{"resources":{"asset":{"id":"asset","name":"asset","fields":{"purl":{"name":"purl","type":"\u0007","title":"Platform URL in the package URL format","desc":"Package URL (purl) identifying the connected platform, built as `pkg:platform/\u003cname\u003e@\u003cversion\u003e` with the runtime added as a qualifier. Used to correlate the asset with advisories and inventory records.","provider":"go.mondoo.com/cnquery/providers/junos"}},"is_extension":true,"provider":"go.mondoo.com/cnquery/providers/junos"},"junos":{"id":"junos","name":"junos","fields":{"alarm":{"name":"alarm","type":"\u001bjunos.alarm","title":"Junos system alarm","desc":"System alarm currently raised on the device, with its severity class, description, time raised, and type. Presence of Major-class alarms usually warrants immediate attention.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"alarms":{"name":"alarms","type":"\u0019\u001bjunos.alarm","title":"List of active system alarms on the device","desc":"System alarms currently raised, from the `get-system-alarm-information` RPC, each with a class (Major for critical, Minor for noncritical), description, time raised, and type. An empty list means no active alarms.","provider":"go.mondoo.com/cnquery/providers/junos"},"bgpNeighbor":{"name":"bgpNeighbor","type":"\u001bjunos.bgpNeighbor","title":"Junos BGP neighbor session","desc":"BGP peering session from show bgp neighbor, reporting the peer and local AS numbers, session state, peer type, peer group, and prefix counts aggregated across every negotiated address family (RIB). The peer address has its BGP TCP port suffix stripped. Find down sessions with `junos.bgpNeighbors.where(state != \"Established\")`, or spot unexpectedly large received-prefix counts that may indicate a route leak.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"bgpNeighbors":{"name":"bgpNeighbors","type":"\u0019\u001bjunos.bgpNeighbor","title":"BGP neighbor sessions","desc":"BGP peering sessions with their peer and local AS numbers, session state, peer type (Internal or External), sent/received/accepted prefix counts, uptime, and peer group. Find sessions that are not established with `junos.bgpNeighbors.where(state != \"Established\")`.","provider":"go.mondoo.com/cnquery/providers/junos"},"certificate":{"name":"certificate","type":"\u001bjunos.certificate","title":"Junos PKI local certificate","desc":"Local PKI certificate installed on the device, from the get-pki-local-certificate RPC (show security pki local-certificate), with its subject and issuer distinguished names, validity window, public-key algorithm, and key size. Useful for finding weak keys with `junos.certificates.where(keySize \u003c 2048)` or certificates past their expiry by comparing notAfter against the current date.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"certificates":{"name":"certificates","type":"\u0019\u001bjunos.certificate","title":"PKI certificates installed on the device","desc":"Local PKI certificates with their subject, issuer, validity window, signature algorithm, and key size. Find certificates expiring soon by comparing notAfter, or flag weak keys with `junos.certificates.where(keySize \u003c 2048)`.","provider":"go.mondoo.com/cnquery/providers/junos"},"chassis":{"name":"chassis","type":"\u001bjunos.chassis","title":"Chassis hardware inventory","desc":"Chassis hardware inventory: the chassis serial number and description plus the full list of installed modules (FPCs, PICs, power supplies, fans) through its items field.","provider":"go.mondoo.com/cnquery/providers/junos"},"chassisEnvironment":{"name":"chassisEnvironment","type":"\u0019\u001bjunos.chassisEnvironmentItem","title":"Chassis environment (temperatures, fans, power)","desc":"Environmental sensor readings for the chassis, one entry per component, reporting status and temperature. Find components not reporting OK with `junos.chassisEnvironment.where(status != \"OK\")`.","provider":"go.mondoo.com/cnquery/providers/junos"},"chassisEnvironmentItem":{"name":"chassisEnvironmentItem","type":"\u001bjunos.chassisEnvironmentItem","title":"Junos chassis environment measurement (temperature, fan, power supply)","desc":"Environmental sensor reading for one chassis component, from the get-environment-information RPC (show chassis environment). Each reading reports the component name, its health status, a temperature value for thermal sensors, and the class of component it belongs to. Useful for health monitoring, for example find components not in a healthy state with `junos.chassisEnvironment.where(status != \"OK\")`.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"chassisItem":{"name":"chassisItem","type":"\u001bjunos.chassisItem","title":"Junos chassis hardware item (FPC, PIC, power supply, fan, etc.)","desc":"Single hardware module in the chassis inventory with its description, hardware and part revisions, serial and model numbers, and CLEI code. The name is parent-qualified (for example \"FPC 0/PIC 0\") to reflect its position in the inventory hierarchy. Useful for matching individual components against RMA, firmware, or end-of-life tracking.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"dns":{"name":"dns","type":"\u001bjunos.dns","title":"DNS resolver configuration","desc":"DNS domain name, search domains, and configured name servers from the running configuration.","provider":"go.mondoo.com/cnquery/providers/junos"},"firewallFilter":{"name":"firewallFilter","type":"\u001bjunos.firewallFilter","title":"Junos firewall filter (stateless ACL)","desc":"Firewall filter (stateless ACL) under [firewall] in the running config, identified by name and protocol family, with its ordered terms exposed through the terms field. Filters are applied to interfaces to permit, discard, or reject traffic based on match conditions, independent of the stateful security policies. Selected by name within a family, for example `junos.firewallFilters.where(family == \"inet\")`.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"firewallFilters":{"name":"firewallFilters","type":"\u0019\u001bjunos.firewallFilter","title":"Firewall filters (ACLs)","desc":"Firewall filters (stateless ACLs), each identified by name and protocol family, exposing its ordered terms through the terms field.","provider":"go.mondoo.com/cnquery/providers/junos"},"firewallTerm":{"name":"firewallTerm","type":"\u001bjunos.firewallTerm","title":"Junos firewall filter term (ACL rule)","desc":"Single term within a firewall filter, pairing from-match conditions with then-actions. The from-conditions are exposed as a dict keyed by condition type, and the then-actions list the directives applied to matching packets. Useful for spotting overly broad or unlogged terms, for example `junos.firewallFilters.terms.where(thenActions.contains(\"accept\") \u0026\u0026 !thenActions.contains(\"log\"))`.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"interface":{"name":"interface","type":"\u001bjunos.interface","title":"Junos network interface","desc":"Physical interface on the device with its administrative and operational status, description, MTU, speed, and link type. Compare adminStatus and operStatus to spot links that are enabled but not passing traffic.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"interfaces":{"name":"interfaces","type":"\u0019\u001bjunos.interface","title":"List of physical interfaces on the device","desc":"Physical interfaces from the `get-interface-information` operational RPC, each with its administrative and operational status, description, MTU, negotiated speed, and link-level type. Logical units (`ge-0/0/0.0`) are not listed, only their physical parents. Filter for enabled-but-down links with `junos.interfaces.where(adminStatus == \"up\" \u0026\u0026 operStatus == \"down\")`.","provider":"go.mondoo.com/cnquery/providers/junos"},"ipsec":{"name":"ipsec","type":"\u001bjunos.ipsec","title":"Junos IPsec security association","desc":"Active IPsec security association (an established IPsec/VPN tunnel data-plane pairing) reported by show security ipsec security-associations, with the remote and local tunnel endpoints, state, protocol, inbound and outbound security parameter indexes, negotiated authentication and encryption algorithms, and remaining lifetime. Use to confirm tunnels are up and negotiated with strong ciphers, for example `junos.ipsecSecurityAssociations.where(status == \"up\" \u0026\u0026 encAlgorithm == \"aes-256-cbc\")`.