node-pattern-group

Queries pattern group data downloaded to the Data Node through the policy synchronization module.

Command properties

Property	Description
Command type	Driver
Required permission	Administrator
License usage	Not counted
Parallel execution	Not supported
Distributed execution	Not supported

Syntax

node-pattern-group [guid=STR] [name=STR]

In the syntax above, name is available starting with 4.0.2609.0.

Options

guid=STR: Pattern group GUID. In the 5.0 series (through 5.0.2605.2), this is the only way to specify a pattern group. In the 4.0 series (4.0.2609.0 and later), it cannot be used together with name. When specified, queries the pattern entries included in that pattern group. When omitted, lists a summary of all pattern groups.
name=STR: Pattern group name (cannot be used together with guid). When specified, queries the pattern entries included in that pattern group. When omitted, lists a summary of all pattern groups. This option is available starting with 4.0.2609.0.

Output fields

When either the guid or name option is specified:

Field	Type	Description
`expr`	string	Pattern expression
`expr2`	string	Secondary pattern expression
`rule`	string	Rule name
`app_code`	string	App code
`app_built_in`	boolean	Whether this is a built-in app

When both the guid and name options are omitted:

Field	Type	Description
`id`	integer	Pattern group ID
`guid`	string	Pattern group GUID
`name`	string	Pattern group name
`description`	string	Pattern group description
`pattern_count`	integer	Number of pattern entries
`user_name`	string	Creator name
`user_guid`	string	Creator GUID

Error codes

Parse errors

Error code	Message	Description
300320	no permission for node-pattern-group	Administrator privileges are required.
300321	invalid guid format for node-pattern-group	The `guid` option value is not a valid GUID format.
300322	pattern group [guid] not found for node-pattern-group	No pattern group exists for the specified GUID.
300323	Pattern group not found by name for node-pattern-group.	No pattern group exists with the name specified in the `name` option. Available starting with 4.0.2609.0, which has the `name` option.
300324	Duplicate pattern group name for node-pattern-group.	More than one pattern group exists with the name specified in the `name` option. Available starting with 4.0.2609.0, which has the `name` option.
300325	Specify only one of 'guid' or 'name' option in the node-pattern-group command.	Both the `guid` and `name` options are specified. Available starting with 4.0.2609.0, which has the `name` option.
300326	Cannot load pattern group for node-pattern-group.	An error occurred while reading data while querying by the `name` option. Available starting with 4.0.2609.0, which has the `name` option.

Runtime errors

None

Description

The node-pattern-group command queries pattern group data downloaded from the Control Node to the Data Node through the policy synchronization module.

When either the guid or name option is specified, it returns the individual pattern entries (expression, secondary expression, rule) included in that pattern group. When both options are omitted, it returns a summary list of all synchronized pattern groups (name, GUID, pattern count, etc.).

In the 4.0 series (4.0.2609.0 and later), you can use the name option to specify a pattern group by name instead of GUID. Specifying both options at the same time causes an error, as does specifying a name that does not exist or that matches more than one group.

Examples

List all pattern groups
```
node-pattern-group
```
Queries the summary information of all pattern groups synchronized to the Data Node.
Query pattern entries of a specific pattern group
```
node-pattern-group guid=550e8400-e29b-41d4-a716-446655440000
```
Queries the pattern entries included in the pattern group with the specified GUID.
Query pattern entries of a pattern group by name (4.0 series, 4.0.2609.0 and later)
```
node-pattern-group name=sql_injection
```
Queries the pattern entries included in the pattern group with the specified name.

Change history

Target	Introduced in
The `node-pattern-group` command	Before Sonar 4.0
The `name` option	4.0.2609.0