Live queries
Ask your agents a question and see the answer per host within seconds. Is Remote Desktop off? Which hosts listen on port 3389? What does PasswordAuthentication say in sshd_config? Schedule the question and every change lands in an index, ready for an alert.
Overview
Live queries live on the Agents page, tab Live queries. A query uses the same signed, read-only building blocks as the vulnerability sensors. The agent reads, your LogPulse environment judges the answer. There is never a script.
Requirements
| What | Needs |
|---|---|
| Live queries | Agent 0.9.3 or later, every plan. Permission agents:update |
| Scheduled queries | Agent 0.9.3 or later, Pro or Business. Permission agents:query |
| Firewall rules and "all listening ports" | Agent 0.9.3 or later |
Ask a question
Pick the hosts (all agents, groups or single agents), choose what to look at and press Run now. The question goes straight to connected agents over their open connection; each agent answers once. A live query stays open for 24 hours, so hosts that come online later still answer.
What you can ask
| In the form | Building block | Compare versions |
|---|---|---|
| Installed software | package | Yes |
| A setting in a config file | file_regex for Key value or key = value | No |
| A registry value | registry (Windows) | Yes |
| A file | file (one * per folder) | Windows (PE version) |
| Text in a file | file_regex (RE2) | No |
| A running process | process | No |
| A listening port | port (empty: every listening TCP port) | No |
| Firewall rules | firewall: rules with a port from Windows Firewall, ufw or firewalld, such as block in tcp/23 | No |
| A Java library | archive (live only) | Yes |
Show or check
Show the value lists the value per host, and on top how many hosts have which value. Click a value to see the hosts.
Check a value adds an expected value (is, is not, contains, matches, more than, less than, exists, absent). Every host is As expected or Not as expected. All values found must match: one sshd include with yes makes the host Not as expected. An agent that may not read a path answers Could not check, never Not found.
Templates
Use a template fills the form in one click. A selection:
| Template | Hosts |
|---|---|
| Open ports per host | Linux, Windows |
| Ports the firewall blocks / lets in | Linux, Windows |
| Remote Desktop is off, requires NLA | Windows |
| SMBv1 server is off | Windows |
| Defender real-time protection is not turned off by policy | Windows |
| Windows Firewall domain profile is on | Windows |
| SSH does not accept passwords, no root login with a password | Linux |
| Remote access tools that run (AnyDesk, TeamViewer, ScreenConnect, RustDesk) | Linux, Windows |
| Telnet or FTP listens | Linux, Windows |
| Browser versions per host | Linux, Windows |
Scheduled queries
Press Schedule to keep a query running every hour, every six hours or every day. Pick the index the answers go to. A changed expected value judges the stored answers again right away. The host sheet on the Agents page shows the current answer under Scheduled queries.
Events and alerts
On every change, and otherwise once a day per host, a scheduled query writes a state event:
index=<your index> sourcetype=agent_query event_type=state query_id=<uuid>
state, value, values, added, removed, expected_op, expected_value, changedFor every value that appears or disappears there is also a change event with change=added|removed, the value, and the parsed fields port, protocol, firewall_action and direction. Alert on them like on any other search:
sourcetype=agent_query event_type=change change=added primitive=port
sourcetype=agent_query event_type=change change=added primitive=firewall firewall_action=allow
sourcetype=agent_query event_type=change change=removed primitive=firewall firewall_action=blockSafety
Only the fixed read-only building blocks of the agent run: no shell, PowerShell, WMI or script. Paths, keys and patterns that look like secrets are refused. The allowlist of the host in sensors.conf also applies to queries, and an agent in restricted mode only reads what its own user may read.
API
| Call | What it does |
|---|---|
POST /api/v1/fleet/questions | A live query with targets (agentIds, groupIds; empty is all agents) and an optional check |
POST /api/v1/agent-queries/scheduled | A scheduled query with intervalMinutes (60, 360 or 1440) and index |
PATCH / DELETE on a scheduled query | Change, pause or remove it |
Limits
| Limit | Value |
|---|---|
| New live queries | 30 per hour |
| Open live queries | 10 per organization |
| Active scheduled queries | 50 per organization |
| Performance questions (CPU, memory, disk) | Not yet |