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"ipsecSecurityAssociations":{"name":"ipsecSecurityAssociations","type":"\u0019\u001bjunos.ipsec","title":"IPsec security associations","desc":"Active IPsec security associations (established VPN tunnels) from the `get-ipsec-security-associations-information` RPC, each with the remote and local gateways, SA state, protocol (ESP or AH), inbound/outbound SPIs, negotiated authentication and encryption algorithms, and remaining lifetime in seconds. Use to verify tunnels are up and negotiated strong ciphers rather than DES/3DES or MD5.","provider":"go.mondoo.com/cnquery/providers/junos"},"lag":{"name":"lag","type":"\u001bjunos.lag","title":"Junos link aggregation group (ae interface)","desc":"Aggregated Ethernet (ae) bundle from [edit interfaces], with its member interfaces, required minimum links, configured link speed, and LACP settings. Members are resolved from the physical interfaces that reference the bundle through ether-options/gigether-options ieee-802.3ad. Confirm LACP is enabled with `junos.lags.where(lacpActive == false)` to find static (non-LACP) bundles, which offer no misconfiguration or unidirectional-link protection.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"lags":{"name":"lags","type":"\u0019\u001bjunos.lag","title":"Link aggregation groups (ae interfaces)","desc":"Aggregated Ethernet (ae) bundles, each with its member interfaces, required minimum links, link speed, and LACP settings.","provider":"go.mondoo.com/cnquery/providers/junos"},"license":{"name":"license","type":"\u001bjunos.license","title":"Junos feature license","desc":"Feature license reported by `show system license` (the get-license-information RPC), with its state, expiration, and used-versus-installed counts. Two on-device formats are normalized here: the standard license-information list (per license key) and the license-usage-summary format (per feature). Find expired or over-subscribed entitlements with `junos.licenses.where(state == \"expired\")` or by comparing usedCount to installedCount.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"licenses":{"name":"licenses","type":"\u0019\u001bjunos.license","title":"Installed feature licenses","desc":"Feature licenses installed on the device, each with its state, expiration date, and used-versus-installed counts. Find expired entitlements with `junos.licenses.where(state == \"expired\")`.","provider":"go.mondoo.com/cnquery/providers/junos"},"loginClass":{"name":"loginClass","type":"\u001bjunos.loginClass","title":"Junos login class (permission profile)","desc":"Login class under [system login class] defining the permissions granted to accounts assigned to it, including permission flags, allow/deny command and configuration regexes, idle timeout, and Common Criteria security role. Useful for auditing which classes grant broad access (for example the \"all\" permission bit or a super-user class) and which accounts inherit them.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"loginClasses":{"name":"loginClasses","type":"\u0019\u001bjunos.loginClass","title":"Login classes (permission profiles)","desc":"Login classes that define the permissions granted to accounts assigned to them, including permission flags, allow/deny command and configuration regexes, idle timeout, and security role.","provider":"go.mondoo.com/cnquery/providers/junos"},"natRule":{"name":"natRule","type":"\u001bjunos.natRule","title":"Junos NAT rule","desc":"Source, destination, or static NAT rule read from the security configuration (security nat), flattened to one row per rule across all rule-sets. The natType field distinguishes the three kinds. Source NAT translates the source address of outbound flows (interface-based PAT or a named source pool); destination NAT redirects inbound flows to an internal host or port via a named pool; static NAT provides a one-to-one bidirectional mapping to a fixed prefix. For static rules matchSourceAddress is always empty and translationTarget holds the static-nat-prefix. Audit for overly broad matches, disabled translation (translationType \"off\"), and unexpected port redirections. For example `junos.natRules.where(natType == \"destination\")` lists all inbound redirections.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"natRules":{"name":"natRules","type":"\u0019\u001bjunos.natRule","title":"NAT rules","desc":"Source, destination, and static NAT rules from the `security nat` configuration, each with its rule-set, match conditions, translation type, and translation target. Select by NAT type with `junos.natRules.where(natType == \"static\")`; natType is source, destination, or static.","provider":"go.mondoo.com/cnquery/providers/junos"},"ntpPeer":{"name":"ntpPeer","type":"\u001bjunos.ntpPeer","title":"Junos NTP peer/server association","desc":"NTP association with a configured time source from show ntp associations, reporting its selection status, stratum, reachability, and timing statistics. The status field carries the tally code that indicates whether this source is selected as the system peer. Use to confirm the device is synchronized to a trusted, low-stratum server, for example `junos.ntpPeers.where(status == \"*\")` to find the currently selected source.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"ntpPeers":{"name":"ntpPeers","type":"\u0019\u001bjunos.ntpPeer","title":"NTP associations","desc":"NTP peer and server associations from the `get-ntp-associations-information` RPC, with each remote source's sync status (the leading `*`, `+`, `-` marker), stratum, reference ID, and offset/delay/jitter timing statistics. Confirm the device is synchronized to a trusted, low-stratum source.","provider":"go.mondoo.com/cnquery/providers/junos"},"ospfNeighbor":{"name":"ospfNeighbor","type":"\u001bjunos.ospfNeighbor","title":"Junos OSPF neighbor adjacency","desc":"OSPF adjacency with a neighboring router from show ospf neighbor, reporting the neighbor interface address and router ID, adjacency state, forming interface, election priority, area, and uptime. Verify fully established adjacencies with `junos.ospfNeighbors.where(state == \"Full\")`; neighbors stuck below \"Full\" (for example \"ExStart\" or \"2Way\") signal MTU mismatches, authentication failures, or DR/BDR election issues.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"ospfNeighbors":{"name":"ospfNeighbors","type":"\u0019\u001bjunos.ospfNeighbor","title":"OSPF neighbor adjacencies","desc":"OSPF adjacencies with the neighbor address and router ID, adjacency state, interface, priority, area, and uptime. Verify fully adjacent neighbors with `junos.ospfNeighbors.where(state == \"Full\")`; a neighbor stuck in ExStart, Exchange, or Init signals an adjacency problem.","provider":"go.mondoo.com/cnquery/providers/junos"},"redundancyGroup":{"name":"redundancyGroup","type":"\u001bjunos.redundancyGroup","title":"Junos chassis cluster redundancy group","desc":"Chassis-cluster (high-availability) redundancy group from the get-chassis-cluster-information RPC, reporting its status, failover count, per-node priorities and states, monitored-object count, and preempt setting. Redundancy group 0 controls the Routing Engine mastership; groups 1 and above control data-plane interface failover. Empty on standalone (non-clustered) devices. Use it to verify the cluster is healthy and each node holds the expected primary/secondary role, for example `junos.redundancyGroups.where(node0Status != \"primary\" \u0026\u0026 node1Status != \"primary\")`.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"redundancyGroups":{"name":"redundancyGroups","type":"\u0019\u001bjunos.redundancyGroup","title":"Chassis cluster redundancy groups","desc":"Chassis-cluster (high-availability) redundancy groups, each reporting its status, failover count, per-node priorities and states, monitored-object count, and preempt setting. Empty on standalone devices.","provider":"go.mondoo.com/cnquery/providers/junos"},"route":{"name":"route","type":"\u001bjunos.route","title":"Junos routing table entry","desc":"Route from a device routing table (show route), expanded to one row per next-hop so that multipath (ECMP) routes appear as separate entries. Reports the destination prefix, next-hop, source protocol, preference, metric, outgoing interface, whether it is the active (forwarding-installed) route, and the owning table. Audit for unexpected static routes, default routes, or routes learned from an unintended protocol, for example `junos.routes.where(destination == \"0.0.0.0/0\")`.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"routes":{"name":"routes","type":"\u0019\u001bjunos.route","title":"Routing table entries","desc":"Routes from the device routing tables, one entry per active next-hop. Each route reports its destination prefix, next-hop, protocol (Static, Direct, Local, OSPF, BGP, and so on), preference, metric, outgoing interface, whether it is the active route, and the table it belongs to (for example `inet.0` for IPv4 or `inet6.0` for IPv6 unicast).","provider":"go.mondoo.com/cnquery/providers/junos"},"routingEngine":{"name":"routingEngine","type":"\u001bjunos.routingEngine","title":"Junos routing engine information","desc":"Routing engine (control-plane processor) with its slot, model, status, temperature, memory and CPU utilization, uptime, last reboot reason, and running Junos version. Dual-RE and chassis-cluster platforms report one entry per engine.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"routingEngines":{"name":"routingEngines","type":"\u0019\u001bjunos.routingEngine","title":"Routing engine information","desc":"Routing engines (control-plane processors) from the `get-route-engine-information` RPC, with model, status, temperature, memory and CPU utilization, uptime, last reboot reason, and running Junos version. Dual-RE, Virtual Chassis, and chassis-cluster platforms report one entry per engine, keyed by slot.","provider":"go.mondoo.com/cnquery/providers/junos"},"screen":{"name":"screen","type":"\u001bjunos.screen","title":"Junos IDS screen profile","desc":"Screen (IDS) profile from the security configuration (security screen ids-option) that protects a zone against common network attacks. Each well-known protection is exposed as an individual boolean, and the options field lists every enabled protection by its configuration keyword so that protections beyond the named booleans are still visible. A profile takes effect only when attached to a zone through the zone screen field. Audit internet-facing zones for missing flood and malformed-packet protections, for example `junos.screens.where(!tcpSynFlood)`.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"screenProfiles":{"name":"screenProfiles","type":"\u0019\u001bjunos.screen","title":"IDS/IPS screen profiles","desc":"Screen (IDS) profiles from the `security screen` configuration that protect against network attacks. Each profile exposes booleans for individual protections (ICMP ping-of-death, IP source-route-option and tear-drop, TCP SYN-flood, land, and WinNuke) plus the full list of the enabled options as strings.","provider":"go.mondoo.com/cnquery/providers/junos"},"securityPolicies":{"name":"securityPolicies","type":"\u0019\u001bjunos.securityPolicy","title":"Security policies","desc":"Zone-pair security policies from the `security policies` running configuration, each defining the traffic permitted or denied from a source zone to a destination zone. Fields cover the matched source and destination addresses and applications, the action (permit, deny, or reject), and whether session-init/session-close logging or session counting is enabled. Find permissive rules with `junos.securityPolicies.where(action == \"permit\")`. Empty on platforms (routers, switches) that do not run the security-policy feature.","provider":"go.mondoo.com/cnquery/providers/junos"},"securityPolicy":{"name":"securityPolicy","type":"\u001bjunos.securityPolicy","title":"Junos security policy rule","desc":"Zone-pair security policy controlling traffic between a source and destination zone. Combines the match criteria (source and destination addresses, applications) with the action taken (permit, deny, reject) and logging or counting flags. Overly broad permit rules (for example matching the \"any\" address) are a common finding.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"securityZone":{"name":"securityZone","type":"\u001bjunos.securityZone","title":"Junos security zone","desc":"Security zone grouping interfaces into a trust boundary. Reports the member interfaces, any applied screen profile, and the host-inbound system services and protocols permitted to reach the device itself through this zone. Host-inbound entries are collected from both the zone-level and per-interface configuration and deduplicated.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"securityZones":{"name":"securityZones","type":"\u0019\u001bjunos.securityZone","title":"Security zones","desc":"Security zones that group interfaces into trust boundaries, from the `security zones` configuration. Each zone lists its member interfaces, any applied screen profile, and the host-inbound system services and protocols permitted to reach the Routing Engine itself through that zone (merged from the zone-level and per-interface host-inbound-traffic stanzas).","provider":"go.mondoo.com/cnquery/providers/junos"},"service":{"name":"service","type":"\u001bjunos.service","title":"Junos system service","desc":"Management or access service enabled under [system services] in the running configuration. Only services that are configured (and therefore enabled) are returned, so the presence of an entry means the service is on. Detection covers the recognized set ssh, netconf, web-management, ftp, telnet, finger, dhcp, xnm-ssl, and rest. Useful for flagging insecure cleartext services with `junos.services.where(name == \"telnet\" || name == \"ftp\" || name == \"finger\")`.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"services":{"name":"services","type":"\u0019\u001bjunos.service","title":"Enabled system services","desc":"Management and access services enabled in the running configuration (for example ssh, netconf, web-management, ftp, telnet). Only enabled services appear, so `junos.services.where(name == \"telnet\")` returning a result means telnet is on.","provider":"go.mondoo.com/cnquery/providers/junos"},"snmpCommunities":{"name":"snmpCommunities","type":"\u0019\u001bjunos.snmpCommunity","title":"SNMP community configurations","desc":"SNMPv1/v2c communities with their authorization level (read-only or read-write) and the client addresses permitted to use them. Flag weak or default community strings and write access.","provider":"go.mondoo.com/cnquery/providers/junos"},"snmpCommunity":{"name":"snmpCommunity","type":"\u001bjunos.snmpCommunity","title":"Junos SNMP community configuration","desc":"SNMPv1/v2c community from [edit snmp community], with its authorization level and the client addresses permitted to poll with it. Read-write communities, communities open to any client, and weak or default community strings (for example \"public\" or \"private\") are common findings. Flag unrestricted or writable access with `junos.snmpCommunities.where(authorization == \"read-write\" || clients == empty)`.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"sshConfig":{"name":"sshConfig","type":"\u001bjunos.sshConfig","title":"SSH server configuration","desc":"SSH server settings from the running configuration: root-login policy, protocol version, session and connection limits, and the configured ciphers, MACs, key-exchange and host-key algorithms. Use to audit for weak crypto or permissive root login.","provider":"go.mondoo.com/cnquery/providers/junos"},"syslogHost":{"name":"syslogHost","type":"\u001bjunos.syslogHost","title":"Junos syslog host configuration","desc":"Remote syslog destination from the running configuration ([edit system syslog host]), expanded to one entry per facility/severity combination configured for the host. Reports the destination address, the transport protocol and port, the source address, and any log prefix. Having no syslogHost at all, or forwarding only over plaintext udp, is a common logging-coverage and log-integrity finding: audit with `junos.syslogHosts.where(transport != \"tls\")` or by asserting at least one host exists.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"syslogHosts":{"name":"syslogHosts","type":"\u0019\u001bjunos.syslogHost","title":"Syslog host configurations","desc":"Remote syslog destinations from the running configuration, one entry per facility/severity combination, with the destination host, transport, and source address. Use to confirm logs are shipped off-box.","provider":"go.mondoo.com/cnquery/providers/junos"},"system":{"name":"system","type":"\u001bjunos.system","title":"System information about the connected Junos device","desc":"Hostname, hardware model, serial number, Junos OS version, and OS name of the device, taken from the connection's software-information snapshot. Use `junos.system` to record which platform and software release an audit ran against.","provider":"go.mondoo.com/cnquery/providers/junos"},"user":{"name":"user","type":"\u001bjunos.user","title":"Junos local user account","desc":"Local login account from the running configuration (system login user) with its login class, UID, full name, whether an encrypted password is set, and any configured SSH public keys. The login class determines the account's permissions and authorization. Audit privileged accounts, accounts without a password, and their key-based authentication, for example `junos.users.where(class == \"super-user\")`.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bjunos.user","title":"Local user accounts","desc":"Local login accounts from the `system login user` configuration, each with its login class, UID, full name, whether a password hash is set, and any configured SSH public keys. Use to audit account privilege assignments and whether accounts rely on passwords versus SSH keys.","provider":"go.mondoo.com/cnquery/providers/junos"},"vlan":{"name":"vlan","type":"\u001bjunos.vlan","title":"Junos VLAN configuration","desc":"VLAN definition from [edit vlans], with its 802.1Q tag, member interfaces, and any associated Layer 3 (routed) interface. Selected by its configured name. Useful for auditing VLAN-to-interface assignments and confirming which VLANs are routed. For example `junos.vlans.where(l3Interface != \"\")` lists VLANs with a routed gateway.","provider":"go.mondoo.com/cnquery/providers/junos","is_implicit_resource":true},"vlans":{"name":"vlans","type":"\u0019\u001bjunos.vlan","title":"VLANs configured on the device","desc":"VLANs from the running configuration, each with its 802.1Q tag, member interfaces, and associated Layer 3 interface.","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Juniper Junos OS","desc":"Juniper networking device running Junos OS, queried over NETCONF. Exposes operational state (interfaces, routing engines, alarms, routes, BGP/OSPF neighbors, IPsec SAs, chassis inventory and environment) alongside the running configuration (security policies and zones, NAT rules, firewall filters, local users and login classes, SSH and system services, syslog, SNMP, DNS, NTP, VLANs, link aggregation, screen profiles, and licenses). The starting point for auditing SRX firewalls, MX routers, EX switches, and other Junos platforms.","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.alarm":{"id":"junos.alarm","name":"junos.alarm","fields":{"alarmType":{"name":"alarmType","type":"\u0007","is_mandatory":true,"title":"Alarm type (e.g., \"Chassis\", \"License\")","provider":"go.mondoo.com/cnquery/providers/junos"},"class":{"name":"class","type":"\u0007","is_mandatory":true,"title":"Alarm class (\"Major\" or \"Minor\")","provider":"go.mondoo.com/cnquery/providers/junos"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Alarm description","provider":"go.mondoo.com/cnquery/providers/junos"},"time":{"name":"time","type":"\u0007","is_mandatory":true,"title":"Time when the alarm was raised","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos system alarm","desc":"System alarm currently raised on the device, with its severity class, description, time raised, and type. Presence of Major-class alarms usually warrants immediate attention.","defaults":"class description time","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.bgpNeighbor":{"id":"junos.bgpNeighbor","name":"junos.bgpNeighbor","fields":{"acceptedPrefixes":{"name":"acceptedPrefixes","type":"\u0005","is_mandatory":true,"title":"Number of prefixes accepted after inbound policy, summed across all address families","provider":"go.mondoo.com/cnquery/providers/junos"},"elapsed":{"name":"elapsed","type":"\u0007","is_mandatory":true,"title":"Time elapsed since the session entered its current state","provider":"go.mondoo.com/cnquery/providers/junos"},"localAs":{"name":"localAs","type":"\u0005","is_mandatory":true,"title":"Local autonomous system number advertised to the peer","provider":"go.mondoo.com/cnquery/providers/junos"},"peerAddress":{"name":"peerAddress","type":"\u0007","is_mandatory":true,"title":"Peer IP address (BGP TCP port suffix removed)","provider":"go.mondoo.com/cnquery/providers/junos"},"peerAs":{"name":"peerAs","type":"\u0005","is_mandatory":true,"title":"Peer autonomous system number","provider":"go.mondoo.com/cnquery/providers/junos"},"peerGroup":{"name":"peerGroup","type":"\u0007","is_mandatory":true,"title":"Peer group the neighbor belongs to","provider":"go.mondoo.com/cnquery/providers/junos"},"peerType":{"name":"peerType","type":"\u0007","is_mandatory":true,"title":"Peer type","desc":"\"Internal\" for an iBGP peer (same AS) or \"External\" for an eBGP peer (different AS).","provider":"go.mondoo.com/cnquery/providers/junos"},"receivedPrefixes":{"name":"receivedPrefixes","type":"\u0005","is_mandatory":true,"title":"Number of prefixes received from the peer, summed across all address families","provider":"go.mondoo.com/cnquery/providers/junos"},"sentPrefixes":{"name":"sentPrefixes","type":"\u0005","is_mandatory":true,"title":"Number of prefixes advertised to the peer, summed across all address families","provider":"go.mondoo.com/cnquery/providers/junos"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Session state","desc":"BGP finite-state-machine state: \"Idle\", \"Connect\", \"Active\", \"OpenSent\", \"OpenConfirm\", or \"Established\". Only \"Established\" sessions exchange routes.","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos BGP neighbor session","desc":"BGP peering session from show bgp neighbor, reporting the peer and local AS numbers, session state, peer type, peer group, and prefix counts aggregated across every negotiated address family (RIB). The peer address has its BGP TCP port suffix stripped. Find down sessions with `junos.bgpNeighbors.where(state != \"Established\")`, or spot unexpectedly large received-prefix counts that may indicate a route leak.","defaults":"peerAddress peerAs