sonar-address-groups

Retrieves the list of address groups registered in Logpresso Sonar. You can use the keywords option to search by name or description.

Command properties

Property	Description
Command type	Driver query
Required permission	Administrator
License usage	Counted
Parallel execution	Not supported
Distributed execution	Not supported

Syntax

sonar-address-groups [keywords=STR]

Options

keywords=STR: Searches for a keyword contained in the name or description. If you separate multiple words with spaces, only address groups that contain all the words are returned.

Output fields

Field	Type	Description
`guid`	string	Address group GUID (36 characters)
`name`	string	Address group name
`description`	string	Address group description
`count`	long	Number of addresses in the group
`version`	long	Version number
`created`	string	Creation time. Returned as a string in `yyyy-MM-dd HH:mm:ssZ` format (not a timestamp type)
`updated`	string	Last update time. Returned as a string in `yyyy-MM-dd HH:mm:ssZ` format (not a timestamp type)
`share`	boolean	Whether sharing is configured. A conditional field not listed in the column order definition; it appears only for groups configured as shared, and is displayed after the other columns in the result table (groups that are not shared do not have this field at all)

Error codes

Parsing errors

Error code	Message	Description
300173	No permission to enumerate address groups.	Run in a session without administrator permission

Runtime errors

N/A

Description

sonar-address-groups is an administrator-only command that retrieves the list of address groups (formerly IP blocklists) registered in Logpresso Sonar. Running it in a session without administrator permission causes an error at the parsing stage and the query does not run.

Internally, it retrieves the full list of address groups sequentially in pages of 1,000 records at a time. You can use the retrieved guid in the group option of the sonar-address-objects command to query the individual address objects in a group, or in the guid option of the sonar-add-address-batch and sonar-remove-address-batch commands to add or remove addresses in bulk.

Examples

Retrieve all registered address groups
```
sonar-address-groups
```
Search for address groups whose name or description contains a specific keyword
```
sonar-address-groups keywords="block"
| fields guid, name, count, updated
```

Filter groups with 100 or more registered addresses

sonar-address-groups
| search count >= 100
| sort -count

Change history

The sonar-address-groups command is available in the Sonar 4.0 series starting with 4.0.2609.0, where the command previously provided by the Experimental app was built into Sonar core. On versions without the built-in command, install the Experimental app to use it.