Skip to main content

​
Cancel Scanner query

Action ID: tools.scanner.cancel_query Cancel a previously started asynchronous Scanner query. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Query run ID (qr_id) returned by tools.scanner.start_query.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

​
Create Scanner detection rule

Action ID: tools.scanner.create_detection_rule Create a detection rule in Scanner. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Description of the detection rule.
​
string
required
Scanner enabled state, such as Active, Staging, or Paused.
​
array[string]
required
Event sink IDs that receive alerts from this detection rule.
​
string
required
Name of the detection rule.
​
string
required
Scanner query text for the detection rule.
​
integer
required
Run frequency in seconds. Scanner requires minute granularity and a value no greater than time_range_s.
​
string
required
Detection severity accepted by Scanner, such as Information, Low, Medium, High, Critical, Fatal, or Other.
​
string
required
Unique identifier for the Scanner tenant.
​
integer
required
Lookback period in seconds. Scanner requires minute granularity.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.
​
string | null
Sync key used by automatic detection rule syncers.Default: null.
​
array[string] | null
Tags to associate with the detection rule.Default: null.

​
Create Scanner event sink

Action ID: tools.scanner.create_event_sink Create a Slack, webhook, or PagerDuty event sink in Scanner. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Description of the event sink.
​
object
required
API-native event sink configuration, such as {“Webhook”: {“url”: “https://example.com/webhook”}}.
​
string
required
Name of the event sink.
​
string
required
Unique identifier for the Scanner tenant.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

​
Delete Scanner detection rule

Action ID: tools.scanner.delete_detection_rule Delete a Scanner detection rule by ID. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Unique Scanner detection rule ID.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

​
Delete Scanner event sink

Action ID: tools.scanner.delete_event_sink Delete a Scanner event sink by ID. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Unique Scanner event sink ID.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

​
Get Scanner detection rule

Action ID: tools.scanner.get_detection_rule Get a Scanner detection rule by ID. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Unique Scanner detection rule ID.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

​
Get Scanner event sink

Action ID: tools.scanner.get_event_sink Get a Scanner event sink by ID. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Unique Scanner event sink ID.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

​
Get Scanner query progress

Action ID: tools.scanner.get_query_progress Poll an asynchronous Scanner query for progress and results. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Query run ID (qr_id) returned by tools.scanner.start_query.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.
​
boolean
Whether to return intermediate results while the query is running.Default: true.

​
List Scanner detection rules

Action ID: tools.scanner.list_detection_rules List detection rules for a Scanner tenant. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Unique identifier for the Scanner tenant.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.
​
integer | null
Maximum detection rules to return in a page. Scanner defaults to 50.Default: null.
​
string | null
Pagination cursor returned as next_page_token by a previous request.Default: null.

​
List Scanner event sinks

Action ID: tools.scanner.list_event_sinks List event sinks for a Scanner tenant. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Unique identifier for the Scanner tenant.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

​
Run Scanner detection YAML tests

Action ID: tools.scanner.run_detection_rule_yaml_tests Run tests declared in a Scanner detection rule YAML document. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/validating-yaml-files

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Detection rule YAML content whose tests should be run.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

​
Run Scanner query

Action ID: tools.scanner.run_query Execute a blocking ad hoc query and return its results. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Exclusive query end timestamp in RFC 3339 format.
​
string
required
Scanner query text to execute.
​
string
required
Inclusive query start timestamp in RFC 3339 format.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.
​
integer | null
Maximum bytes for the result table. Scanner defaults to 134,217,728 bytes.Default: null.
​
integer | null
Maximum rows to return. Scanner defaults to 1,000 and allows up to 100,000.Default: null.
​
boolean | null
Scan from the latest events toward the earliest events.Default: null.
​
integer
HTTP timeout in seconds. Scanner may hold blocking queries open for up to 300 seconds.Default: 310.

​
Start Scanner query

Action ID: tools.scanner.start_query Start an asynchronous ad hoc query and return its query run ID. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Exclusive query end timestamp in RFC 3339 format.
​
string
required
Scanner query text to execute.
​
string
required
Inclusive query start timestamp in RFC 3339 format.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.
​
integer | null
Maximum bytes for the result table. Scanner defaults to 134,217,728 bytes.Default: null.
​
integer | null
Maximum rows to return. Scanner defaults to 1,000 and allows up to 100,000.Default: null.
​
boolean | null
Scan from the latest events toward the earliest events.Default: null.

​
Update Scanner detection rule

Action ID: tools.scanner.update_detection_rule Update a Scanner detection rule with API-native fields. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Unique Scanner detection rule ID.
​
object
required
Detection rule fields to update. The rule ID is added to the request body.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

​
Update Scanner event sink

Action ID: tools.scanner.update_event_sink Update a Scanner event sink with API-native fields. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Unique Scanner event sink ID.
​
object
required
Event sink fields to update. The event sink ID is added to the request body.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

​
Validate Scanner detection YAML

Action ID: tools.scanner.validate_detection_rule_yaml Validate a Scanner detection rule YAML document. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/validating-yaml-files

​
Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

​
Input fields

​
string
required
Detection rule YAML content to validate.
​
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.