{"resources":{"arista":{"id":"arista","fields":{"eos":{"name":"eos","type":"\u001barista.eos","title":"Arista EOS network operating system","desc":"Top-level entry point for an Arista EOS device. Exposes system identity (hostname, FQDN, software/hardware version), the data-plane and management surfaces (interfaces, IP interfaces, switchports, VLANs, routes, BGP, MLAG, ACLs), the management-plane services (SSH, telnet, SNMP, NTP), the AAA stack, control-plane policing, and the local user / role / password-policy hardening that auditors check against network-device benchmarks.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true}},"is_extension":true},"arista.eos":{"id":"arista.eos","name":"arista.eos","fields":{"aaa":{"name":"aaa","type":"\u001barista.eos.aaa","title":"AAA (Authentication, Authorization, Accounting) configuration","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"acl":{"name":"acl","type":"\u001barista.eos.acl","title":"Arista EOS IP access control list","desc":"A single access control list, selected by `name` and optionally `family` (for example `arista.eos.acl(name: \"MGMT-ACCESS\")`, or `arista.eos.acl(name: \"MGMT\", family: \"ipv6\")` when an IPv4 and an IPv6 list share a name). Covers the standard, extended, and IPv6 forms: `family` reports whether the list matches IPv4 or IPv6 traffic and `type` reports whether it matches on source address alone (standard) or on the full five-tuple (extended).  The ordered `entries` give each rule's action, protocol, source and destination, port matches, and per-rule logging. To find where a list is actually applied, and therefore what it protects, see `arista.eos.aclBindings`.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"aclBinding":{"name":"aclBinding","type":"\u001barista.eos.aclBinding","title":"Arista EOS access-list binding","desc":"One place an access-list is applied. Knowing which access-lists exist says nothing about what they protect: a list that is written but never applied filters nothing, and a question like \"is management access restricted to the admin network?\" cannot be answered from the rules alone.  `target` reports what the list is bound to, one of `interface`, `managementSsh`, `managementTelnet`, `managementApi`, or `controlPlane`. `targetName` carries the interface name for interface bindings and is empty for the management services and the control plane, which are singletons. `acl` resolves to the list itself, so a single query can walk from a binding to the rules it enforces.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"aclBindings":{"name":"aclBindings","type":"\u0019\u001barista.eos.aclBinding","title":"Every place an access-list is applied","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"acls":{"name":"acls","type":"\u0019\u001barista.eos.acl","title":"IP access control lists (standard, extended, and IPv6)","min_provider_version":"13.0.1","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arpInspection":{"name":"arpInspection","type":"\u001barista.eos.arpInspection","title":"Dynamic ARP Inspection configuration and trusted ports","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"bgp":{"name":"bgp","type":"\u001barista.eos.bgp","title":"BGP configuration and peers","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"bootConfig":{"name":"bootConfig","type":"\u001barista.eos.bootConfig","title":"Boot image and console configuration","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"configSavedToStartup":{"name":"configSavedToStartup","type":"\u0004","title":"Whether the running configuration has been saved to startup","desc":"False when the running and saved configurations differ, meaning the device would come back from a reboot in a different state than it is in now. Comparison ignores comment lines, blank lines, and trailing whitespace, since those differ between two renderings of identical content.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"controlPlanePolicer":{"name":"controlPlanePolicer","type":"\u001barista.eos.controlPlanePolicer","title":"Control-Plane Policing (CoPP) configuration","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"dhcpSnooping":{"name":"dhcpSnooping","type":"\u001barista.eos.dhcpSnooping","title":"DHCP snooping configuration and trusted ports","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"dot1x":{"name":"dot1x","type":"\u001barista.eos.dot1x","title":"802.1X port-based network access control","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"eapi":{"name":"eapi","type":"\u001barista.eos.eapi","title":"eAPI (management API) service configuration","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"eventHandler":{"name":"eventHandler","type":"\u001barista.eos.eventHandler","title":"Arista EOS event handler","desc":"A configured reaction to a device event, selected by `name`. An event-handler whose `actionType` is `bash` runs an arbitrary shell command on the switch whenever its trigger fires, which makes it the closest thing the platform has to a cron backdoor: an `on-boot` trigger paired with a bash action re-executes on every reboot and survives most remediation.  `action` carries the command text in full, because what the command does is the whole question. Enumerating handlers and reading their actions is the point of this resource.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"eventHandlers":{"name":"eventHandlers","type":"\u0019\u001barista.eos.eventHandler","title":"Event handlers, the configured reactions to device events","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"extension":{"name":"extension","type":"\u001barista.eos.extension","title":"Arista EOS installed extension","desc":"An RPM package installed onto the switch, selected by `name`. Extensions are how third-party and in-house software gets onto EOS, so each one is code running on a network device from outside the vendor image and the installed set is worth inventorying.  `presence` and `status` answer different questions: an extension file can be on the device without being activated, and one activated now but not configured to install at boot disappears on the next reload.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"extensions":{"name":"extensions","type":"\u0019\u001barista.eos.extension","title":"Installed EOS extensions","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"fqdn":{"name":"fqdn","type":"\u0007","title":"Fully qualified domain name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"hardware":{"name":"hardware","type":"\u001barista.eos.hardware","title":"Hardware environment and inventory","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"hostname":{"name":"hostname","type":"\u0007","title":"System hostname","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interface":{"name":"interface","type":"\u001barista.eos.interface","title":"Arista EOS network interface","desc":"Physical or logical interface on the switch, selected by `name` (for example `arista.eos.interfaces.where(name == \"Ethernet1\")`). Exposes administrative and line-protocol status, IP addressing, MTU and layer-2 MTU, hardware and burned-in MAC addresses, the forwarding model, and traffic and error counters. Use it to audit which interfaces are enabled, how they are addressed, and their operational state.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"interfaces":{"name":"interfaces","type":"\u0019\u001barista.eos.interface","title":"All network interfaces","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ipInterface":{"name":"ipInterface","type":"\u001barista.eos.ipInterface","title":"Arista EOS IP interface","desc":"A Layer 3 IP interface configured on the switch, covering routed Ethernet ports, VLAN (SVI) interfaces, loopbacks, and management interfaces. The `name` field selects the interface as it appears in the running-config, for example `Ethernet1`, `Vlan10`, `Loopback0`, or `Management1`. Use it to audit which interfaces carry an IP address, the addresses assigned, and the configured MTU.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"ipInterfaces":{"name":"ipInterfaces","type":"\u0019\u001barista.eos.ipInterface","title":"IP-enabled interfaces with addresses","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"logging":{"name":"logging","type":"\u001barista.eos.logging","title":"System logging (syslog) configuration and remote collectors","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"loginBanner":{"name":"loginBanner","type":"\u0007","title":"Login banner shown before authentication","desc":"Literal banner text from the `banner login` block, including its indentation. This is the notice-and-consent text a user sees before supplying credentials, so it is what banner-content requirements are checked against. Empty when no login banner is configured.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"mlag":{"name":"mlag","type":"\u001barista.eos.mlag","title":"MLAG high-availability configuration","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"monitorSession":{"name":"monitorSession","type":"\u001barista.eos.monitorSession","title":"Arista EOS port-mirroring session","desc":"A port-mirroring session, selected by `name`. A session copies production traffic somewhere else, which is a normal troubleshooting tool and also the cleanest way to take traffic off a switch without touching a host.  `destinationInterfaces` keeps the copy on the device; `tunnelDestinations` does not. An encapsulated session sends mirrored traffic to a remote address, so any entry there is worth an explanation.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"monitorSessions":{"name":"monitorSessions","type":"\u0019\u001barista.eos.monitorSession","title":"Port-mirroring sessions","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"motdBanner":{"name":"motdBanner","type":"\u0007","title":"Message-of-the-day banner shown after authentication","desc":"Literal banner text from the `banner motd` block, including its indentation. Empty when no MOTD banner is configured.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ntp":{"name":"ntp","type":"\u001barista.eos.ntp","title":"NTP configuration and authentication state","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ntpAuthKey":{"name":"ntpAuthKey","type":"\u001barista.eos.ntpAuthKey","title":"Arista EOS NTP authentication key","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"passwordPolicy":{"name":"passwordPolicy","type":"\u001barista.eos.passwordPolicy","title":"Password policy and account-lockout configuration","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"portSecurity":{"name":"portSecurity","type":"\u0019\u001barista.eos.portSecurity","title":"Per-interface switchport port-security configurations","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"prefixList":{"name":"prefixList","type":"\u001barista.eos.prefixList","title":"Arista EOS prefix-list","desc":"A named list of prefixes referenced by routing policy, selected by `name` and `family`. The two address families are separate namespaces and can share a name.  The prefix-length qualifiers on each entry matter as much as the prefixes: a rule with a wide `le` accepts far more than its prefix suggests, and `permit 0.0.0.0/0 le 32` accepts every route there is.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"prefixLists":{"name":"prefixLists","type":"\u0019\u001barista.eos.prefixList","title":"Prefix-lists referenced by routing policy","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"role":{"name":"role","type":"\u001barista.eos.role","title":"Arista EOS command-authorization role","desc":"Named role that restricts which CLI commands the users assigned to it may run, the building block of role-based access control on EOS. Each role carries an ordered list of permit and deny rules matched against command text (see `rules`), and `default` marks the role applied to users who have no role of their own. Auditing roles confirms that privileged commands are limited to the operators who should have them.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"roles":{"name":"roles","type":"\u0019\u001barista.eos.role","title":"User-defined and built-in roles","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"route":{"name":"route","type":"\u001barista.eos.route","title":"Arista EOS IP route","desc":"Single entry in the IP routing table, selected by its `destination` prefix (for example `arista.eos.routes.where(destination == \"10.0.0.0/8\")`): the VRF it belongs to, the source protocol (connected, static, BGP, OSPF, and so on), the administrative distance and metric, the hardware-programmed and kernel-programmed flags, the next-hop list, the route action, and an `active` flag indicating whether the route is currently in use for forwarding.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"routeMap":{"name":"routeMap","type":"\u001barista.eos.routeMap","title":"Arista EOS route-map","desc":"A named routing policy, selected by `name` (for example `arista.eos.routeMaps.where(name == \"IMPORT-FILTER\")`), made of ordered clauses in `entries`. Route-maps decide which routes a device accepts from and announces to its neighbors, so they are where a routing leak is either prevented or created.  The last clause usually decides the posture: a map whose final clause is a bare `deny` rejects everything the earlier clauses did not explicitly accept, while a map with no deny clause accepts the remainder.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"routeMaps":{"name":"routeMaps","type":"\u0019\u001barista.eos.routeMap","title":"Route-maps, the named routing policies applied to routing adjacencies","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"routes":{"name":"routes","type":"\u0019\u001barista.eos.route","title":"IP routing table entries","min_provider_version":"11.1.0","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"runningConfig":{"name":"runningConfig","type":"\u001barista.eos.runningConfig","title":"Arista EOS running-config (full device configuration)","desc":"Full running-configuration text as emitted by `show running-config`. `content` is the entire config as one string; use it for pattern matching or line-oriented audits, or as a fall-through when no more specific resource exists. To inspect a single block of the configuration use `arista.eos.runningConfig.section(name: \"\u003cheader\u003e\")`.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"schedule":{"name":"schedule","type":"\u001barista.eos.schedule","title":"Arista EOS scheduled task","desc":"A recurring command the device runs on its own, selected by `name`. Like an event handler, a schedule whose `command` starts with `bash` executes a shell command on the switch, on a timer, with no operator present.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"schedules":{"name":"schedules","type":"\u0019\u001barista.eos.schedule","title":"Recurring commands the device runs on its own","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"sflow":{"name":"sflow","type":"\u001barista.eos.sflow","title":"sFlow sampling configuration and collectors","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"snmp":{"name":"snmp","type":"\u001barista.eos.snmpSetting","title":"SNMP configuration","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"snmpCommunities":{"name":"snmpCommunities","type":"\u0019\u001barista.eos.snmpCommunity","title":"SNMPv1/v2c community strings (plaintext shared secrets)","min_provider_version":"13.1.9","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"snmpCommunity":{"name":"snmpCommunity","type":"\u001barista.eos.snmpCommunity","title":"Arista EOS SNMPv1/v2c community string configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"snmpSetting":{"name":"snmpSetting","type":"\u001barista.eos.snmpSetting","title":"Arista EOS SNMP daemon configuration","desc":"SNMP daemon state on the switch, covering whether SNMP logging is enabled and which trap notifications the device is configured to send. For SNMPv1 / v2c community strings (a common hardening finding) see `arista.eos.snmpCommunities`.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"spt":{"name":"spt","type":"\u001barista.eos.spt","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"sshSettings":{"name":"sshSettings","type":"\u001barista.eos.sshSettings","title":"Management SSH service configuration","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"startupConfig":{"name":"startupConfig","type":"\u001barista.eos.startupConfig","title":"Saved configuration the device loads on boot","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"stp":{"name":"stp","type":"\u001barista.eos.stp","title":"Arista EOS Spanning Tree Protocol (STP) configuration","desc":"Spanning Tree Protocol state for the device, exposing each configured Multiple Spanning Tree (MST) instance through mstInstances. Use it to audit the STP topology: which bridge is elected root, which is the regional root, and how each interface participates in loop prevention.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"switchport":{"name":"switchport","type":"\u001barista.eos.switchport","title":"Arista EOS Layer-2 switchport configuration","desc":"Layer-2 switchport state for one interface, selected by `name` (for example `arista.eos.switchports.where(name == \"Ethernet1\")`). Reports the switchport `mode` (access or trunk), the access VLAN, the trunk native VLAN, the allowed-VLAN list, and any trunk groups, so you can flag misconfigured trunks or unexpected access-VLAN assignments.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"switchports":{"name":"switchports","type":"\u0019\u001barista.eos.switchport","title":"Layer 2 switchport configurations","min_provider_version":"11.1.0","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"systemConfig":{"name":"systemConfig","type":"\u001a\u0007\u0007","title":"Global system settings parsed from the running-config","desc":"Keyed map of top-level system settings. `hostname` is the configured device hostname (defaults to `localhost` when unset), and `iprouting` is `true` or `false` reflecting whether IP routing is enabled on the device.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"telnetService":{"name":"telnetService","type":"\u001barista.eos.telnetService","title":"Management telnet service configuration (insecure plaintext protocol)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"user":{"name":"user","type":"\u001barista.eos.user","title":"Arista EOS local user account","desc":"Local user account defined by a `username` line in the running-config: login name, EOS privilege level, assigned role, password state, secret encoding, and any configured SSH key. Audits use these accounts to find privilege-15 users, accounts with no password, weak secret encodings, and stale credentials. The `locked` predicate reports accounts that can no longer authenticate.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001barista.eos.user","title":"Local user accounts","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"version":{"name":"version","type":"\n","title":"EOS software release and hardware identity","desc":"Output of `show version` as a dict. Keys covering the running image are `version`, `internalVersion`, `internalBuildId`, and `architecture`. Hardware identity keys are `modelName`, `mfgName`, `serialNumber`, `hardwareRevision`, `systemMacAddress`, `configMacAddress`, and `hwMacAddress`. Memory keys `memTotal` and `memFree` are in kilobytes, and `uptime` and `bootupTimestamp` are in seconds.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vlan":{"name":"vlan","type":"\u001barista.eos.vlan","title":"Arista EOS VLAN","desc":"Layer 2 broadcast domain configured on the switch, selected by its numeric `id` (for example `arista.eos.vlan(id: \"10\")`). Covers the VLAN name, its administrative state (active or suspend), the trunk groups it belongs to, whether it was learned dynamically, and the interfaces assigned to it, so you can audit segmentation and confirm that only expected VLANs and ports are in use.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"vlans":{"name":"vlans","type":"\u0019\u001barista.eos.vlan","title":"Configured VLANs","min_provider_version":"11.1.0","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vrrp":{"name":"vrrp","type":"\u001barista.eos.vrrp","title":"VRRP (Virtual Router Redundancy Protocol) configuration","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS network operating system","desc":"Top-level entry point for an Arista EOS device. Exposes system identity (hostname, FQDN, software/hardware version), the data-plane and management surfaces (interfaces, IP interfaces, switchports, VLANs, routes, BGP, MLAG, ACLs), the management-plane services (SSH, telnet, SNMP, NTP), the AAA stack, control-plane policing, and the local user / role / password-policy hardening that auditors check against network-device benchmarks.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.aaa":{"id":"arista.eos.aaa","name":"arista.eos.aaa","fields":{"accountingCommands":{"name":"accountingCommands","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Accounting commands method lists (key = \"\u003clevel\u003e/\u003clist\u003e\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"accountingExec":{"name":"accountingExec","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Accounting exec method lists","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"authenticationEnable":{"name":"authenticationEnable","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Authentication enable method lists","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"authenticationLogin":{"name":"authenticationLogin","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Authentication login method lists (key = list name, e.g. \"default\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"authorizationCommands":{"name":"authorizationCommands","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Authorization commands method lists (key = \"\u003clevel\u003e/\u003clist\u003e\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"authorizationConsoleCommands":{"name":"authorizationConsoleCommands","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Console command authorization method lists (key = \"\u003clevel\u003e/\u003clist\u003e\")","desc":"The console is authorized separately from remote sessions, so a device can require remote command authorization over SSH while leaving the console unauthorized. Empty means no console authorization is configured.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"authorizationExec":{"name":"authorizationExec","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Authorization exec method lists","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"defaultLoginPermitsLocalOnly":{"name":"defaultLoginPermitsLocalOnly","type":"\u0004","is_mandatory":true,"title":"Whether the default authentication list uses only the local user database (no remote AAA configured before local)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"radiusServer":{"name":"radiusServer","type":"\u001barista.eos.aaa.radiusServer","title":"Arista EOS RADIUS server","desc":"A single RADIUS server the device authenticates against, selected by its `host` address. Covers the routing instance used to reach it, the authentication and accounting ports, the timeout and retry count, and the state of the shared secret. The same effective-value and secret-handling rules as `arista.eos.aaa.tacacsServer` apply.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"radiusServerHosts":{"name":"radiusServerHosts","type":"\u0019\u001barista.eos.aaa.radiusServer","title":"RADIUS servers with their transport and shared-secret state","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"radiusServers":{"name":"radiusServers","type":"\u0019\u0007","is_mandatory":true,"title":"RADIUS server hostnames","desc":"Deprecated in favor of radiusServerHosts, which reports the same hosts along with the routing instance, ports, timeout, retransmit count, and whether the shared secret is stored in the clear.","provider":"go.mondoo.com/cnquery/v9/providers/arista","maturity":"deprecated"},"rootAccountEnabled":{"name":"rootAccountEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the root account can be logged into","desc":"The root account is the escape hatch to a shell on the underlying system. True when `aaa root secret` or `aaa root nopassword` is configured. An absent `aaa root` line leaves the account disabled, which is the shipped default.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"rootAccountNoPassword":{"name":"rootAccountNoPassword","type":"\u0004","is_mandatory":true,"title":"Whether the root account authenticates with no password","desc":"True for `aaa root nopassword`, the worst of the three root states: anyone reaching the console or a remote session can become root.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"rootSecretFormat":{"name":"rootSecretFormat","type":"\u0007","is_mandatory":true,"title":"Encoding of the root account secret","desc":"Selector from the `aaa root secret` line, for example `5` or `sha512`. Empty when root has no secret configured.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"serialConsoleAuthorization":{"name":"serialConsoleAuthorization","type":"\u0004","is_mandatory":true,"title":"Whether exec authorization extends to the serial console (`aaa authorization serial-console`)","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"serverGroup":{"name":"serverGroup","type":"\u001barista.eos.aaa.serverGroup","title":"Arista EOS AAA server group","desc":"A named set of AAA servers, selected by `name`. Method lists reference groups rather than hosts, as in `aaa authentication login default group TACACS-GROUP local`, so the group membership is what connects a method list to the servers it actually reaches. A group with no members authenticates against nothing, which makes every method list pointing at it fall through to whatever follows.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"serverGroups":{"name":"serverGroups","type":"\u0019\u001barista.eos.aaa.serverGroup","title":"Named server groups referenced by the method lists","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"tacacsServer":{"name":"tacacsServer","type":"\u001barista.eos.aaa.tacacsServer","title":"Arista EOS TACACS+ server","desc":"A single TACACS+ server the device authenticates against, selected by its `host` address. Covers the routing instance used to reach it, the port and timeout, and the state of the shared secret. `keyEncryptionType` is what hardening reviews read: `0` means the secret sits in the running-config in the clear, and `7` is a reversible obfuscation that any config reader can undo.  `timeout`, `keyConfigured`, and `keyEncryptionType` report the value in effect for this server. An option omitted from the host line falls back to the global `tacacs-server` setting, matching how the device resolves it. The shared secret itself is never read off the device.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"tacacsServerHosts":{"name":"tacacsServerHosts","type":"\u0019\u001barista.eos.aaa.tacacsServer","title":"TACACS+ servers with their transport and shared-secret state","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"tacacsServers":{"name":"tacacsServers","type":"\u0019\u0007","is_mandatory":true,"title":"TACACS+ server hostnames","desc":"Deprecated in favor of tacacsServerHosts, which reports the same hosts along with the routing instance, ports, timeout, and whether the shared secret is stored in the clear.","provider":"go.mondoo.com/cnquery/v9/providers/arista","maturity":"deprecated"}},"title":"Arista EOS AAA (Authentication, Authorization, Accounting) configuration","desc":"Authentication, authorization, and accounting (AAA) settings parsed from the running-config: the method lists that govern login and enable authentication, command and exec authorization, and command and exec accounting, plus the configured TACACS+ and RADIUS server hosts. The defaultLoginPermitsLocalOnly predicate flags when the default login list can authenticate against the switch's local account database alone with no remote AAA source, a common hardening finding where policy requires TACACS+ or RADIUS.","min_provider_version":"13.1.9","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.aaa.radiusServer":{"id":"arista.eos.aaa.radiusServer","name":"arista.eos.aaa.radiusServer","fields":{"acctPort":{"name":"acctPort","type":"\u0005","is_mandatory":true,"title":"Accounting port (1813 when the configuration omits it)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"authPort":{"name":"authPort","type":"\u0005","is_mandatory":true,"title":"Authentication port (1812 when the configuration omits it)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Server hostname or IP address as configured","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"keyConfigured":{"name":"keyConfigured","type":"\u0004","is_mandatory":true,"title":"Whether a shared secret is configured for this server","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"keyEncryptionType":{"name":"keyEncryptionType","type":"\u0007","is_mandatory":true,"title":"How the shared secret is stored","desc":"One of `0` (cleartext in the running-config), `7` (reversible type-7 obfuscation), or `8a` (a stronger hash). Empty when no secret is configured.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"retransmit":{"name":"retransmit","type":"\u0005","is_mandatory":true,"title":"Retry count (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"timeout":{"name":"timeout","type":"\u0005","is_mandatory":true,"title":"Timeout in seconds (0 = unset with no global default configured)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"Routing instance used to reach the server (empty = default VRF)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS RADIUS server","desc":"A single RADIUS server the device authenticates against, selected by its `host` address. Covers the routing instance used to reach it, the authentication and accounting ports, the timeout and retry count, and the state of the shared secret. The same effective-value and secret-handling rules as `arista.eos.aaa.tacacsServer` apply.","private":true,"min_provider_version":"13.3.15","defaults":"host vrf keyEncryptionType","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.aaa.serverGroup":{"id":"arista.eos.aaa.serverGroup","name":"arista.eos.aaa.serverGroup","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Group name as referenced by the method lists","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol the group speaks, `tacacs+` or `radius`","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"servers":{"name":"servers","type":"\u0019\u0007","is_mandatory":true,"title":"Member server hosts, in configured order","desc":"Held as addresses rather than server resources because a group's members resolve to a different resource depending on protocol.","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS AAA server group","desc":"A named set of AAA servers, selected by `name`. Method lists reference groups rather than hosts, as in `aaa authentication login default group TACACS-GROUP local`, so the group membership is what connects a method list to the servers it actually reaches. A group with no members authenticates against nothing, which makes every method list pointing at it fall through to whatever follows.","private":true,"min_provider_version":"13.3.15","defaults":"name protocol","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.aaa.tacacsServer":{"id":"arista.eos.aaa.tacacsServer","name":"arista.eos.aaa.tacacsServer","fields":{"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Server hostname or IP address as configured","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"keyConfigured":{"name":"keyConfigured","type":"\u0004","is_mandatory":true,"title":"Whether a shared secret is configured for this server","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"keyEncryptionType":{"name":"keyEncryptionType","type":"\u0007","is_mandatory":true,"title":"How the shared secret is stored","desc":"One of `0` (cleartext in the running-config), `7` (reversible type-7 obfuscation), or `8a` (a stronger hash). Empty when no secret is configured.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"TACACS+ port (49 when the configuration omits it)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"singleConnection":{"name":"singleConnection","type":"\u0004","is_mandatory":true,"title":"Whether sessions are multiplexed over a single TCP connection","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"timeout":{"name":"timeout","type":"\u0005","is_mandatory":true,"title":"Timeout in seconds (0 = unset with no global default configured)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"Routing instance used to reach the server (empty = default VRF)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS TACACS+ server","desc":"A single TACACS+ server the device authenticates against, selected by its `host` address. Covers the routing instance used to reach it, the port and timeout, and the state of the shared secret. `keyEncryptionType` is what hardening reviews read: `0` means the secret sits in the running-config in the clear, and `7` is a reversible obfuscation that any config reader can undo.  `timeout`, `keyConfigured`, and `keyEncryptionType` report the value in effect for this server. An option omitted from the host line falls back to the global `tacacs-server` setting, matching how the device resolves it. The shared secret itself is never read off the device.","private":true,"min_provider_version":"13.3.15","defaults":"host vrf keyEncryptionType","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.acl":{"id":"arista.eos.acl","name":"arista.eos.acl","fields":{"entries":{"name":"entries","type":"\u0019\u001barista.eos.acl.entry","title":"ACL entries (rules), ordered by sequence number","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"entry":{"name":"entry","type":"\u001barista.eos.acl.entry","title":"Arista EOS ACL entry (rule)","desc":"One rule inside an access-list. `text` carries the rule exactly as configured: the structured fields cover the forms the device emits, but the rule grammar accepts qualifiers that are not broken out separately, so `text` is what guarantees a rule is never reduced to less than it says.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Address family the list matches, `ipv4` or `ipv6`","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"ACL name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"ACL form","desc":"Either `standard`, which matches on source address alone, or `extended`, which matches on protocol, source, destination, and ports. A list declared without an explicit keyword is extended.","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS IP access control list","desc":"A single access control list, selected by `name` and optionally `family` (for example `arista.eos.acl(name: \"MGMT-ACCESS\")`, or `arista.eos.acl(name: \"MGMT\", family: \"ipv6\")` when an IPv4 and an IPv6 list share a name). Covers the standard, extended, and IPv6 forms: `family` reports whether the list matches IPv4 or IPv6 traffic and `type` reports whether it matches on source address alone (standard) or on the full five-tuple (extended).  The ordered `entries` give each rule's action, protocol, source and destination, port matches, and per-rule logging. To find where a list is actually applied, and therefore what it protects, see `arista.eos.aclBindings`.","min_provider_version":"13.0.1","defaults":"name family type","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.acl.entry":{"id":"arista.eos.acl.entry","name":"arista.eos.acl.entry","fields":{"aclFamily":{"name":"aclFamily","type":"\u0007","is_mandatory":true,"title":"Address family of the ACL this entry belongs to, `ipv4` or `ipv6`","desc":"Present because a name alone does not identify a list: IPv4 and IPv6 access-lists live in separate namespaces and can share a name.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"aclName":{"name":"aclName","type":"\u0007","is_mandatory":true,"title":"ACL name this entry belongs to","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Rule action","desc":"One of `permit`, `deny`, or `remark` for a comment entry.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"dstAddress":{"name":"dstAddress","type":"\u0007","is_mandatory":true,"title":"Destination IP address, or `any` for a wildcard match","desc":"Empty on standard lists, which have no destination match.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"dstPortOperator":{"name":"dstPortOperator","type":"\u0007","is_mandatory":true,"title":"Destination port match operator","desc":"One of `eq`, `neq`, `lt`, `gt`, or `range`. Empty when the rule does not match on destination port.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"dstPorts":{"name":"dstPorts","type":"\u0019\u0007","is_mandatory":true,"title":"Destination port operands for dstPortOperator","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"dstPrefixLen":{"name":"dstPrefixLen","type":"\u0005","is_mandatory":true,"title":"Destination prefix length (CIDR notation, e.g., 24 for /24)","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"established":{"name":"established","type":"\u0004","is_mandatory":true,"title":"Whether the rule matches only packets belonging to an existing TCP session","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"log":{"name":"log","type":"\u0004","is_mandatory":true,"title":"Whether logging is enabled for this rule","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol matched by the rule","desc":"For example `ip`, `tcp`, `udp`, `icmp`, `ipv6`, or a protocol number. Empty on standard lists, which match on source address alone.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"remark":{"name":"remark","type":"\u0007","is_mandatory":true,"title":"Comment text on a `remark` entry","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"sequenceNumber":{"name":"sequenceNumber","type":"\u0005","is_mandatory":true,"title":"Sequence number (determines evaluation order)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"srcAddress":{"name":"srcAddress","type":"\u0007","is_mandatory":true,"title":"Source IP address, or `any` for a wildcard match","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"srcPortOperator":{"name":"srcPortOperator","type":"\u0007","is_mandatory":true,"title":"Source port match operator","desc":"One of `eq`, `neq`, `lt`, `gt`, or `range`. Empty when the rule does not match on source port.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"srcPorts":{"name":"srcPorts","type":"\u0019\u0007","is_mandatory":true,"title":"Source port operands for srcPortOperator","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"srcPrefixLen":{"name":"srcPrefixLen","type":"\u0005","is_mandatory":true,"title":"Source prefix length (CIDR notation, e.g., 24 for /24)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"text":{"name":"text","type":"\u0007","is_mandatory":true,"title":"The rule as written, without its sequence number","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS ACL entry (rule)","desc":"One rule inside an access-list. `text` carries the rule exactly as configured: the structured fields cover the forms the device emits, but the rule grammar accepts qualifiers that are not broken out separately, so `text` is what guarantees a rule is never reduced to less than it says.","private":true,"min_provider_version":"13.0.1","defaults":"sequenceNumber action text","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.aclBinding":{"id":"arista.eos.aclBinding","name":"arista.eos.aclBinding","fields":{"acl":{"name":"acl","type":"\u001barista.eos.acl","title":"The applied access-list, resolved from aclName","desc":"Null when the binding names a list that is not defined on the device, which permits all traffic in that direction.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"aclName":{"name":"aclName","type":"\u0007","is_mandatory":true,"title":"Name of the applied access-list","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"direction":{"name":"direction","type":"\u0007","is_mandatory":true,"title":"Traffic direction, `in` or `out`","desc":"A binding written without a direction is inbound, matching how the device applies it.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Address family of the binding, `ipv4` or `ipv6`","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"What the list is applied to","desc":"One of `interface`, `managementSsh`, `managementTelnet`, `managementApi`, or `controlPlane`.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"targetName":{"name":"targetName","type":"\u0007","is_mandatory":true,"title":"Interface name for interface bindings, empty for the singleton targets","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS access-list binding","desc":"One place an access-list is applied. Knowing which access-lists exist says nothing about what they protect: a list that is written but never applied filters nothing, and a question like \"is management access restricted to the admin network?\" cannot be answered from the rules alone.  `target` reports what the list is bound to, one of `interface`, `managementSsh`, `managementTelnet`, `managementApi`, or `controlPlane`. `targetName` carries the interface name for interface bindings and is empty for the management services and the control plane, which are singletons. `acl` resolves to the list itself, so a single query can walk from a binding to the rules it enforces.","private":true,"min_provider_version":"13.3.15","defaults":"target targetName direction aclName","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.arpInspection":{"id":"arista.eos.arpInspection","name":"arista.eos.arpInspection","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Dynamic ARP Inspection covers at least one VLAN","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"trustedInterfaces":{"name":"trustedInterfaces","type":"\u0019\u0007","is_mandatory":true,"title":"Interfaces exempted from inspection (`ip arp inspection trust`)","desc":"Held as interface names, matching how the other interface-scoped resources in this provider report the ports they cover.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vlans":{"name":"vlans","type":"\u0019\u0007","is_mandatory":true,"title":"VLANs inspection is enabled on","desc":"Entries appear as configured, so a range stays a single token such as `300-310` rather than being expanded into its members.","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS Dynamic ARP Inspection configuration","desc":"Dynamic ARP Inspection validates ARP replies against the DHCP snooping bindings, which is what stops one host on a VLAN from claiming another host's address and intercepting its traffic. It pairs with DHCP snooping: without snooping bindings there is nothing to validate against.  DAI has no device-wide on switch. It is enabled per VLAN, so `enabled` is derived from whether any VLAN is covered.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.bgp":{"id":"arista.eos.bgp","name":"arista.eos.bgp","fields":{"asNumber":{"name":"asNumber","type":"\u0007","title":"BGP Autonomous System Number","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"enabled":{"name":"enabled","type":"\u0004","title":"Whether BGP is enabled on this device","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"logNeighborChanges":{"name":"logNeighborChanges","type":"\u0004","title":"Whether session state transitions are logged","desc":"Reflects `bgp log-neighbor-changes`. Without it a session that flaps or is taken over leaves no record to correlate after the fact.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"peer":{"name":"peer","type":"\u001barista.eos.bgp.peer","title":"Arista EOS BGP peer","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"routerId":{"name":"routerId","type":"\u0007","title":"BGP Router ID","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vrf":{"name":"vrf","type":"\u001barista.eos.bgp.vrf","title":"Arista EOS BGP VRF","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"vrfs":{"name":"vrfs","type":"\u0019\u001barista.eos.bgp.vrf","title":"BGP VRFs","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS BGP configuration","desc":"Border Gateway Protocol configuration for the device, covering whether BGP is enabled, the global autonomous system number, the router ID, and the per-VRF configurations in vrfs. Each VRF lists its peers with their session state, prefix counts, and inbound and outbound route maps, so you can audit routing adjacencies and the filters applied to them.","min_provider_version":"13.0.1","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.bgp.peer":{"id":"arista.eos.bgp.peer","name":"arista.eos.bgp.peer","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Peer description","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ebgpMultihop":{"name":"ebgpMultihop","type":"\u0005","is_mandatory":true,"title":"Configured multihop limit for an external peer (0 = unset)","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"inboundPolicy":{"name":"inboundPolicy","type":"\u001barista.eos.routeMap","title":"Route-map applied to routes received from the peer","desc":"Null when no inbound policy is applied, which accepts whatever the peer announces, or when the configured name matches no route-map on the device, which has the same effect.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"inboundRouteMap":{"name":"inboundRouteMap","type":"\u0007","is_mandatory":true,"title":"Inbound route map name","desc":"Deprecated in favor of inboundPolicy, which resolves to the route-map itself so its clauses can be inspected.","provider":"go.mondoo.com/cnquery/v9/providers/arista","maturity":"deprecated"},"maximumRoutes":{"name":"maximumRoutes","type":"\u0005","is_mandatory":true,"title":"Maximum prefixes accepted from the peer (0 = no limit configured)","desc":"Without a limit, a peer that announces the full routing table, by mistake or otherwise, can exhaust the device's forwarding resources.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"outboundPolicy":{"name":"outboundPolicy","type":"\u001barista.eos.routeMap","title":"Route-map applied to routes advertised to the peer","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"outboundRouteMap":{"name":"outboundRouteMap","type":"\u0007","is_mandatory":true,"title":"Outbound route map name","desc":"Deprecated in favor of outboundPolicy, which resolves to the route-map itself so its clauses can be inspected.","provider":"go.mondoo.com/cnquery/v9/providers/arista","maturity":"deprecated"},"passwordConfigured":{"name":"passwordConfigured","type":"\u0004","is_mandatory":true,"title":"Whether the session is authenticated with a password","desc":"An unauthenticated session can be taken over by anything that can reach the port and spoof the peer address. The password itself is never read off the device.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"passwordEncryptionType":{"name":"passwordEncryptionType","type":"\u0007","is_mandatory":true,"title":"How the session password is stored","desc":"Either `0` for cleartext in the running-config or `7` for the reversible obfuscation. Empty when no password is configured.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"peerAddress":{"name":"peerAddress","type":"\u0007","is_mandatory":true,"title":"Peer IP address","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"prefixesAccepted":{"name":"prefixesAccepted","type":"\u0005","is_mandatory":true,"title":"Number of prefixes accepted from peer (after inbound filtering)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"prefixesReceived":{"name":"prefixesReceived","type":"\u0005","is_mandatory":true,"title":"Number of prefixes received from peer","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"remoteAs":{"name":"remoteAs","type":"\u0007","is_mandatory":true,"title":"Remote Autonomous System Number","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"shutdown":{"name":"shutdown","type":"\u0004","is_mandatory":true,"title":"Whether the neighbor is configured but administratively down","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Peer state (Established, Idle, Active, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ttlMaximumHops":{"name":"ttlMaximumHops","type":"\u0005","is_mandatory":true,"title":"Maximum hops the peer may be away (0 = unset)","desc":"From `neighbor \u003cpeer\u003e ttl maximum-hops`. Setting it to the real distance makes the session unreachable from anywhere further away, which defeats spoofing attempts from off-path.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"updateSource":{"name":"updateSource","type":"\u0007","is_mandatory":true,"title":"Interface sourcing the session (empty = chosen by route lookup)","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"uptime":{"name":"uptime","type":"\u0005","is_mandatory":true,"title":"Uptime in seconds","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vrfName":{"name":"vrfName","type":"\u0007","is_mandatory":true,"title":"VRF name","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS BGP peer","private":true,"min_provider_version":"13.0.1","defaults":"peerAddress","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.bgp.vrf":{"id":"arista.eos.bgp.vrf","name":"arista.eos.bgp.vrf","fields":{"asNumber":{"name":"asNumber","type":"\u0007","is_mandatory":true,"title":"BGP Autonomous System Number for this VRF","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VRF name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"peers":{"name":"peers","type":"\u0019\u001barista.eos.bgp.peer","is_mandatory":true,"title":"BGP peers in this VRF","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"routerId":{"name":"routerId","type":"\u0007","is_mandatory":true,"title":"BGP Router ID for this VRF","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS BGP VRF","private":true,"min_provider_version":"13.0.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.bootConfig":{"id":"arista.eos.bootConfig","name":"arista.eos.bootConfig","fields":{"consoleSpeed":{"name":"consoleSpeed","type":"\u0005","is_mandatory":true,"title":"Console baud rate","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"memoryTest":{"name":"memoryTest","type":"\u0007","is_mandatory":true,"title":"Memory test setting (empty when unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"softwareImage":{"name":"softwareImage","type":"\u0007","is_mandatory":true,"title":"Path to the software image loaded on next boot","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS boot configuration","desc":"Boot settings for the device: the software image loaded on the next boot and the console speed it comes up with. The image path is what a device actually runs after a reload, so it is worth confirming it points at the image that was reviewed rather than one staged beside it.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.controlPlanePolicer":{"id":"arista.eos.controlPlanePolicer","name":"arista.eos.controlPlanePolicer","fields":{"configured":{"name":"configured","type":"\u0004","is_mandatory":true,"title":"Whether a `control-plane` block exists in the running-config","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ip6AccessGroup":{"name":"ip6AccessGroup","type":"\u0007","is_mandatory":true,"title":"IPv6 access-group applied to control-plane (empty if none)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ip6AccessGroupAcl":{"name":"ip6AccessGroupAcl","type":"\u001barista.eos.acl","title":"IPv6 access-group ACL bound to the control plane, resolved from ip6AccessGroup (null when none is bound)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ipAccessGroup":{"name":"ipAccessGroup","type":"\u0007","is_mandatory":true,"title":"IPv4 access-group applied to control-plane (empty if none)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ipAccessGroupAcl":{"name":"ipAccessGroupAcl","type":"\u001barista.eos.acl","title":"IPv4 access-group ACL bound to the control plane, resolved from ipAccessGroup (null when none is bound)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"policyApplied":{"name":"policyApplied","type":"\u0004","is_mandatory":true,"title":"Whether a `service-policy input \u003cname\u003e` is applied","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"policyName":{"name":"policyName","type":"\u0007","is_mandatory":true,"title":"The service-policy name (empty if none applied)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS Control-Plane Policing (CoPP) configuration","desc":"Control-Plane Policing (CoPP) protects the device CPU and management plane against denial-of-service by rate-limiting and filtering the traffic destined for the control plane. The fields report whether a `control-plane` block is present, whether a service policy is applied, and which IPv4 and IPv6 access-groups are bound to the control plane. The ipAccessGroupAcl and ip6AccessGroupAcl fields resolve to the underlying arista.eos.acl resources so audits can inspect the rules actually enforced.","min_provider_version":"13.1.9","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.dhcpSnooping":{"id":"arista.eos.dhcpSnooping","name":"arista.eos.dhcpSnooping","fields":{"bridging":{"name":"bridging","type":"\u0004","is_mandatory":true,"title":"Whether snooping applies to bridged traffic (`ip dhcp snooping bridging`)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether DHCP snooping is globally enabled","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"insertOption82":{"name":"insertOption82","type":"\u0004","is_mandatory":true,"title":"Whether relay-agent information (option 82) is stamped onto forwarded requests","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"trustedInterfaces":{"name":"trustedInterfaces","type":"\u0019\u0007","is_mandatory":true,"title":"Interfaces exempted from snooping (`ip dhcp snooping trust`)","desc":"Held as interface names, matching how the other interface-scoped resources in this provider report the ports they cover.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vlans":{"name":"vlans","type":"\u0019\u0007","is_mandatory":true,"title":"VLANs snooping is enabled on","desc":"Entries appear as configured, so a range stays a single token such as `300-310` rather than being expanded into its members.","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS DHCP snooping configuration","desc":"DHCP snooping state and the ports exempted from it. Snooping drops server-role DHCP traffic arriving on untrusted ports, which is what stops a rogue DHCP server from handing out its own address as the default gateway and putting itself in the path of every conversation on the segment.  `trustedInterfaces` is the field to audit: an uplink toward the real DHCP server has to be trusted, and an access port facing users must not be.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.dot1x":{"id":"arista.eos.dot1x","name":"arista.eos.dot1x","fields":{"dynamicAuthorization":{"name":"dynamicAuthorization","type":"\u0004","is_mandatory":true,"title":"Whether a RADIUS server may change or revoke an authorized session","desc":"Reflects `dot1x dynamic-authorization`, which allows change-of- authorization requests to move or disconnect a session after the initial exchange.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interface":{"name":"interface","type":"\u001barista.eos.dot1x.interface","title":"Arista EOS per-interface 802.1X configuration","desc":"802.1X settings on one switched interface, selected by `interface` (for example `arista.eos.dot1x.interfaces.where(interface == \"Ethernet1\")`). `portControl` decides whether the port enforces anything: `auto` runs the authentication exchange, while `force-authorized` admits whatever plugs in and is the device default. `macBasedAuth` weakens the control to a MAC allowlist for endpoints that cannot speak 802.1X, and `reauthentication` stops a station holding access indefinitely on a single success.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"interfaces":{"name":"interfaces","type":"\u0019\u001barista.eos.dot1x.interface","title":"Per-interface 802.1X configuration","desc":"One row per interface carrying at least one `dot1x` line. Interfaces with no 802.1X configuration are absent, leaving the meaning of an unconfigured port to the policy that reads this.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"macBasedAuthHoldPeriod":{"name":"macBasedAuthHoldPeriod","type":"\u0005","is_mandatory":true,"title":"Hold period in seconds after a failed MAC authentication (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"systemAuthControl":{"name":"systemAuthControl","type":"\u0004","is_mandatory":true,"title":"Whether 802.1X authentication is globally active (`dot1x system-auth-control`)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS 802.1X port-based network access control","desc":"Device-wide 802.1X state and the per-port configuration under `interfaces`. 802.1X is the control that decides whether an unknown device plugged into a switch port reaches the network at all, so it is the layer beneath every other segmentation control.  `systemAuthControl` is the master switch and is worth reading first: with it off, per-interface `dot1x port-control auto` lines are configured but inert, so a device can carry a complete-looking 802.1X configuration and enforce nothing.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.dot1x.interface":{"id":"arista.eos.dot1x.interface","name":"arista.eos.dot1x.interface","fields":{"eapolDisabled":{"name":"eapolDisabled","type":"\u0004","is_mandatory":true,"title":"Whether EAPOL frames are suppressed on the port","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"hostMode":{"name":"hostMode","type":"\u0007","is_mandatory":true,"title":"How many stations may authenticate on the port","desc":"One of `single-host` or `multi-host`. Empty when the interface does not set it.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interface":{"name":"interface","type":"\u0007","is_mandatory":true,"title":"Parent interface name (for example `Ethernet1`)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"macBasedAuth":{"name":"macBasedAuth","type":"\u0004","is_mandatory":true,"title":"Whether MAC authentication bypass is enabled on the port","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"paeMode":{"name":"paeMode","type":"\u0007","is_mandatory":true,"title":"Port access entity role, typically `authenticator`","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"portControl":{"name":"portControl","type":"\u0007","is_mandatory":true,"title":"Enforcement mode","desc":"One of `auto` (run the authentication exchange), `force-authorized` (admit everything, the device default), or `force-unauthorized` (admit nothing). Empty when the interface does not set it.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"quietPeriod":{"name":"quietPeriod","type":"\u0005","is_mandatory":true,"title":"Hold-down after a failed exchange, in seconds (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"reauthPeriod":{"name":"reauthPeriod","type":"\u0005","is_mandatory":true,"title":"Reauthentication interval in seconds (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"reauthentication":{"name":"reauthentication","type":"\u0004","is_mandatory":true,"title":"Whether an authorized port periodically re-runs the authentication exchange","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"txPeriod":{"name":"txPeriod","type":"\u0005","is_mandatory":true,"title":"EAP request retransmit interval in seconds (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS per-interface 802.1X configuration","desc":"802.1X settings on one switched interface, selected by `interface` (for example `arista.eos.dot1x.interfaces.where(interface == \"Ethernet1\")`). `portControl` decides whether the port enforces anything: `auto` runs the authentication exchange, while `force-authorized` admits whatever plugs in and is the device default. `macBasedAuth` weakens the control to a MAC allowlist for endpoints that cannot speak 802.1X, and `reauthentication` stops a station holding access indefinitely on a single success.","private":true,"min_provider_version":"13.3.15","defaults":"interface portControl hostMode","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.eapi":{"id":"arista.eos.eapi","name":"arista.eos.eapi","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether eAPI is enabled on the device","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"httpServerConfigured":{"name":"httpServerConfigured","type":"\u0004","is_mandatory":true,"title":"Whether the plaintext HTTP eAPI server is configured","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"httpServerPort":{"name":"httpServerPort","type":"\u0005","is_mandatory":true,"title":"TCP port the HTTP eAPI server listens on","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"httpServerRunning":{"name":"httpServerRunning","type":"\u0004","is_mandatory":true,"title":"Whether the plaintext HTTP eAPI server is currently running","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"httpsServerConfigured":{"name":"httpsServerConfigured","type":"\u0004","is_mandatory":true,"title":"Whether the HTTPS eAPI server is configured","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"httpsServerPort":{"name":"httpsServerPort","type":"\u0005","is_mandatory":true,"title":"TCP port the HTTPS eAPI server listens on","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"httpsServerRunning":{"name":"httpsServerRunning","type":"\u0004","is_mandatory":true,"title":"Whether the HTTPS eAPI server is currently running","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"localHttpServerConfigured":{"name":"localHttpServerConfigured","type":"\u0004","is_mandatory":true,"title":"Whether the local (loopback-only) HTTP eAPI server is configured","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"localHttpServerPort":{"name":"localHttpServerPort","type":"\u0005","is_mandatory":true,"title":"TCP port the local HTTP eAPI server listens on","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"localHttpServerRunning":{"name":"localHttpServerRunning","type":"\u0004","is_mandatory":true,"title":"Whether the local HTTP eAPI server is currently running","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"unixSocketServerConfigured":{"name":"unixSocketServerConfigured","type":"\u0004","is_mandatory":true,"title":"Whether the Unix-domain-socket eAPI server is configured","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"unixSocketServerRunning":{"name":"unixSocketServerRunning","type":"\u0004","is_mandatory":true,"title":"Whether the Unix-domain-socket eAPI server is currently running","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS eAPI (management API) configuration","desc":"Management-API (eAPI) service surface, the transport through which mql itself connects to the device. `enabled` indicates whether eAPI is configured at all; the per-protocol fields (`httpServerConfigured` / `httpServerRunning` / `httpServerPort`, the matching `httpsServer*` and `localHttpServer*` triplets, and the `unixSocketServer*` pair) report which transports are actually listening. Common compliance audits check that `httpServerConfigured` is false (no plaintext HTTP) while `httpsServerConfigured` and `httpsServerRunning` are both true.","min_provider_version":"13.2.7","defaults":"enabled httpsServerRunning httpServerRunning","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.eventHandler":{"id":"arista.eos.eventHandler","name":"arista.eos.eventHandler","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action text as configured","desc":"For a bash action this is the command line that runs on the switch.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"actionType":{"name":"actionType","type":"\u0007","is_mandatory":true,"title":"Kind of action the handler runs","desc":"Typically `bash` for a shell command or `log` for a log message. Empty when the handler has no action configured, in which case it does nothing.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"asynchronous":{"name":"asynchronous","type":"\u0004","is_mandatory":true,"title":"Whether the action runs without blocking the event","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"delay":{"name":"delay","type":"\u0005","is_mandatory":true,"title":"Wait before the action runs, in seconds (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Handler name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"timeout":{"name":"timeout","type":"\u0005","is_mandatory":true,"title":"Bound on how long the action may run, in seconds (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"trigger":{"name":"trigger","type":"\u0007","is_mandatory":true,"title":"Event class the handler fires on","desc":"For example `on-boot`, `on-startup-config`, `on-intf`, `on-counters`, or `on-logging`.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"triggerDetail":{"name":"triggerDetail","type":"\u0007","is_mandatory":true,"title":"Remainder of the trigger line","desc":"For example the interface and condition on an `on-intf` trigger. Empty when the trigger takes no further arguments.","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS event handler","desc":"A configured reaction to a device event, selected by `name`. An event-handler whose `actionType` is `bash` runs an arbitrary shell command on the switch whenever its trigger fires, which makes it the closest thing the platform has to a cron backdoor: an `on-boot` trigger paired with a bash action re-executes on every reboot and survives most remediation.  `action` carries the command text in full, because what the command does is the whole question. Enumerating handlers and reading their actions is the point of this resource.","private":true,"min_provider_version":"13.3.15","defaults":"name trigger actionType action","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.extension":{"id":"arista.eos.extension","name":"arista.eos.extension","fields":{"error":{"name":"error","type":"\u0004","is_mandatory":true,"title":"Whether the device reports a problem with the extension","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Extension file name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"numPackages":{"name":"numPackages","type":"\u0005","is_mandatory":true,"title":"How many RPM packages the extension contains","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"presence":{"name":"presence","type":"\u0007","is_mandatory":true,"title":"Whether the extension file is on the device, for example `present`","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"release":{"name":"release","type":"\u0007","is_mandatory":true,"title":"Extension release","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Whether the extension is activated, for example `installed` or `notInstalled`","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Extension version","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS installed extension","desc":"An RPM package installed onto the switch, selected by `name`. Extensions are how third-party and in-house software gets onto EOS, so each one is code running on a network device from outside the vendor image and the installed set is worth inventorying.  `presence` and `status` answer different questions: an extension file can be on the device without being activated, and one activated now but not configured to install at boot disappears on the next reload.","private":true,"min_provider_version":"13.3.15","defaults":"name version status","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.hardware":{"id":"arista.eos.hardware","name":"arista.eos.hardware","fields":{"fan":{"name":"fan","type":"\u001barista.eos.hardware.fan","title":"Arista EOS cooling fan","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"fans":{"name":"fans","type":"\u0019\u001barista.eos.hardware.fan","title":"Cooling fans","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"inventory":{"name":"inventory","type":"\u0019\u001barista.eos.hardware.inventoryItem","title":"Hardware inventory (chassis, modules, transceivers)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"inventoryItem":{"name":"inventoryItem","type":"\u001barista.eos.hardware.inventoryItem","title":"Arista EOS hardware inventory item","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"powerSupplies":{"name":"powerSupplies","type":"\u0019\u001barista.eos.hardware.powerSupply","title":"Power supply units","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"powerSupply":{"name":"powerSupply","type":"\u001barista.eos.hardware.powerSupply","title":"Arista EOS power supply unit","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true}},"title":"Arista EOS hardware environment and inventory","desc":"Chassis hardware and environmental state for an EOS device. The `powerSupplies` field reports each PSU's state, capacity, output, and embedded temperature sensors and fans; `fans` reports each cooling fan's status and configured-versus-current speed; and `inventory` lists every chassis, module, and transceiver with its serial number and hardware revision. Useful for auditing power and cooling redundancy (missing or failed PSUs and fans) and tracking installed components by serial number.","min_provider_version":"13.0.1","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.hardware.fan":{"id":"arista.eos.hardware.fan","name":"arista.eos.hardware.fan","fields":{"configuredSpeed":{"name":"configuredSpeed","type":"\u0005","is_mandatory":true,"title":"Configured speed percentage","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tray-qualified fan identifier (e.g., \"FanTray1/1/1\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"speed":{"name":"speed","type":"\u0005","is_mandatory":true,"title":"Current speed percentage","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Operational status (ok, down, notInserted, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"trayLabel":{"name":"trayLabel","type":"\u0007","is_mandatory":true,"title":"Fan tray label (e.g., \"FanTray1\", \"FanTray2\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS cooling fan","private":true,"min_provider_version":"13.0.1","defaults":"name status speed","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.hardware.inventoryItem":{"id":"arista.eos.hardware.inventoryItem","name":"arista.eos.hardware.inventoryItem","fields":{"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Inventory category (system, powerSupply, fanTray, transceiver, card)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Component description","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"hardwareRevision":{"name":"hardwareRevision","type":"\u0007","is_mandatory":true,"title":"Hardware revision","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"manufacturerDate":{"name":"manufacturerDate","type":"\u0007","is_mandatory":true,"title":"Manufacturing