behavior

Queries the build data of a behavior profile stored on the Control Node. You can specify a date range to retrieve data for a specific period.

Command properties

Syntax

In the syntax above, name is available starting with 4.0.2609.0.

Options

guid=STR

Behavior profile GUID. In the 5.0 series (through 5.0.2605.2), this is the only way to specify the target. In the 4.0 series (4.0.2609.0 and later), this option cannot be used together with name, and you must specify either guid or name.

name=STR

Behavior profile name (cannot be used together with guid). You must specify either the guid or name option. This option is available starting with 4.0.2609.0.

from=DATE

Start time of the query range. Specify in yyyyMMddHHmmss format. If omitted, the query starts from the beginning of the available data.

to=DATE

End time of the query range. Specify in yyyyMMddHHmmss format. If omitted, the query runs to the end of the available data.

Output fields

The output fields are the result fields from the behavior profile's build query. The exact fields depend on each profile's build query.

Error codes

Parse errors

Runtime errors

N/A

Description

The behavior command retrieves the build result data of a behavior profile stored on the Control Node. If the behavior profile has not been built yet, no results are returned.

Use the guid option to specify which behavior profile to query. In the 4.0 series (4.0.2609.0 and later), you can also use the name option; the command looks up the profile by that name to resolve its GUID, and specifying both guid and name, or omitting both, causes an error, as does specifying a name that does not exist or that matches more than one profile.

Use the from and to options to specify a date range and retrieve data only for that period. The date format is yyyyMMddHHmmss.

Only the profile owner, users with whom the profile is shared, or administrators can run this command. Accessing a profile belonging to another tenant requires cluster administrator privileges.

Examples

1. Querying all data from a behavior profile

   behavior guid=550e8400-e29b-41d4-a716-446655440000
   

   Retrieves all available build data for the behavior profile with the specified GUID.

2. Querying data for a specific date range

   behavior guid=550e8400-e29b-41d4-a716-446655440000 from=20260101000000 to=20260317235959
   

   Retrieves behavior profile build data from January 1, 2026 to March 17, 2026.

3. Querying data from a specific start time

   behavior guid=550e8400-e29b-41d4-a716-446655440000 from=20260301000000
   

   Retrieves behavior profile build data from March 1, 2026 onward.

4. Specifying a behavior profile by name (4.0 series, 4.0.2609.0 and later)

   behavior name=web_attacker_profile
   

   Retrieves build data for the behavior profile by name instead of GUID.

Change history