maestro-indicators

Retrieves the list of indicators of compromise (IoC) registered in Logpresso Sonar. You can check each indicator's type, risk level, external reputation, and detection time.

Command properties

Property	Description
Command type	Driver query
Required permission	Administrator
License usage	Counted
Parallel execution	Not supported
Distributed execution	Runs on Data Node (mapper)

Syntax

maestro-indicators [type=STR]

Options

type=STR: Filters by indicator of compromise type. Specify multiple types separated by commas. Not case-sensitive.

IP: IP address
DOMAIN: Domain
URL: URL
MD5: MD5 hash
EMAIL: Email address

Input fields

None (as a driver query, this command can only be used as the first command in a pipeline)

Output fields

Field	Type	Description
type	string	Indicator of compromise type. One of `URL`, `MD5`, `IP`, `DOMAIN`, `EMAIL`
value	string	The value of the indicator of compromise
risk	string	Risk level. One of `BENIGN`, `LOW`, `MEDIUM`, `HIGH`
reputation	string	External reputation. One of `WAIT`, `UNKNOWN`, `BENIGN`, `SUSPICIOUS`, `MALICIOUS`
status	string	Status. One of `WAIT`, `ERROR`, `RETRY`, `DONE`
first_seen	timestamp	First detection time
last_seen	timestamp	Last detection time
created	timestamp	Creation time
updated	timestamp	Last update time

Error codes

Parsing errors

Error code	Message	Description
300606	No permission to enumerate indicators.	Run by an account without administrator permission
300607	Invalid indicator type. Valid types are: IP, DOMAIN, URL, MD5, EMAIL	An invalid type value was specified in the `type` option

Runtime errors

N/A

Description

The maestro-indicators command retrieves the indicators of compromise registered to the company (tenant) that the current account belongs to, in pages of up to 10,000 records at a time, and returns the entire set sequentially. If the type option is not specified, indicators of all types are returned.

The status field indicates the progress of the external reputation lookup. An indicator is in the WAIT state immediately after it is registered, and changes to DONE (complete), ERROR (error), or RETRY (retrying) as the external reputation lookup proceeds.

If the risk, reputation, or status field has no value yet (for example, before a risk level has been calculated), the field itself is not included in the result.

Examples

Retrieve the full list of indicators of compromise
```
maestro-indicators
```
Filter by a specific type
```
maestro-indicators type="ip, domain"
```
Retrieves only indicators of compromise of the IP address and domain types.

Retrieve only high-risk indicators of compromise

maestro-indicators
| search risk == "HIGH"
| fields type, value, reputation, last_seen

Aggregate the count of indicators of compromise by type

maestro-indicators
| stats count by type
| sort -count

Change history

The maestro-indicators command is available in the Sonar 4.0 series starting with 4.0.2609.0, where the command previously provided by the Experimental app was built into Sonar core. On versions without the built-in command, install the Experimental app to use it. The Experimental app provides it under the name sonar-indicators.