date","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Component name (e.g., \"Chassis\", \"Supervisor\", \"PowerSupply1\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Serial number","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS hardware inventory item","private":true,"min_provider_version":"13.0.1","defaults":"name description serialNumber","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.hardware.powerSupply":{"id":"arista.eos.hardware.powerSupply","name":"arista.eos.hardware.powerSupply","fields":{"capacity":{"name":"capacity","type":"\u0005","is_mandatory":true,"title":"Maximum output capacity in watts","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"fans":{"name":"fans","type":"\u0019\n","is_mandatory":true,"title":"Cooling fans on this PSU","desc":"One entry per fan, each with `name` (fan identifier), `status` (fan operational status), and `speed` (current speed percentage).","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"inputCurrent":{"name":"inputCurrent","type":"\u0006","is_mandatory":true,"title":"Current input current in amps","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"managed":{"name":"managed","type":"\u0004","is_mandatory":true,"title":"Whether this PSU is managed by the system","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"modelName":{"name":"modelName","type":"\u0007","is_mandatory":true,"title":"Power supply model name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Power supply slot name (e.g., \"1\", \"2\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"outputCurrent":{"name":"outputCurrent","type":"\u0006","is_mandatory":true,"title":"Current output current in amps","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"outputPower":{"name":"outputPower","type":"\u0006","is_mandatory":true,"title":"Current output power in watts","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Operational state (ok, powerLoss, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"tempSensors":{"name":"tempSensors","type":"\u0019\n","is_mandatory":true,"title":"Temperature sensors on this PSU","desc":"One entry per sensor, each with `name` (sensor identifier), `status` (sensor operational status), and `temperature` (current reading in degrees Celsius).","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"uptime":{"name":"uptime","type":"\u0006","is_mandatory":true,"title":"PSU uptime in seconds","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS power supply unit","private":true,"min_provider_version":"13.0.1","defaults":"name state modelName","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.interface":{"id":"arista.eos.interface","name":"arista.eos.interface","fields":{"autoNegotiate":{"name":"autoNegotiate","type":"\u0004","title":"Auto-negotiation enabled","min_provider_version":"13.0.1","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"bandwidth":{"name":"bandwidth","type":"\u0005","is_mandatory":true,"title":"Interface bandwidth","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"burnedInAddress":{"name":"burnedInAddress","type":"\u0007","is_mandatory":true,"title":"Burned-in (factory-assigned) MAC address of the interface","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Interface description","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"duplex":{"name":"duplex","type":"\u0007","title":"Duplex setting (full, half, auto)","min_provider_version":"13.0.1","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"enabled":{"name":"enabled","type":"\u0004","title":"Whether the interface is enabled administratively","desc":"True unless `interfaceStatus` is `disabled`, meaning the interface has not been shut down in the configuration.","min_provider_version":"13.0.1","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"forwardingModel":{"name":"forwardingModel","type":"\u0007","is_mandatory":true,"title":"Forwarding mode","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"hardware":{"name":"hardware","type":"\u0007","is_mandatory":true,"title":"Hardware Name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"icmpRedirectsEnabled":{"name":"icmpRedirectsEnabled","type":"\u0004","title":"Whether the interface sends ICMP redirects","desc":"Redirects disclose routing topology to hosts on the segment. The device sends them unless `no ip redirects` is configured, so an interface that says nothing about it reports true.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interfaceAddress":{"name":"interfaceAddress","type":"\u0019\n","is_mandatory":true,"title":"Interface addressing","desc":"One entry per configured address. Each is a dict with keys `PrimaryIP` and `VirtualIP` (each `{Address, MaskLen}`), `SecondaryIPOrderedList` (a list of the same shape), `SecondaryIPs`, and `BroadcastAddress`.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interfaceCounters":{"name":"interfaceCounters","type":"\n","is_mandatory":true,"title":"Traffic and error counters","desc":"Dict of interface counters with keys `InOctets`, `OutOctets`, `InUcastPkts`, `OutUcastPkts`, `InMulticastPkts`, `OutMulticastPkts`, `InBroadcastPkts`, `OutBroadcastPkts`, `InDiscards`, `OutDiscards`, `TotalInErrors`, `TotalOutErrors`, `LinkStatusChanges`, `LastClear`, `CounterRefreshTime`, and the nested `InputErrorsDetail` and `OutErrorsDetail` error breakdowns.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interfaceMembership":{"name":"interfaceMembership","type":"\u0007","is_mandatory":true,"title":"Interface membership","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interfaceStatistics":{"name":"interfaceStatistics","type":"\n","is_mandatory":true,"title":"Interface throughput rates","desc":"Dict of rate statistics with keys `InBitsRate`, `OutBitsRate`, `InPktsRate`, `OutPktsRate`, and `UpdateInterval` (the sampling window over which the rates are computed).","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interfaceStatus":{"name":"interfaceStatus","type":"\u0007","is_mandatory":true,"title":"Interface status","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"l2Mtu":{"name":"l2Mtu","type":"\u0005","is_mandatory":true,"title":"Layer 2 MTU","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"lastStatusChangeTimestamp":{"name":"lastStatusChangeTimestamp","type":"\u0005","is_mandatory":true,"title":"Last interface change timestamp","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"lineProtocolStatus":{"name":"lineProtocolStatus","type":"\u0007","is_mandatory":true,"title":"Interface protocol status","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"mtu":{"name":"mtu","type":"\u0005","is_mandatory":true,"title":"MTU","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Interface name (for example `Ethernet1` or `Management1`)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"physicalAddress":{"name":"physicalAddress","type":"\u0007","is_mandatory":true,"title":"MAC address of the interface","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"proxyArpEnabled":{"name":"proxyArpEnabled","type":"\u0004","title":"Whether the interface answers ARP for addresses that are not its own","desc":"Proxy ARP blurs the segmentation a subnet boundary is meant to provide, letting hosts reach destinations they could not otherwise resolve. Off unless configured.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"status":{"name":"status","type":"\n","title":"Link status details","desc":"Dict from `show interfaces status` with keys `bandwidth`, `interfaceType`, `description`, `autoNegotiateActive`, `duplex`, `linkStatus`, `lineProtocolStatus`, and `vlanInformation` (`{interfaceMode, vlanId, interfaceForwardingModel}`). The `duplex` and `autoNegotiate` fields are derived from this dict.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"unicastRpfMode":{"name":"unicastRpfMode","type":"\u0007","title":"Reverse-path-forwarding mode for anti-spoofing","desc":"Either `rx`, which drops packets arriving from a direction the routing table would not use to reach their source, or `any`, which accepts any reachable direction. Empty when unicast RPF is not configured, which leaves the interface accepting spoofed source addresses.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS network interface","desc":"Physical or logical interface on the switch, selected by `name` (for example `arista.eos.interfaces.where(name == \"Ethernet1\")`). Exposes administrative and line-protocol status, IP addressing, MTU and layer-2 MTU, hardware and burned-in MAC addresses, the forwarding model, and traffic and error counters. Use it to audit which interfaces are enabled, how they are addressed, and their operational state.","private":true,"min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.ipInterface":{"id":"arista.eos.ipInterface","name":"arista.eos.ipInterface","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"IP Address","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"mtu":{"name":"mtu","type":"\u0007","is_mandatory":true,"title":"MTU","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Interface Name","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS IP interface","desc":"A Layer 3 IP interface configured on the switch, covering routed Ethernet ports, VLAN (SVI) interfaces, loopbacks, and management interfaces. The `name` field selects the interface as it appears in the running-config, for example `Ethernet1`, `Vlan10`, `Loopback0`, or `Management1`. Use it to audit which interfaces carry an IP address, the addresses assigned, and the configured MTU.","private":true,"min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.logging":{"id":"arista.eos.logging","name":"arista.eos.logging","fields":{"bufferedSeverity":{"name":"bufferedSeverity","type":"\u0007","is_mandatory":true,"title":"Severity threshold for the on-box buffer (`logging buffered`)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"bufferedSize":{"name":"bufferedSize","type":"\u0005","is_mandatory":true,"title":"On-box log buffer size in bytes (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"consoleSeverity":{"name":"consoleSeverity","type":"\u0007","is_mandatory":true,"title":"Severity threshold for the console (`logging console`)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether system logging is enabled","desc":"True unless `no logging on` is configured. EOS logs by default, so an absent `logging on` line still means logging is on.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"facility":{"name":"facility","type":"\u0007","is_mandatory":true,"title":"Syslog facility stamped on outbound messages (for example `local6`)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"host":{"name":"host","type":"\u001barista.eos.logging.host","title":"Arista EOS remote syslog collector","desc":"A single remote destination the device ships log messages to, selected by its `host` address. `port` and `protocol` report the transport actually used, falling back to the UDP port 514 default that EOS applies when the configuration line omits them, and `vrf` is the routing instance the collector is reached through.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"hostnameFormat":{"name":"hostnameFormat","type":"\u0007","is_mandatory":true,"title":"Hostname format applied to messages","desc":"Token from `logging format hostname`, for example `fqdn` or `ipv4`. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"hosts":{"name":"hosts","type":"\u0019\u001barista.eos.logging.host","title":"Remote syslog collectors the device ships messages to","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"monitorSeverity":{"name":"monitorSeverity","type":"\u0007","is_mandatory":true,"title":"Severity threshold for terminal monitors (`logging monitor`)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"persistentEnabled":{"name":"persistentEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the log buffer is written to flash so it survives a reboot","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"persistentSize":{"name":"persistentSize","type":"\u0005","is_mandatory":true,"title":"Persistent log size in bytes (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"rfc5424Format":{"name":"rfc5424Format","type":"\u0004","is_mandatory":true,"title":"Whether messages are emitted in RFC 5424 syslog format","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"sourceInterface":{"name":"sourceInterface","type":"\u0007","is_mandatory":true,"title":"Interface whose address is used as the source of outbound syslog traffic","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"synchronous":{"name":"synchronous","type":"\u0004","is_mandatory":true,"title":"Whether console output is synchronized with command output","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"timestampFormat":{"name":"timestampFormat","type":"\u0007","is_mandatory":true,"title":"Timestamp format applied to messages","desc":"Token from `logging format timestamp`, for example `traditional` or `high-resolution`. Empty when unset.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"trapSeverity":{"name":"trapSeverity","type":"\u0007","is_mandatory":true,"title":"Severity threshold for messages sent to remote collectors (`logging trap`)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS system logging configuration","desc":"Syslog configuration for the device: the remote collectors it ships messages to, the severity threshold applied to each destination (remote trap, console, terminal monitors, and the on-box buffer), the source interface and facility stamped on outbound messages, and the message format. The `hosts` field is what most audits read first: a device with no collector keeps its log messages on-box, where a reboot loses them and no central system can correlate them.  Severity fields carry the token as configured, such as `informational`, `errors`, `disabled`, or a numeric level. An empty severity means the running-config did not set that destination and the release default applies, which is reported as unset rather than filled in with a guess.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.logging.host":{"id":"arista.eos.logging.host","name":"arista.eos.logging.host","fields":{"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Collector hostname or IP address as configured","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Destination port (514 when the configuration omits it)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Transport protocol, `udp` or `tcp` (`udp` when the configuration omits it)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"Routing instance used to reach the collector (empty = default VRF)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS remote syslog collector","desc":"A single remote destination the device ships log messages to, selected by its `host` address. `port` and `protocol` report the transport actually used, falling back to the UDP port 514 default that EOS applies when the configuration line omits them, and `vrf` is the routing instance the collector is reached through.","private":true,"min_provider_version":"13.3.15","defaults":"host port protocol vrf","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.mlag":{"id":"arista.eos.mlag","name":"arista.eos.mlag","fields":{"domainId":{"name":"domainId","type":"\u0007","title":"MLAG domain ID","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interface":{"name":"interface","type":"\u001barista.eos.mlag.interface","title":"Arista EOS MLAG interface (Port-Channel with MLAG ID)","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"interfaces":{"name":"interfaces","type":"\u0019\u001barista.eos.mlag.interface","title":"Port-Channel interfaces configured with MLAG IDs","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"localInterface":{"name":"localInterface","type":"\u0007","title":"Local interface used for MLAG communication (typically a VLAN interface)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"peerAddress":{"name":"peerAddress","type":"\u0007","title":"IP address of the MLAG peer switch","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"peerLink":{"name":"peerLink","type":"\u0007","title":"Interface used as the peer-link (typically a Port-Channel)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"shutdown":{"name":"shutdown","type":"\u0004","title":"Whether MLAG is administratively shutdown","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS MLAG (Multi-Chassis Link Aggregation) configuration","desc":"Multi-Chassis Link Aggregation domain, which lets two switches present themselves as a single logical device so downstream hosts can dual-home a Port-Channel across both chassis for redundancy. Query this to confirm the peer relationship is healthy: the domain pairing (domainId, peerAddress), the control path (localInterface and peerLink), whether the domain is administratively disabled (shutdown), and which Port-Channels carry an MLAG ID. A shutdown or misconfigured peer link breaks the redundancy the design depends on.","min_provider_version":"13.0.1","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.mlag.interface":{"id":"arista.eos.mlag.interface","name":"arista.eos.mlag.interface","fields":{"mlagId":{"name":"mlagId","type":"\u0007","is_mandatory":true,"title":"MLAG ID assigned to this Port-Channel","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Port-Channel interface name (e.g., \"Port-Channel1\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS MLAG interface (Port-Channel with MLAG ID)","private":true,"min_provider_version":"13.0.1","defaults":"name mlagId","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.monitorSession":{"id":"arista.eos.monitorSession","name":"arista.eos.monitorSession","fields":{"destinationInterfaces":{"name":"destinationInterfaces","type":"\u0019\u0007","is_mandatory":true,"title":"Local ports the mirrored copy is sent to","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Session name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"source":{"name":"source","type":"\u001barista.eos.monitorSession.source","title":"Arista EOS mirrored interface","desc":"One mirrored interface within a port-mirroring session.