state","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.certificate":{"id":"junos.certificate","name":"junos.certificate","fields":{"algorithm":{"name":"algorithm","type":"\u0007","is_mandatory":true,"title":"Public-key algorithm","desc":"Algorithm of the certificate's public key, for example \"rsaEncryption\" (RSA), \"id-ecPublicKey\" (ECDSA), or \"dsaEncryption\" (DSA).","provider":"go.mondoo.com/cnquery/providers/junos"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Issuer distinguished name","desc":"Distinguished name of the issuing certificate authority.","provider":"go.mondoo.com/cnquery/providers/junos"},"keySize":{"name":"keySize","type":"\u0005","is_mandatory":true,"title":"Public-key size in bits","desc":"Modulus or curve size of the public key, for example 2048 or 4096 for RSA. Keys smaller than 2048 bits are considered weak.","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Certificate identifier","desc":"The certificate-id under which the certificate was enrolled or generated on the device (the PKI local-certificate name), not a field of the certificate itself.","provider":"go.mondoo.com/cnquery/providers/junos"},"notAfter":{"name":"notAfter","type":"\u0007","is_mandatory":true,"title":"End of the validity period (not valid after)","desc":"Timestamp string as the device reports it. The certificate has expired once the current time is past this instant.","provider":"go.mondoo.com/cnquery/providers/junos"},"notBefore":{"name":"notBefore","type":"\u0007","is_mandatory":true,"title":"Start of the validity period (not valid before)","desc":"Timestamp string as the device reports it. The certificate is not valid before this instant.","provider":"go.mondoo.com/cnquery/providers/junos"},"subject":{"name":"subject","type":"\u0007","is_mandatory":true,"title":"Subject distinguished name","desc":"Distinguished name of the certificate's subject (the entity the certificate identifies), for example \"CN=srx.example.com, O=Example\".","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos PKI local certificate","desc":"Local PKI certificate installed on the device, from the get-pki-local-certificate RPC (show security pki local-certificate), with its subject and issuer distinguished names, validity window, public-key algorithm, and key size. Useful for finding weak keys with `junos.certificates.where(keySize \u003c 2048)` or certificates past their expiry by comparing notAfter against the current date.","defaults":"name subject notAfter","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.chassis":{"id":"junos.chassis","name":"junos.chassis","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Chassis model description (for example \"SRX340\")","provider":"go.mondoo.com/cnquery/providers/junos"},"items":{"name":"items","type":"\u0019\u001bjunos.chassisItem","title":"Chassis hardware items (FPCs, PICs, power supplies, fans, and more)","desc":"All hardware modules in the chassis, flattened from the nested inventory so that sub-modules (for example a PIC inside an FPC) appear as their own entries with a parent-qualified name.","provider":"go.mondoo.com/cnquery/providers/junos"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Chassis serial number","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos chassis hardware inventory","desc":"Chassis hardware inventory from `show chassis hardware` (the get-chassis-inventory RPC): the chassis serial number and description, plus the full list of installed modules through the items field. Reachable through the singleton junos.chassis. Useful for hardware lifecycle and asset-tracking audits, and for correlating installed components against end-of-life notices.","defaults":"serialNumber description","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.chassisEnvironmentItem":{"id":"junos.chassisEnvironmentItem","name":"junos.chassisEnvironmentItem","fields":{"class":{"name":"class","type":"\u0007","is_mandatory":true,"title":"Component class","desc":"Category of the reading: \"Temp\" (temperature sensors), \"Fans\" (fans and blowers), \"Power\" (power entry modules and supplies), or \"Misc\" (miscellaneous components such as craft interfaces).","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Component name","desc":"Sensor or component label as reported by the chassis, for example \"PEM 0\", \"FPC 0 Intake\", \"Routing Engine 0\", or \"Fan Tray 1\".","provider":"go.mondoo.com/cnquery/providers/junos"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Component health status","desc":"One of \"OK\", \"Check\", \"Testing\", \"Failed\", or \"Absent\". \"OK\" means the component is present and healthy, \"Check\" flags a condition needing attention, \"Testing\" is a transient self-test state, \"Failed\" indicates a fault, and \"Absent\" means the slot is empty. Filter with `.where(status == \"Failed\" || status == \"Check\")` to surface problems.","provider":"go.mondoo.com/cnquery/providers/junos"},"temperature":{"name":"temperature","type":"\u0007","is_mandatory":true,"title":"Temperature reading for thermal sensors","desc":"Raw temperature string with units as the device reports it, for example \"41 degrees C / 105 degrees F\". Empty for non-thermal components such as fans and power supplies (class \"Fans\", \"Power\", or \"Misc\").","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos chassis environment measurement (temperature, fan, power supply)","desc":"Environmental sensor reading for one chassis component, from the get-environment-information RPC (show chassis environment). Each reading reports the component name, its health status, a temperature value for thermal sensors, and the class of component it belongs to. Useful for health monitoring, for example find components not in a healthy state with `junos.chassisEnvironment.where(status != \"OK\")`.","defaults":"name status class","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.chassisItem":{"id":"junos.chassisItem","name":"junos.chassisItem","fields":{"cleiCode":{"name":"cleiCode","type":"\u0007","is_mandatory":true,"title":"CLEI (Common Language Equipment Identification) code, an industry","desc":"hardware identifier used for inventory and procurement","provider":"go.mondoo.com/cnquery/providers/junos"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Item model description","provider":"go.mondoo.com/cnquery/providers/junos"},"modelNumber":{"name":"modelNumber","type":"\u0007","is_mandatory":true,"title":"Model number of the component","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Parent-qualified item name reflecting its inventory position (for example","desc":"\"FPC 0\", \"FPC 0/PIC 0\", \"Power Supply 0\")","provider":"go.mondoo.com/cnquery/providers/junos"},"partNumber":{"name":"partNumber","type":"\u0007","is_mandatory":true,"title":"Manufacturer part number","provider":"go.mondoo.com/cnquery/providers/junos"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Component serial number","provider":"go.mondoo.com/cnquery/providers/junos"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Hardware revision of the module","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos chassis hardware item (FPC, PIC, power supply, fan, etc.)","desc":"Single hardware module in the chassis inventory with its description, hardware and part revisions, serial and model numbers, and CLEI code. The name is parent-qualified (for example \"FPC 0/PIC 0\") to reflect its position in the inventory hierarchy. Useful for matching individual components against RMA, firmware, or end-of-life tracking.","defaults":"name description","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.dns":{"id":"junos.dns","name":"junos.dns","fields":{"domain":{"name":"domain","type":"\u0007","is_mandatory":true,"title":"Default domain name (domain-name) appended to unqualified hostnames when","desc":"no search list matches; empty when not configured","provider":"go.mondoo.com/cnquery/providers/junos"},"nameServers":{"name":"nameServers","type":"\u0019\u0007","is_mandatory":true,"title":"Recursive