Entity Selectors → Smartscape DQL

Entity Selectors → Smartscape DQL

Gen2 entity selectors were a mini-language for finding entities. Gen3 replaces them with DQL queries against Smartscape.

Migration Examples

GEN2 Entity Selector                    GEN3 DQL
──────────────────────────────────────  ──────────────────────────────────────
type(HOST)                              smartscapeNodes "HOST"

type(HOST),tag("env:prod")              smartscapeNodes "HOST"
                                        | filter matchesValue(dt.tags, "env:prod")

type(SERVICE),entityName("login")       smartscapeNodes "SERVICE"
                                        | filter name == "login"

type(HOST),                             smartscapeNodes "HOST"
  fromRelationships.isInstanceOf(       | traverse "runs_on", "SERVICE",
    type(SERVICE),entityName("web"))       direction: backward
                                        | filter name == "web"

Common Entity Queries

// List all hosts with OS and cloud provider
smartscapeNodes "HOST"
| fieldsAdd os.type, cloud.provider, host.logical.cpu.cores
| fields name, os.type, cloud.provider, host.logical.cpu.cores

// Find services on a specific host
smartscapeNodes "HOST"
| filter name == "my-host"
| traverse "runs_on", "SERVICE", direction: backward
| fields name, id

// List K8s pods in a namespace
smartscapeNodes "K8S_POD"
| filter k8s.namespace.name == "production"
| fields k8s.cluster.name, k8s.pod.name, k8s.workload.name

// Find AWS EC2 instances
smartscapeNodes "AWS_EC2_INSTANCE"
| fieldsAdd aws.region, aws.account.id
| fields name, aws.region, aws.account.id

Relationship Traversal Cheat Sheet

From → To                               Traverse Command
──────────────────────────────────────  ──────────────────────────────────────
HOST → services running on it           traverse "runs_on", "SERVICE", direction: backward
SERVICE → host it runs on               traverse "runs_on", "HOST"
HOST → processes                        traverse "runs_on", "PROCESS", direction: backward
K8S_POD → containers                    traverse "is_part_of", "CONTAINER", direction: backward
LB → target groups                      traverse "balanced_by", direction: backward
EC2 → security groups                   traverse "uses", "AWS_EC2_SECURITYGROUP"
RDS → KMS key                           traverse "uses", "AWS_KMS_KEY"