Skip to main content

Datasource Information

This topic describes how to use the Lacework CLI and API to get information about datasources that you can access through LQL. Then you can use the datasource information to configure queries.


For information on available datasources, see the Datasource Metadata knowledge base article. (Requires customer login.)

Use the Lacework CLI

If you are new to the Lacework CLI, see Get Started to learn about installing and configuring the CLI.

List All Datasources

The easiest way to learn about the LQL datasources is to discover the names of the datasources and then get details about the one you are interested in.

To list all datasources, run this command:

lacework query list-sources

To list all AWS datasources, run:

lacework query list-sources | grep AWS

List Datasource Details

To list the details for a specific datasource, run this command:

lacework query show-source <datasource>

Preview Events for a Datasource

For some datasources, you can run the following command to show a preview of a sample event for the datasource.

lacework query preview-source <datasource>

Use the Lacework API

All Lacework endpoints require an API access (bearer) token to be specified when you invoke the endpoint. If you already have a secret key, you can use the POST /api/v2/access/tokens endpoint to generate an access token. For details, see API Access Keys and Tokens.

List All Datasources

To list all available datasources and their metadata, use the following endpoint:


List Datasource Details

To list the metadata for a specific datasource based on the datasource name, use the following endpoint: