radql_query
Execute RadQL queries to filter, search, and analyze security data in Kubernetes environments for investigations and aggregations.
Instructions
Execute RadQL queries for security investigations. Supports: list (filter/search), get_by_id (single item), stats (aggregations).
WORKFLOW: radql_list_data_types -> radql_get_type_metadata -> radql_query
COMMON FIELDS BY DATA TYPE: containers: name, image_name, image_repo, owner_kind, cluster_id, created_at Example: image_name:nginx AND owner_kind:Pod
finding_groups: type, source_kind, source_name, rule_title, severity, event_timestamp Types: k8s_misconfiguration, k8s_audit_logs_anomaly, threat_vector Example: type:k8s_misconfiguration AND severity:critical
inbox_items: severity (High|Medium|Low), type, title, archived, false_positive, created_at Example: severity:High AND archived:false
kubernetes_resources: kind, name, namespace, cluster_id, owner_kind, created_at Example: kind:Deployment AND namespace:production
CRITICAL QUOTING RULES: MUST quote when value contains:
Dates/timestamps: created_at>"2024-01-01" (NOT created_at>2024-01-01)
Hyphens: cluster_id:"abc-123-def", name:"kube-system"
UUIDs: id:"550e8400-e29b-41d4-a716-446655440000"
Spaces: title:"my alert"
Special chars: :, =, <, >, !, (, )
Wildcards with hyphens: name:"kube-*"
OK to leave unquoted:
Simple strings: status:active, kind:Pod
Numbers: count:123
Booleans: archived:true
Simple wildcards: name:nginx*
For complete schema: call radql_get_type_metadata with target data_type
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data_type | Yes | The data type to query (e.g., 'containers', 'kubernetes_resources', 'inbox_items'). Use radql_list_data_types to discover available types. | |
| operation | Yes | The operation to perform: 'list' for filtering/searching, 'get_by_id' for single item, 'stats' for aggregations | |
| filters_query | No | RadQL filter query (e.g., 'severity:High AND type:misconfiguration'). Used for filtering results. | |
| stats_query | No | RadQL analytics query (e.g., 'count() by severity'). Used for aggregations and grouping. | |
| id | No | The ID of a specific item to retrieve (for get_by_id operation) | |
| limit | No | Maximum number of results to return | |
| offset | No | Pagination offset | |
| include_relations | No | Relations to include (e.g., ['owner'] for containers to include Kubernetes owner resource) |