name server addresses the device queries, in configured","desc":"preference order","provider":"go.mondoo.com/cnquery/providers/junos"},"search":{"name":"search","type":"\u0019\u0007","is_mandatory":true,"title":"Ordered domain-search list appended, in turn, to unqualified hostnames","desc":"during resolution","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos DNS resolver configuration","desc":"DNS resolver settings from [edit system], covering the device's own default domain, the search list appended to unqualified names, and the recursive name servers it queries. Reachable through the singleton junos.dns. Useful for confirming name servers point at approved resolvers and that a search domain is set.","defaults":"domain","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.firewallFilter":{"id":"junos.firewallFilter","name":"junos.firewallFilter","fields":{"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Protocol family","desc":"One of \"inet\" (IPv4), \"inet6\" (IPv6), or \"ethernet-switching\" (Layer 2). Filters defined at the top level of [firewall] without an explicit family are reported as \"inet\".","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Filter name","provider":"go.mondoo.com/cnquery/providers/junos"},"terms":{"name":"terms","type":"\u0019\u001bjunos.firewallTerm","title":"Filter terms (rules)","desc":"Ordered terms that make up the filter, each pairing match conditions with actions. Terms are evaluated top to bottom and the first matching term decides the action; traffic matching no term is discarded by the implicit default.","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos firewall filter (stateless ACL)","desc":"Firewall filter (stateless ACL) under [firewall] in the running config, identified by name and protocol family, with its ordered terms exposed through the terms field. Filters are applied to interfaces to permit, discard, or reject traffic based on match conditions, independent of the stateful security policies. Selected by name within a family, for example `junos.firewallFilters.where(family == \"inet\")`.","defaults":"name family","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.firewallTerm":{"id":"junos.firewallTerm","name":"junos.firewallTerm","fields":{"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Protocol family of the parent filter","desc":"One of \"inet\", \"inet6\", or \"ethernet-switching\", inherited from the firewall filter that contains this term.","provider":"go.mondoo.com/cnquery/providers/junos"},"filterName":{"name":"filterName","type":"\u0007","is_mandatory":true,"title":"Name of the filter this term belongs to","provider":"go.mondoo.com/cnquery/providers/junos"},"fromConditions":{"name":"fromConditions","type":"\n","is_mandatory":true,"title":"From (match) conditions","desc":"Match criteria keyed by condition type, each mapping to a list of string values. Possible keys are \"protocol\", \"port\", \"destination-port\", \"source-port\", \"source-address\", and \"destination-address\"; address keys carry the configured prefix or address-book names. A key is present only when that condition is configured on the term, and a term with no from-conditions matches all traffic.","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Term name","provider":"go.mondoo.com/cnquery/providers/junos"},"thenActions":{"name":"thenActions","type":"\u0019\u0007","is_mandatory":true,"title":"Then (action) directives","desc":"Actions applied to matching packets, drawn from \"accept\", \"discard\" (silently drop), \"reject\" (drop and send an ICMP error), \"log\", and \"count\". A term can carry several of these together (for example both \"accept\" and \"log\").","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos firewall filter term (ACL rule)","desc":"Single term within a firewall filter, pairing from-match conditions with then-actions. The from-conditions are exposed as a dict keyed by condition type, and the then-actions list the directives applied to matching packets. Useful for spotting overly broad or unlogged terms, for example `junos.firewallFilters.terms.where(thenActions.contains(\"accept\") \u0026\u0026 !thenActions.contains(\"log\"))`.","defaults":"name","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.interface":{"id":"junos.interface","name":"junos.interface","fields":{"adminStatus":{"name":"adminStatus","type":"\u0007","is_mandatory":true,"title":"Administrative status (\"up\" or \"down\")","provider":"go.mondoo.com/cnquery/providers/junos"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Interface description","provider":"go.mondoo.com/cnquery/providers/junos"},"linkType":{"name":"linkType","type":"\u0007","is_mandatory":true,"title":"Link-level type (e.g., \"Ethernet\")","provider":"go.mondoo.com/cnquery/providers/junos"},"mtu":{"name":"mtu","type":"\u0005","is_mandatory":true,"title":"Interface MTU in bytes","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Interface name (e.g., \"ge-0/0/0\", \"lo0\")","provider":"go.mondoo.com/cnquery/providers/junos"},"operStatus":{"name":"operStatus","type":"\u0007","is_mandatory":true,"title":"Operational status (\"up\" or \"down\")","provider":"go.mondoo.com/cnquery/providers/junos"},"speed":{"name":"speed","type":"\u0007","is_mandatory":true,"title":"Interface speed (e.g., \"1000mbps\", \"10Gbps\"); empty for interfaces with no negotiated speed","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos network interface","desc":"Physical interface on the device with its administrative and operational status, description, MTU, speed, and link type. Compare adminStatus and operStatus to spot links that are enabled but not passing traffic.","defaults":"name operStatus adminStatus","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.ipsec":{"id":"junos.ipsec","name":"junos.ipsec","fields":{"authAlgorithm":{"name":"authAlgorithm","type":"\u0007","is_mandatory":true,"title":"Negotiated authentication (integrity) algorithm, such as \"hmac-sha-256-128\" or \"hmac-sha1-96\"","provider":"go.mondoo.com/cnquery/providers/junos"},"encAlgorithm":{"name":"encAlgorithm","type":"\u0007","is_mandatory":true,"title":"Negotiated encryption algorithm, such as \"aes-256-cbc\", \"aes-128-gcm\", or \"3des-cbc\"","provider":"go.mondoo.com/cnquery/providers/junos"},"index":{"name":"index","type":"\u0005","is_mandatory":true,"title":"Security association index assigned by the device","provider":"go.mondoo.com/cnquery/providers/junos"},"lifetimeRemaining":{"name":"lifetimeRemaining","type":"\u0005","is_mandatory":true,"title":"Lifetime remaining before the SA is rekeyed, in seconds","provider":"go.mondoo.com/cnquery/providers/junos"},"localGateway":{"name":"localGateway","type":"\u0007","is_mandatory":true,"title":"Local tunnel gateway IP address","provider":"go.mondoo.com/cnquery/providers/junos"},"monitoringState":{"name":"monitoringState","type":"\u0007","is_mandatory":true,"title":"VPN monitoring state","desc":"\"U\" when VPN monitoring is enabled and up, \"D\" when monitoring is enabled but down, or \"-\" when VPN monitoring is not configured for the SA.","provider":"go.mondoo.com/cnquery/providers/junos"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"IPsec protocol","desc":"Security protocol protecting the traffic: \"ESP\" (Encapsulating Security Payload, encryption plus integrity) or \"AH\" (Authentication Header, integrity only).","provider":"go.mondoo.com/cnquery/providers/junos"},"remoteGateway":{"name":"remoteGateway","type":"\u0007","is_mandatory":true,"title":"Remote tunnel gateway (peer) IP address","provider":"go.mondoo.com/cnquery/providers/junos"},"spiInbound":{"name":"spiInbound","type":"\u0007","is_mandatory":true,"title":"Inbound security parameter index (SPI), a hex value identifying the inbound SA","provider":"go.mondoo.com/cnquery/providers/junos"},"spiOutbound":{"name":"spiOutbound","type":"\u0007","is_mandatory":true,"title":"Outbound