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"sources":{"name":"sources","type":"\u0019\u001barista.eos.monitorSession.source","is_mandatory":true,"title":"Mirrored interfaces and the direction each is mirrored in","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"truncateEnabled":{"name":"truncateEnabled","type":"\u0004","is_mandatory":true,"title":"Whether mirrored packets are truncated","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"truncateSize":{"name":"truncateSize","type":"\u0005","is_mandatory":true,"title":"Truncation size in bytes (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"tunnelDestinations":{"name":"tunnelDestinations","type":"\u0019\u0007","is_mandatory":true,"title":"Remote addresses an encapsulated session sends mirrored traffic to","desc":"Empty for a session that stays on the device. A non-empty list means production traffic leaves the switch.","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS port-mirroring session","desc":"A port-mirroring session, selected by `name`. A session copies production traffic somewhere else, which is a normal troubleshooting tool and also the cleanest way to take traffic off a switch without touching a host.  `destinationInterfaces` keeps the copy on the device; `tunnelDestinations` does not. An encapsulated session sends mirrored traffic to a remote address, so any entry there is worth an explanation.","private":true,"min_provider_version":"13.3.15","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.monitorSession.source":{"id":"arista.eos.monitorSession.source","name":"arista.eos.monitorSession.source","fields":{"direction":{"name":"direction","type":"\u0007","is_mandatory":true,"title":"Mirrored direction","desc":"One of `rx`, `tx`, or `both`. A source configured without a direction mirrors both.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interface":{"name":"interface","type":"\u0007","is_mandatory":true,"title":"Mirrored interface name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"sessionName":{"name":"sessionName","type":"\u0007","is_mandatory":true,"title":"Session this source belongs to","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS mirrored interface","desc":"One mirrored interface within a port-mirroring session.","private":true,"min_provider_version":"13.3.15","defaults":"interface direction","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.ntp":{"id":"arista.eos.ntp","name":"arista.eos.ntp","fields":{"authKeys":{"name":"authKeys","type":"\u0019\u001barista.eos.ntpAuthKey","title":"NTP authentication keys and trusted-key state","min_provider_version":"13.1.9","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"authenticationEnabled":{"name":"authenticationEnabled","type":"\u0004","title":"Whether NTP authentication is globally enabled (`ntp authenticate`)","min_provider_version":"13.1.9","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"serveAccessGroup":{"name":"serveAccessGroup","type":"\u0007","title":"Access-list bounding which clients may query the device for time","desc":"Name of the access-list applied via `ntp serve ipv4 access-group` or its IPv6 form. Empty when the device either does not serve time or serves it without restriction.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"serveAccessGroupAcl":{"name":"serveAccessGroupAcl","type":"\u001barista.eos.acl","title":"Access-list that bounds NTP clients, resolved from serveAccessGroup (null when none is bound)","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"serveEnabled":{"name":"serveEnabled","type":"\u0004","title":"Whether the device answers NTP queries from clients","desc":"True when `ntp serve all` is configured, or when an access-group is bound to the serve function. A device that serves time to any client that asks is usable as a reflection and amplification source.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"server":{"name":"server","type":"\u001barista.eos.ntp.server","title":"Arista EOS upstream NTP server","desc":"A single upstream time source the device synchronizes against, selected by its configured `address` (for example `arista.eos.ntp.servers.where(address == \"0.pool.ntp.org\")`). Covers the routing instance used to reach it, the poll-interval bounds, the source interface, and whether the server is preferred. Time an attacker can move undermines certificate validity windows, log correlation, and any authentication scheme with a replay window, so both the server list and its authentication state are worth auditing.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"servers":{"name":"servers","type":"\u0019\u001barista.eos.ntp.server","title":"Upstream time sources the device synchronizes against","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of NTP on the switch","min_provider_version":"13.1.9","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS NTP configuration and authentication state","desc":"NTP service status, whether `ntp authenticate` is globally enabled, and the configured NTP authentication keys, each carrying its key ID, hash algorithm, and trusted flag. This is what benchmarks check when they require cryptographic protection of time synchronization, so an unauthenticated or untrusted key set is a finding.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.ntp.server":{"id":"arista.eos.ntp.server","name":"arista.eos.ntp.server","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Server hostname or IP address as configured","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"authKey":{"name":"authKey","type":"\u001barista.eos.ntpAuthKey","title":"Authentication key this server is authenticated with, resolved from keyId","desc":"Null when the server references no key, or references a key ID with no matching `ntp authentication-key` line.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"iburst":{"name":"iburst","type":"\u0004","is_mandatory":true,"title":"Whether a burst of packets is sent on startup for faster initial sync","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"keyId":{"name":"keyId","type":"\u0005","is_mandatory":true,"title":"Authentication key ID referenced by this server","desc":"0 means the server line references no key, so its responses are accepted unauthenticated. A non-zero value paired with a null authKey means the server references a key that is not defined on the device.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"localInterface":{"name":"localInterface","type":"\u0007","is_mandatory":true,"title":"Source interface for packets sent to this server","desc":"From either the `local-interface` or `source` keyword on the server line. Empty when the device picks the source by route lookup.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"maxPoll":{"name":"maxPoll","type":"\u0005","is_mandatory":true,"title":"Maximum poll interval as a power of two seconds (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"minPoll":{"name":"minPoll","type":"\u0005","is_mandatory":true,"title":"Minimum poll interval as a power of two seconds (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"prefer":{"name":"prefer","type":"\u0004","is_mandatory":true,"title":"Whether this server is marked as the preferred synchronization source","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"NTP protocol version (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"Routing instance used to reach the server (empty = default VRF)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS upstream NTP server","desc":"A single upstream time source the device synchronizes against, selected by its configured `address` (for example `arista.eos.ntp.servers.where(address == \"0.pool.ntp.org\")`). Covers the routing instance used to reach it, the poll-interval bounds, the source interface, and whether the server is preferred. Time an attacker can move undermines certificate validity windows, log correlation, and any authentication scheme with a replay window, so both the server list and its authentication state are worth auditing.","private":true,"min_provider_version":"13.3.15","defaults":"address vrf prefer","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.ntpAuthKey":{"id":"arista.eos.ntpAuthKey","name":"arista.eos.ntpAuthKey","fields":{"hashAlgo":{"name":"hashAlgo","type":"\u0007","is_mandatory":true,"title":"Hash algorithm (md5, sha1, sha256, sha384, sha512). md5 is weak.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Key ID","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"trusted":{"name":"trusted","type":"\u0004","is_mandatory":true,"title":"Whether this key ID appears in `ntp trusted-key` and is therefore actually used for authenticating servers","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS NTP authentication key","private":true,"min_provider_version":"13.1.9","defaults":"id hashAlgo trusted","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.passwordPolicy":{"id":"arista.eos.passwordPolicy","name":"arista.eos.passwordPolicy","fields":{"allowNopasswordRemoteLogin":{"name":"allowNopasswordRemoteLogin","type":"\u0004","is_mandatory":true,"title":"Whether remote login is permitted for users with no password configured","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"lockoutDurationSeconds":{"name":"lockoutDurationSeconds","type":"\u0005","is_mandatory":true,"title":"How long an account stays locked, in seconds","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"lockoutFailure":{"name":"lockoutFailure","type":"\u0005","is_mandatory":true,"title":"Failures allowed before account lockout (0 = lockout not configured)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"lockoutWindowSeconds":{"name":"lockoutWindowSeconds","type":"\u0005","is_mandatory":true,"title":"Rolling window during which failures count, in seconds","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"logOnFailure":{"name":"logOnFailure","type":"\u0004","is_mandatory":true,"title":"Whether failed authentication events are logged","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"logOnSuccess":{"name":"logOnSuccess","type":"\u0004","is_mandatory":true,"title":"Whether successful authentication events are logged","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"maximumRepetitive":{"name":"maximumRepetitive","type":"\u0005","is_mandatory":true,"title":"Maximum allowed repetitive characters","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"maximumSequential":{"name":"maximumSequential","type":"\u0005","is_mandatory":true,"title":"Maximum allowed sequential characters","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"minimumDigits":{"name":"minimumDigits","type":"\u0005","is_mandatory":true,"title":"Minimum digit characters required","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"minimumLength":{"name":"minimumLength","type":"\u0005","is_mandatory":true,"title":"Minimum password length (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"minimumLowercase":{"name":"minimumLowercase","type":"\u0005","is_mandatory":true,"title":"Minimum lowercase characters required","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"minimumSpecial":{"name":"minimumSpecial","type":"\u0005","is_mandatory":true,"title":"Minimum special characters required","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"minimumUppercase":{"name":"minimumUppercase","type":"\u0005","is_mandatory":true,"title":"Minimum uppercase characters required","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"policyName":{"name":"policyName","type":"\u0007","is_mandatory":true,"title":"Configured `password policy \u003cname\u003e` (empty = no policy block)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS password policy and account-lockout configuration","desc":"Account-lockout thresholds and password-complexity rules enforced for local authentication on the device. Covers the lockout trigger (failure count, observation window, lock duration), whether users with no password may log in remotely, login-event logging, and the minimum-character and maximum-repetition rules from the `password policy` block. Audit these to confirm brute-force protection is enabled and complexity meets policy.","min_provider_version":"13.1.9","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.portSecurity":{"id":"arista.eos.portSecurity","name":"arista.eos.portSecurity","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether port-security is enabled on the interface","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interface":{"name":"interface","type":"\u0007","is_mandatory":true,"title":"Parent interface name (e.g. \"Ethernet1\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"maximumMacAddresses":{"name":"maximumMacAddresses","type":"\u0005","is_mandatory":true,"title":"Maximum learned MAC addresses (0 = EOS default of 1)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"stickyLearning":{"name":"stickyLearning","type":"\u0004","is_mandatory":true,"title":"Whether sticky MAC learning is configured","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"violationAction":{"name":"violationAction","type":"\u0007","is_mandatory":true,"title":"Violation action: \"protect\", \"restrict\", or \"shutdown\" (empty = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS per-interface switchport port-security configuration","desc":"Port-security posture for switched interfaces, covering how many MAC addresses each port may learn, what the switch does when that limit is exceeded, and whether learned addresses are pinned into the running config. Auditing this confirms that access-facing ports restrict which end stations can connect, limiting MAC-flooding and rogue-device attacks. The `violationAction` field reports the enforcement mode (\"protect\", \"restrict\", or \"shutdown\"). There is one row per interface, identified by the interface field.","private":true,"min_provider_version":"13.1.9","defaults":"interface enabled violationAction","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.prefixList":{"id":"arista.eos.prefixList","name":"arista.eos.prefixList","fields":{"entries":{"name":"entries","type":"\u0019\u001barista.eos.prefixList.entry","title":"Ordered rules, by sequence number","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"entry":{"name":"entry","type":"\u001barista.eos.prefixList.entry","title":"Arista EOS prefix-list rule","desc":"One rule of a prefix-list. `ge` and `le` bound the prefix lengths the rule accepts, widening it beyond the prefix alone.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Address family the list matches, `ipv4` or `ipv6`","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Prefix-list name as referenced by routing policy","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS prefix-list","desc":"A named list of prefixes referenced by routing policy, selected by `name` and `family`. The two address families are separate namespaces and can share a name.  The prefix-length qualifiers on each entry matter as much as the prefixes: a rule with a wide `le` accepts far more than its prefix suggests, and `permit 0.0.0.0/0 le 32` accepts every route there is.","private":true,"min_provider_version":"13.3.15","defaults":"name family","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.prefixList.entry":{"id":"arista.eos.prefixList.entry","name":"arista.eos.prefixList.entry","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Rule action, `permit` or `deny`","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"eq":{"name":"eq","type":"\u0005","is_mandatory":true,"title":"Exact prefix length the rule accepts (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ge":{"name":"ge","type":"\u0005","is_mandatory":true,"title":"Minimum prefix length the rule accepts (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"le":{"name":"le","type":"\u0005","is_mandatory":true,"title":"Maximum prefix length the rule accepts (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"prefix":{"name":"prefix","type":"\u0007","is_mandatory":true,"title":"Network in CIDR form","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"prefixListFamily":{"name":"prefixListFamily","type":"\u0007","is_mandatory":true,"title":"Address family of the prefix-list this rule belongs to, `ipv4` or `ipv6`","desc":"Present because a name alone does not identify a list: the two address families are separate namespaces and can share a name.