Tier2
Tier2 is not an entity type of its own. Selecting it in Select Entity Type returns every object that Forestall classified as Tier 2 in the selected scan, whatever its type or provider. Tier 2 is the default tier: an object is Tier 2 unless the scan found it to be Tier 0 (or, for some Active Directory types, Tier 1). Use it together with a relation to find the ordinary objects that can reach a critical one.
Forestall assigns the tier of each object during the scan (the Tier field on Active Directory types, AZTier, AWSTier, GCPTier and GHTier on the cloud types). An object with tier 2 carries the Tier2 label. Tier 1 objects are in neither Tier0 nor Tier2. See the Glossary for how Active Directory objects get their tier.
How to use it
Open Search & Reports and select New Query.
In Select Entity Type, select
Tier2.Add rules as for any other type.
To find Tier 2 objects that can take over Tier 0 objects, select Add new relation and node, pick a relation preset (for example Hybrid Attack Paths) and select
Tier0as the type of the second node.Select Run to list the results, or Run on Graph to draw the paths on the Visualize page.
The Show Outgoing Paths / Show Incoming Paths actions of Tier0 Analysis build this kind of query for a selected group, using Tier2 and Tier0 nodes and a TierGroups rule.
Fields
When Tier2 is the selected type, the field list of a rule contains the fields of every entity type of every provider (Active Directory, Azure, AWS, GCP and GitHub), plus TierGroups. A rule on a field that a matched object does not have simply does not match that object. For the meaning, type and operators of a field, see the page of the entity type that carries it:
TierGroups
TEXT
IN
Names of the Tier0 Analysis groups the object belongs to: Tier0 for the Tier 0 objects themselves, Group1, Group2, … for the objects that reach them through a relation, in the order the analysis found them. Filled in when the scan policy enables the Tier0 Analysis module.
Last updated
Was this helpful?