security parameter index (SPI), a hex value identifying the outbound SA","provider":"go.mondoo.com/cnquery/providers/junos"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"SA state","desc":"\"up\" when the security association is installed and passing traffic, \"down\" otherwise.","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos IPsec security association","desc":"Active IPsec security association (an established IPsec/VPN tunnel data-plane pairing) reported by show security ipsec security-associations, with the remote and local tunnel endpoints, state, protocol, inbound and outbound security parameter indexes, negotiated authentication and encryption algorithms, and remaining lifetime. Use to confirm tunnels are up and negotiated with strong ciphers, for example `junos.ipsecSecurityAssociations.where(status == \"up\" \u0026\u0026 encAlgorithm == \"aes-256-cbc\")`.","defaults":"remoteGateway status protocol","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.lag":{"id":"junos.lag","name":"junos.lag","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-text bundle description; empty when not configured","provider":"go.mondoo.com/cnquery/providers/junos"},"lacpActive":{"name":"lacpActive","type":"\u0004","is_mandatory":true,"title":"Whether LACP is enabled on the bundle (either active or passive mode is","desc":"configured). False means a static bundle with no LACP negotiation.","provider":"go.mondoo.com/cnquery/providers/junos"},"lacpInterval":{"name":"lacpInterval","type":"\u0007","is_mandatory":true,"title":"LACP periodic transmit interval","desc":"Either \"fast\" (LACP packets every 1 second) or \"slow\" (every 30 seconds). Empty when LACP is not configured.","provider":"go.mondoo.com/cnquery/providers/junos"},"linkSpeed":{"name":"linkSpeed","type":"\u0007","is_mandatory":true,"title":"Required member link speed as configured (for example \"1g\", \"10g\"),","desc":"expressed in bits per second; empty when not constrained","provider":"go.mondoo.com/cnquery/providers/junos"},"memberCount":{"name":"memberCount","type":"\u0005","is_mandatory":true,"title":"Count of member interfaces referencing this bundle","provider":"go.mondoo.com/cnquery/providers/junos"},"members":{"name":"members","type":"\u0019\u0007","is_mandatory":true,"title":"Physical member interfaces bundled into this LAG","provider":"go.mondoo.com/cnquery/providers/junos"},"minimumLinks":{"name":"minimumLinks","type":"\u0005","is_mandatory":true,"title":"Minimum number of member links that must be up for the bundle to stay","desc":"operationally up (Junos minimum-links, 1 through 8); 0 when unset, in which case Junos defaults to 1","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Aggregated Ethernet interface name (for example \"ae0\")","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos link aggregation group (ae interface)","desc":"Aggregated Ethernet (ae) bundle from [edit interfaces], with its member interfaces, required minimum links, configured link speed, and LACP settings. Members are resolved from the physical interfaces that reference the bundle through ether-options/gigether-options ieee-802.3ad. Confirm LACP is enabled with `junos.lags.where(lacpActive == false)` to find static (non-LACP) bundles, which offer no misconfiguration or unidirectional-link protection.","defaults":"name memberCount","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.license":{"id":"junos.license","name":"junos.license","fields":{"expiryDate":{"name":"expiryDate","type":"\u0007","is_mandatory":true,"title":"License expiration","desc":"Expiration date of the key, or a validity type such as \"permanent\" for keys that never expire. In the usage-summary format this carries the feature's validity-type rather than a date.","provider":"go.mondoo.com/cnquery/providers/junos"},"installedCount":{"name":"installedCount","type":"\u0005","is_mandatory":true,"title":"Number of license instances installed (the entitlement); compare against","desc":"usedCount to detect over-subscription","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"License name or feature identifier the key entitles","provider":"go.mondoo.com/cnquery/providers/junos"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Serial number of the license key; empty in the usage-summary format","provider":"go.mondoo.com/cnquery/providers/junos"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"License validity state","desc":"One of \"valid\", \"invalid\" (key entered incorrectly or not valid for this device), or \"expired\". Empty when derived from the license-usage-summary format, which reports usage counts rather than a per-key state.","provider":"go.mondoo.com/cnquery/providers/junos"},"usedCount":{"name":"usedCount","type":"\u0005","is_mandatory":true,"title":"Number of license instances currently in use (consumed)","provider":"go.mondoo.com/cnquery/providers/junos"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"License key version; 0 when not reported (including the usage-summary","desc":"format)","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos feature license","desc":"Feature license reported by `show system license` (the get-license-information RPC), with its state, expiration, and used-versus-installed counts. Two on-device formats are normalized here: the standard license-information list (per license key) and the license-usage-summary format (per feature). Find expired or over-subscribed entitlements with `junos.licenses.where(state == \"expired\")` or by comparing usedCount to installedCount.","defaults":"name state","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.loginClass":{"id":"junos.loginClass","name":"junos.loginClass","fields":{"allowCommands":{"name":"allowCommands","type":"\u0007","is_mandatory":true,"title":"Allowed CLI commands regex","desc":"Extended regular expression of operational-mode commands this class may run beyond its permission bits. Empty when unset.","provider":"go.mondoo.com/cnquery/providers/junos"},"allowConfiguration":{"name":"allowConfiguration","type":"\u0007","is_mandatory":true,"title":"Allowed configuration hierarchies regex","desc":"Extended regular expression of configuration hierarchy paths this class may view or modify. Empty when unset.","provider":"go.mondoo.com/cnquery/providers/junos"},"denyCommands":{"name":"denyCommands","type":"\u0007","is_mandatory":true,"title":"Denied CLI commands regex","desc":"Extended regular expression of operational-mode commands this class is barred from running. Empty when unset.","provider":"go.mondoo.com/cnquery/providers/junos"},"denyConfiguration":{"name":"denyConfiguration","type":"\u0007","is_mandatory":true,"title":"Denied configuration hierarchies regex","desc":"Extended regular expression of configuration hierarchy paths this class is barred from. Empty when unset.","provider":"go.mondoo.com/cnquery/providers/junos"},"idleTimeout":{"name":"idleTimeout","type":"\u0005","is_mandatory":true,"title":"Idle timeout in minutes","desc":"Number of minutes a session for this class may sit idle before it is disconnected. 