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"prefixListName":{"name":"prefixListName","type":"\u0007","is_mandatory":true,"title":"Prefix-list this rule belongs to","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"sequenceNumber":{"name":"sequenceNumber","type":"\u0005","is_mandatory":true,"title":"Sequence number (determines evaluation order)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS prefix-list rule","desc":"One rule of a prefix-list. `ge` and `le` bound the prefix lengths the rule accepts, widening it beyond the prefix alone.","private":true,"min_provider_version":"13.3.15","defaults":"sequenceNumber action prefix","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.role":{"id":"arista.eos.role","name":"arista.eos.role","fields":{"default":{"name":"default","type":"\u0004","is_mandatory":true,"title":"Whether this is the default role","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of role","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Command-authorization rules that restrict access to specified commands","desc":"Ordered list of rules evaluated for the role. Each entry has `cmdPermission` (whether commands matching the rule are permitted or denied), `cmdRegex` (the regular expression matched against command text), `sequenceNumber` (the rule's position in evaluation order), and `mode` (the CLI mode the rule applies to).","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS command-authorization role","desc":"Named role that restricts which CLI commands the users assigned to it may run, the building block of role-based access control on EOS. Each role carries an ordered list of permit and deny rules matched against command text (see `rules`), and `default` marks the role applied to users who have no role of their own. Auditing roles confirms that privileged commands are limited to the operators who should have them.","private":true,"min_provider_version":"9.0.0","defaults":"name default","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.route":{"id":"arista.eos.route","name":"arista.eos.route","fields":{"active":{"name":"active","type":"\u0004","title":"Whether the route is active","min_provider_version":"13.0.1","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"destination":{"name":"destination","type":"\u0007","is_mandatory":true,"title":"Route destination prefix (e.g., \"10.0.0.0/8\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"hardwareProgrammed":{"name":"hardwareProgrammed","type":"\u0004","is_mandatory":true,"title":"Whether the route is programmed in hardware","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"kernelProgrammed":{"name":"kernelProgrammed","type":"\u0004","is_mandatory":true,"title":"Whether the route is programmed in kernel","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"metric":{"name":"metric","type":"\u0005","is_mandatory":true,"title":"Route metric","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"nextHops":{"name":"nextHops","type":"\u0019\n","is_mandatory":true,"title":"Next hops for the route","desc":"One entry per available next hop. Each carries `interface` (the outgoing interface name, e.g. \"Ethernet1\") and `nexthopAddr` (the next-hop IP address). Either value can be an empty string when it does not apply to the route (for example a directly connected route has no next-hop address).","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"preference":{"name":"preference","type":"\u0005","is_mandatory":true,"title":"Administrative distance","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"routeAction":{"name":"routeAction","type":"\u0007","is_mandatory":true,"title":"Route action","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"routeType":{"name":"routeType","type":"\u0007","is_mandatory":true,"title":"Route type (connected, static, bgp, ospf, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"VRF name","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS IP route","desc":"Single entry in the IP routing table, selected by its `destination` prefix (for example `arista.eos.routes.where(destination == \"10.0.0.0/8\")`): the VRF it belongs to, the source protocol (connected, static, BGP, OSPF, and so on), the administrative distance and metric, the hardware-programmed and kernel-programmed flags, the next-hop list, the route action, and an `active` flag indicating whether the route is currently in use for forwarding.","min_provider_version":"11.1.0","defaults":"destination","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.routeMap":{"id":"arista.eos.routeMap","name":"arista.eos.routeMap","fields":{"entries":{"name":"entries","type":"\u0019\u001barista.eos.routeMap.entry","title":"Ordered clauses, by sequence number","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"entry":{"name":"entry","type":"\u001barista.eos.routeMap.entry","title":"Arista EOS route-map clause","desc":"One clause of a route-map, selected by its `sequenceNumber`. `match` and `set` carry the statements as written, without their leading keyword: the statement grammar is wide and still growing, so structuring every variant would be both a losing game and a lossy one.  `matchPrefixLists` resolves the prefix-lists a clause matches against, so a policy can be followed from the adjacency through the clause to the actual prefixes it admits.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Route-map name as referenced by routing configuration","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS route-map","desc":"A named routing policy, selected by `name` (for example `arista.eos.routeMaps.where(name == \"IMPORT-FILTER\")`), made of ordered clauses in `entries`. Route-maps decide which routes a device accepts from and announces to its neighbors, so they are where a routing leak is either prevented or created.  The last clause usually decides the posture: a map whose final clause is a bare `deny` rejects everything the earlier clauses did not explicitly accept, while a map with no deny clause accepts the remainder.","private":true,"min_provider_version":"13.3.15","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.routeMap.entry":{"id":"arista.eos.routeMap.entry","name":"arista.eos.routeMap.entry","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Clause action, `permit` or `deny`","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"continueAt":{"name":"continueAt","type":"\u0005","is_mandatory":true,"title":"Clause number that processing continues at (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Clause description","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"match":{"name":"match","type":"\u0019\u0007","is_mandatory":true,"title":"Match statements, without the leading `match` keyword","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"matchPrefixLists":{"name":"matchPrefixLists","type":"\u0019\u001barista.eos.prefixList","title":"Prefix-lists this clause matches against","desc":"Empty when the clause matches on something other than a prefix-list, or when it names prefix-lists that are not defined on the device.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"routeMapName":{"name":"routeMapName","type":"\u0007","is_mandatory":true,"title":"Route-map this clause belongs to","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"sequenceNumber":{"name":"sequenceNumber","type":"\u0005","is_mandatory":true,"title":"Sequence number (determines evaluation order)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"set":{"name":"set","type":"\u0019\u0007","is_mandatory":true,"title":"Set statements, without the leading `set` keyword","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS route-map clause","desc":"One clause of a route-map, selected by its `sequenceNumber`. `match` and `set` carry the statements as written, without their leading keyword: the statement grammar is wide and still growing, so structuring every variant would be both a losing game and a lossy one.  `matchPrefixLists` resolves the prefix-lists a clause matches against, so a policy can be followed from the adjacency through the clause to the actual prefixes it admits.","private":true,"min_provider_version":"13.3.15","defaults":"routeMapName sequenceNumber action","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.runningConfig":{"id":"arista.eos.runningConfig","name":"arista.eos.runningConfig","fields":{"content":{"name":"content","type":"\u0007","title":"EOS running-config","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"section":{"name":"section","type":"\u001barista.eos.runningConfig.section","title":"Section of the Arista EOS running-config","desc":"A single named section of the running-config, for when you need the raw text of one configuration block rather than the whole device. The `name` field selects the section as it appears in the running-config. For example `arista.eos.runningConfig.section(name: \"interface Ethernet1\")` or `... section(name: \"router bgp 65001\")`. The `content` field returns the raw text of that block.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true}},"title":"Arista EOS running-config (full device configuration)","desc":"Full running-configuration text as emitted by `show running-config`. `content` is the entire config as one string; use it for pattern matching or line-oriented audits, or as a fall-through when no more specific resource exists. To inspect a single block of the configuration use `arista.eos.runningConfig.section(name: \"\u003cheader\u003e\")`.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.runningConfig.section":{"id":"arista.eos.runningConfig.section","name":"arista.eos.runningConfig.section","fields":{"content":{"name":"content","type":"\u0007","title":"Section from EOS running-config","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Section name","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Section of the Arista EOS running-config","desc":"A single named section of the running-config, for when you need the raw text of one configuration block rather than the whole device. The `name` field selects the section as it appears in the running-config. For example `arista.eos.runningConfig.section(name: \"interface Ethernet1\")` or `... section(name: \"router bgp 65001\")`. The `content` field returns the raw text of that block.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.schedule":{"id":"arista.eos.schedule","name":"arista.eos.schedule","fields":{"command":{"name":"command","type":"\u0007","is_mandatory":true,"title":"Command line the schedule runs","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interval":{"name":"interval","type":"\u0005","is_mandatory":true,"title":"Run interval in minutes (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"maxLogFiles":{"name":"maxLogFiles","type":"\u0005","is_mandatory":true,"title":"Cap on retained output files (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Schedule name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"timeout":{"name":"timeout","type":"\u0005","is_mandatory":true,"title":"Bound on how long the command may run, in minutes (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS scheduled task","desc":"A recurring command the device runs on its own, selected by `name`. Like an event handler, a schedule whose `command` starts with `bash` executes a shell command on the switch, on a timer, with no operator present.","private":true,"min_provider_version":"13.3.15","defaults":"name interval command","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.sflow":{"id":"arista.eos.sflow","name":"arista.eos.sflow","fields":{"destination":{"name":"destination","type":"\u001barista.eos.sflow.destination","title":"Arista EOS sFlow collector","desc":"One collector sampled data is sent to, selected by `address`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"destinations":{"name":"destinations","type":"\u0019\u001barista.eos.sflow.destination","title":"Collectors sampled data is sent to","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether sFlow sampling is running","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"pollingInterval":{"name":"pollingInterval","type":"\u0005","is_mandatory":true,"title":"Counter polling interval in seconds (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"sampleRate":{"name":"sampleRate","type":"\u0005","is_mandatory":true,"title":"One-in-N packet sampling rate (0 = unset)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"sourceInterface":{"name":"sourceInterface","type":"\u0007","is_mandatory":true,"title":"Interface sourcing packets sent to the collectors","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS sFlow configuration","desc":"sFlow sampling state and the collectors it reports to. sFlow ships sampled packet headers and interface counters off the device, and the headers carry real traffic, so the collector list is a data-egress path in the same way a mirroring destination is.  Collectors can be configured while sampling is off, so `enabled` and `destinations` answer different questions and both are worth reading.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.sflow.destination":{"id":"arista.eos.sflow.destination","name":"arista.eos.sflow.destination","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Collector hostname or IP address as configured","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Collector port (6343 when the configuration omits it)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"Routing instance used to reach the collector (empty = default VRF)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS sFlow collector","desc":"One collector sampled data is sent to, selected by `address`.","private":true,"min_provider_version":"13.3.15","defaults":"address port vrf","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.snmpCommunity":{"id":"arista.eos.snmpCommunity","name":"arista.eos.snmpCommunity","fields":{"access":{"name":"access","type":"\u0007","is_mandatory":true,"title":"Access mode: \"ro\" (read-only) or \"rw\" (read-write)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"acl":{"name":"acl","type":"\u0007","is_mandatory":true,"title":"Access-list name applied to this community","desc":"Empty = no ACL. When `ipv6` is true this is an IPv6 access-list; otherwise IPv4.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"aclResource":{"name":"aclResource","type":"\u001barista.eos.acl","title":"Access-list that restricts this community, resolved to the `arista.eos.acl` named by `acl`","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ipv6":{"name":"ipv6","type":"\u0004","is_mandatory":true,"title":"Whether the community line declares an IPv6 ACL","desc":"Set via the `ipv6` keyword in `snmp-server community \u003cname\u003e ro ipv6 \u003cacl6\u003e`.","min_provider_version":"13.1.10","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Community string (acts as a plaintext shared secret)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS SNMPv1/v2c community string configuration","private":true,"min_provider_version":"13.1.9","defaults":"name access acl","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.snmpSetting":{"id":"arista.eos.snmpSetting","name":"arista.eos.snmpSetting","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether SNMP logging is enabled","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"notifications":{"name":"notifications","type":"\u0019\n","title":"SNMP trap notification types and their enabled state","desc":"One entry per trap notification type. Each entry carries `name` (the notification name), `reason` (why it is or is not active), `enabled` (whether the device is configured to send this trap), and `component` (the subsystem the notification belongs to).","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS SNMP daemon configuration","desc":"SNMP daemon state on the switch, covering whether SNMP logging is enabled and which trap notifications the device is configured to send. For SNMPv1 / v2c community strings (a common hardening finding) see `arista.eos.snmpCommunities`.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.spt":{"id":"arista.eos.spt","fields":{"mstInterface":{"name":"mstInterface","type":"\u001barista.eos.spt.mstInterface","title":"Arista EOS MST per-interface state","desc":"Spanning-tree state for one interface within one Multiple Spanning Tree (MST) instance, selected by interface `name` and `mstInstanceId`. Useful for confirming that a port carries the role and state expected by the spanning-tree design and for surfacing loop-prevention problems: the `inconsistentFeatures` map flags loop-guard, root-guard, MST/PVST-border, and bridge-assurance conditions that hold a port out of forwarding.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true}},"is_extension":true},"arista.eos.spt.mstInterface":{"id":"arista.eos.spt.mstInterface","name":"arista.eos.spt.mstInterface","fields":{"boundaryType":{"name":"boundaryType","type":"\u0007","is_mandatory":true,"title":"Interface boundary type","desc":"Deprecated, please use state. This field never carried a distinct boundary type: it returns the same value as state. It will be removed in a future major release once a real boundary source is wired up.","provider":"go.mondoo.com/cnquery/v9/providers/arista","maturity":"deprecated"},"cost":{"name":"cost","type":"\u0005","is_mandatory":true,"title":"Cost value for the interface","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"counters":{"name":"counters","type":"\n","title":"BPDU transaction counters for the interface","desc":"Keys `bpduSent`, `bpduReceived`, `bpduTaggedError`, `bpduOtherError`, and `bpduRateLimitCount`.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"detail":{"name":"detail","type":"\n","is_mandatory":true,"title":"Designated root, bridge, and port for the interface","desc":"Keys `designatedRootAddress` and `designatedRootPriority` identify the designated root; `designatedBridgeAddress`, `designatedBridgePriority`, `designatedPortNumber`, and `designatedPortPriority` identify the designated bridge and port; `regionalRootAddress` and `regionalRootPriority` identify the MST regional root.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"features":{"name":"features","type":"\n","title":"Spanning-tree feature configuration for the interface","desc":"Keys `linkType`, `bpduGuard`, and `BpduFilter`, each a map holding a `value` and a `default` boolean indicating whether the value is the interface default.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista"},"inconsistentFeatures":{"name":"inconsistentFeatures","type":"\n","is_mandatory":true,"title":"Loop-prevention inconsistencies detected on the interface","desc":"Boolean flags for each guard that has put the port into an inconsistent (blocked) state: `loopGuard`, `rootGuard`, `mstPvstBorder`, and `bridgeAssurance`.