Auto tagging using global query

Auto tagging using global query

This article provides details on how to create auto tag rules using a global query.

Currently, auto tagging using a global query can be achieved using API only. GUI based solution will be available in release 77.

Global query based auto tag rules can be created by using a POST on /tagRules API call.

upt_asset_id and tag column from the global query determine the assets to be assigned with a particular tag.

Use interval for scheduled tags rules

Use runOnce for one time tag rules.


Scheduled auto tag rule based on Global query

{
"name": 'Mac osx auto tag rule Global',
"description": 'Tag all whoose os_version is mac os x',
"query": "with latest_row as (
select
name,
upt_assets.upt_asset_id,
max(os_version.upt_time) as maxtime
from
os_version
inner join upt_assets on os_version.upt_asset_id = upt_assets.id
where
upt_day >= CAST(
date_format(
localtimestamp - INTERVAL '3' DAY, '%Y%m%d'
) AS INTEGER
)
group by
name,
upt_assets.upt_asset_id
)
select
distinct upt_asset_id,
'usmacbook' as tag
from
latest_row
where
name = 'Mac OS X'",
"interval": 3600,
"source": 'global'
}

One time tag rule

{
"name": 'Mac osx auto tag rule Global',
"description": 'Tag all whoose os_version is mac os x',
"query": "with latest_row as (
select
name,
upt_assets.upt_asset_id,
max(os_version.upt_time) as maxtime
from
os_version
inner join upt_assets on os_version.upt_asset_id = upt_assets.id
where
upt_day >= CAST(
date_format(
localtimestamp - INTERVAL '3' DAY, '%Y%m%d'
) AS INTEGER
)
group by
name,
upt_assets.upt_asset_id
)
select
distinct upt_asset_id,
'usmacbook' as tag
from
latest_row
where
name = 'Mac OS X'",
"runOnce": true,
"source": 'global'
}


    • Related Articles

    • SQL Query Best Practices

      This document gives some best practices for writing high quality, performance optimized SQL queries. TABLE OF CONTENTS Mandatory Practices Tips and Tricks Mandatory Practices Avoid SELECT * when feasible. Uptycs uses Presto, which is a columnar DB, ...
    • Query filter based on tags

      Following are different ways to query for tags assigned using SQL. Check for key WHERE Array_position(Map_keys(pe.upt_asset_tags), '<key>') > 0      e.g.     WHERE  Array_position(Map_keys(pe.upt_asset_tags), 'local_asset') > 0 WHERE ...
    • Tips for designing Investigate query parameters

      Query parameters allow users to create variables to be used in an individual query and can be referenced multiple times within the query. This feature facilitates writing queries that often refer to changing values the user would otherwise have to ...
    • Installing Uptycs Agent on MacOS using JAMF

      Overview This document outlines the procedure on how to install the Uptycs osquery agent on macOS using JAMF. Procedure  Installation Download the installer. Login to JAMF. You must have a JAMF Plus plan to be able to deploy custom macOS packages     ...
    • osqueryd Flags and command line guide

      $ sudo osqueryd --help Password: osquery 3.3.2.45-Uptycs, your OS as a high-performance relational database Usage: osqueryd [OPTION]...  osquery command line flags: --flagfile PATH Line-delimited file of additional flags --D Run as a daemon process ...