> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/tier2.md).

# Tier2

**Tier2** is not an entity type of its own. Selecting it in **Select Entity Type** returns every object that Forestall classified as Tier 2 in the selected scan, whatever its type or provider. Tier 2 is the default tier: an object is Tier 2 unless the scan found it to be Tier 0 (or, for some Active Directory types, Tier 1). Use it together with a relation to find the ordinary objects that can reach a critical one.

Forestall assigns the tier of each object during the scan (the `Tier` field on Active Directory types, `AZTier`, `AWSTier`, `GCPTier` and `GHTier` on the cloud types). An object with tier 2 carries the Tier2 label. Tier 1 objects are in neither [Tier0](/forestall/search-and-reports/tier0.md) nor Tier2. See the [Glossary](/forestall/introduction/glossary/glossary.md) for how Active Directory objects get their tier.

## How to use it

1. Open **Search & Reports** and select **New Query**.
2. In **Select Entity Type**, select `Tier2`.
3. Add rules as for any other type.
4. To find Tier 2 objects that can take over Tier 0 objects, select **Add new relation and node**, pick a relation preset (for example **Hybrid Attack Paths**) and select `Tier0` as the type of the second node.
5. Select **Run** to list the results, or **Run on Graph** to draw the paths on the Visualize page.

The **Show Outgoing Paths** / **Show Incoming Paths** actions of [Tier0 Analysis](/forestall/visualize/tier0-analysis.md) build this kind of query for a selected group, using `Tier2` and `Tier0` nodes and a `TierGroups` rule.

## Fields

When **Tier2** is the selected type, the field list of a rule contains the fields of **every** entity type of every provider (Active Directory, Azure, AWS, GCP and GitHub), plus **TierGroups**. A rule on a field that a matched object does not have simply does not match that object. For the meaning, type and operators of a field, see the page of the entity type that carries it:

* [Active Directory Entities](/forestall/search-and-reports/active-directory-entities.md)
* [Azure Entities](/forestall/search-and-reports/azure-entities.md)
* [GCP Entities](/forestall/search-and-reports/gcp-entities.md)
* [AWS Entities](/forestall/search-and-reports/aws-entities.md)
* [GitHub Entities](/forestall/search-and-reports/github-entities.md)

| Field      | Type | Possible Operators | Description                                                                                                                                                                                                                                                                                                                          |
| ---------- | ---- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| TierGroups | TEXT | IN                 | Names of the [Tier0 Analysis](/forestall/visualize/tier0-analysis.md) groups the object belongs to: `Tier0` for the Tier 0 objects themselves, `Group1`, `Group2`, … for the objects that reach them through a relation, in the order the analysis found them. Filled in when the scan policy enables the **Tier0 Analysis** module. |