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"isEdgePort":{"name":"isEdgePort","type":"\u0004","is_mandatory":true,"title":"Whether the interface is an edge port","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"linkType":{"name":"linkType","type":"\u0007","is_mandatory":true,"title":"Link type","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"mstInstanceId":{"name":"mstInstanceId","type":"\u0007","is_mandatory":true,"title":"MST instance number","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of STP instance","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"portNumber":{"name":"portNumber","type":"\u0005","is_mandatory":true,"title":"Port Number","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Interface priority","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Port role","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Interface state","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS MST per-interface state","desc":"Spanning-tree state for one interface within one Multiple Spanning Tree (MST) instance, selected by interface `name` and `mstInstanceId`. Useful for confirming that a port carries the role and state expected by the spanning-tree design and for surfacing loop-prevention problems: the `inconsistentFeatures` map flags loop-guard, root-guard, MST/PVST-border, and bridge-assurance conditions that hold a port out of forwarding.","min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.sshSettings":{"id":"arista.eos.sshSettings","name":"arista.eos.sshSettings","fields":{"authenticationMode":{"name":"authenticationMode","type":"\u0007","is_mandatory":true,"title":"Authentication mode (e.g. \"keyboard-interactive\", \"password\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ciphers":{"name":"ciphers","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed cipher algorithms","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the SSH service is enabled (no shutdown)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"fipsRestrictions":{"name":"fipsRestrictions","type":"\u0004","is_mandatory":true,"title":"Whether `fips restrictions` is enabled on the SSH service","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"hostkeyAlgorithms":{"name":"hostkeyAlgorithms","type":"\u0019\u0007","is_mandatory":true,"title":"Configured host key algorithms (raw lines after `hostkey`)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"idleTimeout":{"name":"idleTimeout","type":"\u0005","is_mandatory":true,"title":"Idle timeout in minutes (0 = no timeout)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"keyExchange":{"name":"keyExchange","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed key-exchange algorithms","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"macs":{"name":"macs","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed MAC algorithms","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"protocolVersion":{"name":"protocolVersion","type":"\u0007","is_mandatory":true,"title":"Configured SSH protocol version (typically \"2\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"serverPort":{"name":"serverPort","type":"\u0005","is_mandatory":true,"title":"TCP server port (default 22)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS management SSH service configuration","desc":"Configuration of the on-device SSH management service, the primary remote-administration channel into the switch. Covers whether the service is enabled, the negotiated protocol version and idle timeout, the server port and authentication mode, and the negotiated cryptographic primitives (ciphers, key-exchange, MAC, and host-key algorithms), plus whether FIPS restrictions are enforced. This is the surface auditors compare against SSH hardening benchmarks for weak algorithms, missing idle timeouts, and non-standard ports.","min_provider_version":"13.1.9","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.startupConfig":{"id":"arista.eos.startupConfig","name":"arista.eos.startupConfig","fields":{"content":{"name":"content","type":"\u0007","title":"EOS startup-config","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS startup configuration","desc":"Saved configuration the device loads on boot, as one string. Compare it against the running configuration to find changes that were made live and never saved, which would be lost on the next reload. The `arista.eos.configSavedToStartup` predicate does that comparison.","min_provider_version":"13.3.15","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.stp":{"id":"arista.eos.stp","name":"arista.eos.stp","fields":{"mst":{"name":"mst","type":"\u001barista.eos.stp.mst","title":"Arista EOS MST (Multiple Spanning Tree) instance","desc":"Single Multiple Spanning Tree instance selected by instanceId, for example instanceId \"0\". Covers the STP protocol variant, the local bridge parameters, the elected root and regional-root bridges, and the interfaces participating in this instance, so you can verify the spanning-tree topology and root-bridge placement.","provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"mstInstances":{"name":"mstInstances","type":"\u0019\u001barista.eos.stp.mst","title":"Multiple Spanning Tree Protocol (MST) instances","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS Spanning Tree Protocol (STP) configuration","desc":"Spanning Tree Protocol state for the device, exposing each configured Multiple Spanning Tree (MST) instance through mstInstances. Use it to audit the STP topology: which bridge is elected root, which is the regional root, and how each interface participates in loop prevention.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.stp.mst":{"id":"arista.eos.stp.mst","name":"arista.eos.stp.mst","fields":{"bridge":{"name":"bridge","type":"\n","is_mandatory":true,"title":"Local bridge parameters for this MST instance","desc":"Keys: priority, macAddress, systemIdExtension, and (for the default instance) forwardDelay, helloTime, maxAge.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"instanceId":{"name":"instanceId","type":"\u0007","is_mandatory":true,"title":"MST instance number","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interfaces":{"name":"interfaces","type":"\u0019\u001barista.eos.spt.mstInterface","is_mandatory":true,"title":"Interfaces on the specified MST instances","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"MST instance name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Spanning Tree Protocol variant for this MST instance","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"regionalRootBridge":{"name":"regionalRootBridge","type":"\n","is_mandatory":true,"title":"Regional root bridge for this MST region","desc":"Keys: priority, macAddress, systemIdExtension.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"rootBridge":{"name":"rootBridge","type":"\n","is_mandatory":true,"title":"Elected root bridge for this MST instance","desc":"Keys: priority, macAddress, systemIdExtension.","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS MST (Multiple Spanning Tree) instance","desc":"Single Multiple Spanning Tree instance selected by instanceId, for example instanceId \"0\". Covers the STP protocol variant, the local bridge parameters, the elected root and regional-root bridges, and the interfaces participating in this instance, so you can verify the spanning-tree topology and root-bridge placement.","min_provider_version":"9.0.0","defaults":"instanceId name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.switchport":{"id":"arista.eos.switchport","name":"arista.eos.switchport","fields":{"accessVlan":{"name":"accessVlan","type":"\u0007","is_mandatory":true,"title":"Access VLAN ID (for access mode)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Switchport mode (access, trunk)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Interface name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"trunkAllowedVlans":{"name":"trunkAllowedVlans","type":"\u0007","is_mandatory":true,"title":"Allowed VLANs on trunk (e.g., \"1-4094\", \"100,200,300\")","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"trunkGroups":{"name":"trunkGroups","type":"\u0019\u0007","is_mandatory":true,"title":"Trunk groups","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"trunkNativeVlan":{"name":"trunkNativeVlan","type":"\u0007","is_mandatory":true,"title":"Native VLAN ID (for trunk mode)","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS Layer-2 switchport configuration","desc":"Layer-2 switchport state for one interface, selected by `name` (for example `arista.eos.switchports.where(name == \"Ethernet1\")`). Reports the switchport `mode` (access or trunk), the access VLAN, the trunk native VLAN, the allowed-VLAN list, and any trunk groups, so you can flag misconfigured trunks or unexpected access-VLAN assignments.","min_provider_version":"11.1.0","defaults":"name mode","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.telnetService":{"id":"arista.eos.telnetService","name":"arista.eos.telnetService","fields":{"configured":{"name":"configured","type":"\u0004","is_mandatory":true,"title":"Whether a `management telnet` block exists in the running-config","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the telnet service is enabled (configured AND not shutdown)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"idleTimeout":{"name":"idleTimeout","type":"\u0005","is_mandatory":true,"title":"Idle timeout in minutes (0 = no timeout)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"ipAccessGroup":{"name":"ipAccessGroup","type":"\u0007","is_mandatory":true,"title":"Access-list name restricting connections (empty = no ACL)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"perHostLimit":{"name":"perHostLimit","type":"\u0005","is_mandatory":true,"title":"Maximum concurrent sessions per host","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"sessionLimit":{"name":"sessionLimit","type":"\u0005","is_mandatory":true,"title":"Maximum concurrent sessions","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS management telnet service","desc":"State of the `management telnet` service, covering whether the block exists and is actually enabled, the idle timeout, session limits (global and per-host), and any access-list restricting connections. Telnet is a plaintext protocol, so benchmarks generally require it to be disabled.","min_provider_version":"13.1.9","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.user":{"id":"arista.eos.user","name":"arista.eos.user","fields":{"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"Specifies how the secret is encoded","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"locked":{"name":"locked","type":"\u0004","title":"Whether the account can no longer authenticate","desc":"Computed as true when the account has no password (nopassword) and no configured SSH key, so no credential exists to log in with.","min_provider_version":"13.0.1","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The name of the user","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"nopassword":{"name":"nopassword","type":"\u0007","is_mandatory":true,"title":"Set to \"nopassword\" when the account has no password configured, empty otherwise","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"privilege":{"name":"privilege","type":"\u0007","is_mandatory":true,"title":"EOS privilege level, from 0 (most restricted) to 15 (full administrative access)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"User's assigned role","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"secret":{"name":"secret","type":"\u0007","is_mandatory":true,"title":"The secret (password) assigned to this user","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"sshkey":{"name":"sshkey","type":"\u0007","is_mandatory":true,"title":"User's sshkey","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS local user account","desc":"Local user account defined by a `username` line in the running-config: login name, EOS privilege level, assigned role, password state, secret encoding, and any configured SSH key. Audits use these accounts to find privilege-15 users, accounts with no password, weak secret encodings, and stale credentials. The `locked` predicate reports accounts that can no longer authenticate.","min_provider_version":"9.0.0","defaults":"name privilege","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.vlan":{"id":"arista.eos.vlan","name":"arista.eos.vlan","fields":{"dynamic":{"name":"dynamic","type":"\u0004","is_mandatory":true,"title":"Whether this is a dynamic VLAN","min_provider_version":"13.0.1","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VLAN ID","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interfaces":{"name":"interfaces","type":"\u0019\u0007","title":"Interfaces assigned to this VLAN","min_provider_version":"13.0.1","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VLAN name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"VLAN state (active, suspend)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"trunkGroups":{"name":"trunkGroups","type":"\u0019\u0007","is_mandatory":true,"title":"Trunk groups associated with the VLAN","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS VLAN","desc":"Layer 2 broadcast domain configured on the switch, selected by its numeric `id` (for example `arista.eos.vlan(id: \"10\")`). Covers the VLAN name, its administrative state (active or suspend), the trunk groups it belongs to, whether it was learned dynamically, and the interfaces assigned to it, so you can audit segmentation and confirm that only expected VLANs and ports are in use.","min_provider_version":"11.1.0","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.vrrp":{"id":"arista.eos.vrrp","name":"arista.eos.vrrp","fields":{"group":{"name":"group","type":"\u001barista.eos.vrrp.group","title":"Arista EOS VRRP group","desc":"Single VRRP group, keyed by `interface`/`groupId` (a `Vlan100` SVI typically hosts group `1`). `priority` plus `preempt` determine which device becomes master, `state` reports the current FSM state (master / backup / initial), and `virtualIps` is the list of gateway addresses the group advertises. `virtualMac` is the synthetic MAC the group answers ARP for.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/arista","is_implicit_resource":true},"groups":{"name":"groups","type":"\u0019\u001barista.eos.vrrp.group","title":"VRRP groups configured on this device","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS VRRP (Virtual Router Redundancy Protocol) configuration","desc":"VRRP first-hop redundancy state on the device. `groups` lists every VRRP instance configured (each with its `interface`, `groupId`, `priority`, `preempt` behavior, `state` of master / backup / initial, the `virtualIps` it advertises, and the `virtualMac`). Query this to audit gateway redundancy, for example asserting that every L3 subnet has a VRRP group, that priorities are split between the pair of switches, or that preempt is enabled.","min_provider_version":"13.2.7","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"arista.eos.vrrp.group":{"id":"arista.eos.vrrp.group","name":"arista.eos.vrrp.group","fields":{"advertisementInterval":{"name":"advertisementInterval","type":"\u0006","is_mandatory":true,"title":"Advertisement interval in seconds (typically 1.0)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"groupId":{"name":"groupId","type":"\u0005","is_mandatory":true,"title":"VRRP group ID (1-255)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"interface":{"name":"interface","type":"\u0007","is_mandatory":true,"title":"Parent interface (the SVI or routed port the group runs on)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"preempt":{"name":"preempt","type":"\u0004","is_mandatory":true,"title":"Whether preemption is enabled","desc":"When true, a higher-priority device that comes online will take over from a lower-priority current master.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"preemptDelay":{"name":"preemptDelay","type":"\u0005","is_mandatory":true,"title":"Preempt delay in seconds (time the new master waits before taking over)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"primaryIp":{"name":"primaryIp","type":"\u0007","is_mandatory":true,"title":"Primary (source) IP address used in VRRP advertisements","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Configured priority (1-254; higher wins, 255 reserved for IP owner)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"skewTime":{"name":"skewTime","type":"\u0006","is_mandatory":true,"title":"Skew time in seconds (priority-derived component of the master-down interval)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Current FSM state","desc":"One of `master`, `backup`, or `initial`.","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"VRRP protocol version (2 for IPv4, 3 for IPv4/IPv6)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"virtualIps":{"name":"virtualIps","type":"\u0019\u0007","is_mandatory":true,"title":"Virtual IP addresses the group advertises (the gateways clients use)","provider":"go.mondoo.com/cnquery/v9/providers/arista"},"virtualMac":{"name":"virtualMac","type":"\u0007","is_mandatory":true,"title":"Synthetic virtual MAC address the group answers ARP for","provider":"go.mondoo.com/cnquery/v9/providers/arista"}},"title":"Arista EOS VRRP group","desc":"Single VRRP group, keyed by `interface`/`groupId` (a `Vlan100` SVI typically hosts group `1`). `priority` plus `preempt` determine which device becomes master, `state` reports the current FSM state (master / backup / initial), and `virtualIps` is the list of gateway addresses the group advertises. `virtualMac` is the synthetic MAC the group answers ARP for.","private":true,"min_provider_version":"13.2.7","defaults":"interface groupId state priority","provider":"go.mondoo.com/cnquery/v9/providers/arista"}}}