Skip to main content

Cancel Scanner query

Action ID: tools.scanner.cancel_query Cancel a previously started asynchronous Scanner query. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Query run ID (qr_id) returned by tools.scanner.start_query.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

Create Scanner detection rule

Action ID: tools.scanner.create_detection_rule Create a detection rule in Scanner. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Description of the detection rule.
string
required
Scanner enabled state, such as Active, Staging, or Paused.
array[string]
required
Event sink IDs that receive alerts from this detection rule.
string
required
Name of the detection rule.
string
required
Scanner query text for the detection rule.
integer
required
Run frequency in seconds. Scanner requires minute granularity and a value no greater than time_range_s.
string
required
Detection severity accepted by Scanner, such as Information, Low, Medium, High, Critical, Fatal, or Other.
string
required
Unique identifier for the Scanner tenant.
integer
required
Lookback period in seconds. Scanner requires minute granularity.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.
string | null
Sync key used by automatic detection rule syncers.Default: null.
array[string] | null
Tags to associate with the detection rule.Default: null.

Create Scanner event sink

Action ID: tools.scanner.create_event_sink Create a Slack, webhook, or PagerDuty event sink in Scanner. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Description of the event sink.
object
required
API-native event sink configuration, such as {“Webhook”: {“url”: “https://example.com/webhook”}}.
string
required
Name of the event sink.
string
required
Unique identifier for the Scanner tenant.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

Delete Scanner detection rule

Action ID: tools.scanner.delete_detection_rule Delete a Scanner detection rule by ID. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Unique Scanner detection rule ID.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

Delete Scanner event sink

Action ID: tools.scanner.delete_event_sink Delete a Scanner event sink by ID. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Unique Scanner event sink ID.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

Get Scanner detection rule

Action ID: tools.scanner.get_detection_rule Get a Scanner detection rule by ID. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Unique Scanner detection rule ID.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

Get Scanner event sink

Action ID: tools.scanner.get_event_sink Get a Scanner event sink by ID. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Unique Scanner event sink ID.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

Get Scanner query progress

Action ID: tools.scanner.get_query_progress Poll an asynchronous Scanner query for progress and results. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Query run ID (qr_id) returned by tools.scanner.start_query.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.
boolean
Whether to return intermediate results while the query is running.Default: true.

List Scanner detection rules

Action ID: tools.scanner.list_detection_rules List detection rules for a Scanner tenant. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Unique identifier for the Scanner tenant.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.
integer | null
Maximum detection rules to return in a page. Scanner defaults to 50.Default: null.
string | null
Pagination cursor returned as next_page_token by a previous request.Default: null.

List Scanner event sinks

Action ID: tools.scanner.list_event_sinks List event sinks for a Scanner tenant. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Unique identifier for the Scanner tenant.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

Run Scanner detection YAML tests

Action ID: tools.scanner.run_detection_rule_yaml_tests Run tests declared in a Scanner detection rule YAML document. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/validating-yaml-files

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Detection rule YAML content whose tests should be run.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

Run Scanner query

Action ID: tools.scanner.run_query Execute a blocking ad hoc query and return its results. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Exclusive query end timestamp in RFC 3339 format.
string
required
Scanner query text to execute.
string
required
Inclusive query start timestamp in RFC 3339 format.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.
integer | null
Maximum bytes for the result table. Scanner defaults to 134,217,728 bytes.Default: null.
integer | null
Maximum rows to return. Scanner defaults to 1,000 and allows up to 100,000.Default: null.
boolean | null
Scan from the latest events toward the earliest events.Default: null.
integer
HTTP timeout in seconds. Scanner may hold blocking queries open for up to 300 seconds.Default: 310.

Start Scanner query

Action ID: tools.scanner.start_query Start an asynchronous ad hoc query and return its query run ID. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Exclusive query end timestamp in RFC 3339 format.
string
required
Scanner query text to execute.
string
required
Inclusive query start timestamp in RFC 3339 format.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.
integer | null
Maximum bytes for the result table. Scanner defaults to 134,217,728 bytes.Default: null.
integer | null
Maximum rows to return. Scanner defaults to 1,000 and allows up to 100,000.Default: null.
boolean | null
Scan from the latest events toward the earliest events.Default: null.

Update Scanner detection rule

Action ID: tools.scanner.update_detection_rule Update a Scanner detection rule with API-native fields. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Unique Scanner detection rule ID.
object
required
Detection rule fields to update. The rule ID is added to the request body.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

Update Scanner event sink

Action ID: tools.scanner.update_event_sink Update a Scanner event sink with API-native fields. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Unique Scanner event sink ID.
object
required
Event sink fields to update. The event sink ID is added to the request body.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.

Validate Scanner detection YAML

Action ID: tools.scanner.validate_detection_rule_yaml Validate a Scanner detection rule YAML document. Reference: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/validating-yaml-files

Secrets

Required secrets:
  • scanner: required values SCANNER_API_KEY.

Input fields

string
required
Detection rule YAML content to validate.
string | null
Scanner team API URL. Falls back to VARS.scanner.base_url.Default: null.