWS, GCP and GitHub), plus **TierGroups**. A rule on a field that a matched object does not have simply does not match that object. For the meaning, type and operators of a field, see the page of the entity type that carries it:

* [Active Directory Entities](/forestall/search-and-reports/active-directory-entities.md)
* [Azure Entities](/forestall/search-and-reports/azure-entities.md)
* [GCP Entities](/forestall/search-and-reports/gcp-entities.md)
* [AWS Entities](/forestall/search-and-reports/aws-entities.md)
* [GitHub Entities](/forestall/search-and-reports/github-entities.md)

| Field      | Type | Possible Operators | Description                                                                                                                                                                                                                                                                                                                          |
| ---------- | ---- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| TierGroups | TEXT | IN                 | Names of the [Tier0 Analysis](/forestall/visualize/tier0-analysis.md) groups the object belongs to: `Tier0` for the Tier 0 objects themselves, `Group1`, `Group2`, … for the objects that reach them through a relation, in the order the analysis found them. Filled in when the scan policy enables the **Tier0 Analysis** module. |

{% hint style="info" %}
To list the objects that are not Tier 0, use [Tier2](/forestall/search-and-reports/tier2.md).
{% endhint %}