sonar-address-objects

Retrieves the list of address objects included in the specified address group (formerly IP blocklist).

Command properties

Property	Description
Command type	Driver query
Required permission	Administrator
License usage	Counted
Parallel execution	Not supported
Distributed execution	Not supported

Syntax

sonar-address-objects group=STR

Options

group=STR: The GUID of the address group to query. Specify the guid value retrieved with the sonar-address-groups command.

Output fields

Field	Type	Description
`guid`	string	Address object GUID (36 characters)
`ip`	ipaddr	IP address of the address object
`country`	string	Country code
`count`	integer	Occurrence count
`description`	string	Address object description
`expiry`	timestamp	Expiration time
`created`	timestamp	Creation time
`updated`	timestamp	Modification time

Error codes

Parsing errors

Error code	Message	Description
300174	No permission to enumerate address objects.	Run in a session without administrator permission
300175	Group option is required.	The `group` option was not specified
300176	Invalid group GUID format.	The `group` option value is not in GUID format

Runtime errors

Error code	Message	Description	Post-action
-	address group not found: `<group>`	The `group` option value is in valid GUID format but does not correspond to an existing address group (no formal error code)	Aborts query execution

Description

sonar-address-objects is an administrator-only command that retrieves the individual address objects included in the address group specified by the group option. Running it in a session without administrator permission, or omitting the group option, or specifying an invalid GUID format, causes an error at the parsing stage and the query does not run. If you specify a group in valid GUID format that does not actually exist, parsing succeeds but execution ends with an error.

Internally, it retrieves the full set of address objects in the group sequentially in pages of 1,000 records at a time. You should first check the guid of the target address group using the sonar-address-groups command.

Examples

Query the address objects belonging to a specific address group

sonar-address-objects group="550e8400-e29b-41d4-a716-446655440000"

Filter only address objects with an expiration time set

sonar-address-objects group="550e8400-e29b-41d4-a716-446655440000"
| search expiry not null
| fields ip, description, expiry

Query by specifying the GUID as a variable (assuming the GUID was already checked with the sonar-address-groups command)

set _group_guid = "550e8400-e29b-41d4-a716-446655440000"
| sonar-address-objects group=$("_group_guid")
| stats count by country
| sort -count

Change history

The sonar-address-objects command is available in the Sonar 4.0 series starting with 4.0.2609.0, where the command previously provided by the Experimental app was built into Sonar core. On versions without the built-in command, install the Experimental app to use it.