0 means no idle timeout (sessions never time out), which is a hardening concern.","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Class name","desc":"Name of the login class, either a built-in class (\"super-user\", \"operator\", \"read-only\", \"unauthorized\") or a custom class defined in the configuration.","provider":"go.mondoo.com/cnquery/providers/junos"},"permissions":{"name":"permissions","type":"\u0019\u0007","is_mandatory":true,"title":"Permission flags granted to the class","desc":"Permission bits controlling what the class can view and change. \"all\" grants every permission (full super-user access); other common bits include \"view\", \"configure\", \"maintenance\", \"admin\", \"control\", \"network\", \"routing\", \"security\", \"firewall\", and \"secret\", most of which also have \"-control\" variants that add write access. Flag classes granting \"all\" with `.where(permissions.contains(\"all\"))`.","provider":"go.mondoo.com/cnquery/providers/junos"},"securityRole":{"name":"securityRole","type":"\u0007","is_mandatory":true,"title":"Common Criteria security role","desc":"Administrative role for role separation in Common Criteria / FIPS mode: \"audit-administrator\", \"crypto-administrator\", \"ids-administrator\", or \"security-administrator\". Empty when the class defines no role.","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos login class (permission profile)","desc":"Login class under [system login class] defining the permissions granted to accounts assigned to it, including permission flags, allow/deny command and configuration regexes, idle timeout, and Common Criteria security role. Useful for auditing which classes grant broad access (for example the \"all\" permission bit or a super-user class) and which accounts inherit them.","defaults":"name permissions","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.natRule":{"id":"junos.natRule","name":"junos.natRule","fields":{"matchDestinationAddress":{"name":"matchDestinationAddress","type":"\u0007","is_mandatory":true,"title":"Destination-address match condition (a prefix or address-book name)","provider":"go.mondoo.com/cnquery/providers/junos"},"matchDestinationPort":{"name":"matchDestinationPort","type":"\u0007","is_mandatory":true,"title":"Match destination port","desc":"Destination-port match condition. Empty for source NAT rules, which do not match on destination port.","provider":"go.mondoo.com/cnquery/providers/junos"},"matchSourceAddress":{"name":"matchSourceAddress","type":"\u0007","is_mandatory":true,"title":"Match source address","desc":"Source-address match condition (a prefix or address-book name). Always empty for static NAT rules, whose match keys on the destination.","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name within its rule-set","provider":"go.mondoo.com/cnquery/providers/junos"},"natType":{"name":"natType","type":"\u0007","is_mandatory":true,"title":"Kind of NAT","desc":"One of \"source\" (translate the source of outbound traffic), \"destination\" (redirect inbound traffic), or \"static\" (one-to-one bidirectional mapping).","provider":"go.mondoo.com/cnquery/providers/junos"},"ruleSet":{"name":"ruleSet","type":"\u0007","is_mandatory":true,"title":"Name of the rule-set that contains this rule","provider":"go.mondoo.com/cnquery/providers/junos"},"translationTarget":{"name":"translationTarget","type":"\u0007","is_mandatory":true,"title":"Translation target","desc":"Name of the source or destination NAT pool, or the static-nat-prefix for static rules. Empty for interface-based (\"interface\") or disabled (\"off\") translation.","provider":"go.mondoo.com/cnquery/providers/junos"},"translationType":{"name":"translationType","type":"\u0007","is_mandatory":true,"title":"Translation action","desc":"How matching traffic is translated: \"interface\" (source NAT overloaded onto the egress interface address) or \"pool\" (a named source pool) for source NAT, \"pool\" for destination NAT, \"prefix\" for static NAT, or \"off\" when translation is explicitly disabled for the rule.","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos NAT rule","desc":"Source, destination, or static NAT rule read from the security configuration (security nat), flattened to one row per rule across all rule-sets. The natType field distinguishes the three kinds. Source NAT translates the source address of outbound flows (interface-based PAT or a named source pool); destination NAT redirects inbound flows to an internal host or port via a named pool; static NAT provides a one-to-one bidirectional mapping to a fixed prefix. For static rules matchSourceAddress is always empty and translationTarget holds the static-nat-prefix. Audit for overly broad matches, disabled translation (translationType \"off\"), and unexpected port redirections. For example `junos.natRules.where(natType == \"destination\")` lists all inbound redirections.","defaults":"name ruleSet natType","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.ntpPeer":{"id":"junos.ntpPeer","name":"junos.ntpPeer","fields":{"associationType":{"name":"associationType","type":"\u0007","is_mandatory":true,"title":"NTP association role, such as \"server\" or \"peer\"","provider":"go.mondoo.com/cnquery/providers/junos"},"delay":{"name":"delay","type":"\u0007","is_mandatory":true,"title":"Round-trip delay to the source, in milliseconds","provider":"go.mondoo.com/cnquery/providers/junos"},"jitter":{"name":"jitter","type":"\u0007","is_mandatory":true,"title":"Timing jitter (dispersion) of the source, in milliseconds","provider":"go.mondoo.com/cnquery/providers/junos"},"offset":{"name":"offset","type":"\u0007","is_mandatory":true,"title":"Clock offset of the local clock relative to the source, in milliseconds","provider":"go.mondoo.com/cnquery/providers/junos"},"reach":{"name":"reach","type":"\u0005","is_mandatory":true,"title":"Reachability register","desc":"The 8-bit reachability shift register decoded from octal to decimal: each successful poll shifts in a 1 bit. 255 (octal 377) means all of the last eight polls succeeded; 0 means the source is currently unreachable.","provider":"go.mondoo.com/cnquery/providers/junos"},"refid":{"name":"refid","type":"\u0007","is_mandatory":true,"title":"Reference ID of the upstream source this association is synchronized to (an IP or a clock identifier such as \".GPS.\")","provider":"go.mondoo.com/cnquery/providers/junos"},"remote":{"name":"remote","type":"\u0007","is_mandatory":true,"title":"Remote NTP source address (tally-code prefix removed into status)","provider":"go.mondoo.com/cnquery/providers/junos"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Tally-code selection status","desc":"Single-character NTP tally code indicating the source's role in clock selection: \"*\" (system peer, the selected source), \"+\" (survivor and candidate for combining), \"#\" (selected but not among the top six by distance), \"-\" (discarded as an outlier), \"x\" (falseticker), \".\" (excess, dropped from the candidate list), or empty (rejected: unreachable or otherwise not usable).","provider":"go.mondoo.com/cnquery/providers/junos"},"stratum":{"name":"stratum","type":"\u0005","is_mandatory":true,"title":"Stratum","desc":"Distance in hops from a reference clock: a stratum-1 server is directly attached to a reference clock, and each downstream hop adds one. 16 indicates an unsynchronized source.","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos NTP peer/server association","desc":"NTP association with a configured time source from show ntp associations, reporting its selection status, stratum, reachability, and timing statistics. The status field carries the tally code that indicates whether this source is selected as the system peer. Use to confirm the device is synchronized to a trusted, low-stratum server, for example `junos.ntpPeers.where(status == \"*\")` to find the currently selected source.","defaults":"remote status","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.ospfNeighbor":{"id":"junos.ospfNeighbor","name":"junos.ospfNeighbor","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Neighbor interface IP address","provider":"go.mondoo.com/cnquery/providers/junos"},"area":{"name":"area","type":"\u0007","is_mandatory":true,"title":"OSPF area the adjacency belongs to","provider":"go.mondoo.com/cnquery/providers/junos"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Neighbor router ID","provider":"go.mondoo.com/cnquery/providers/junos"},"iface":{"name":"iface","type":"\u0007","is_mandatory":true,"title":"Local interface over which the adjacency is formed","provider":"go.mondoo.com/cnquery/providers/junos"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Neighbor's OSPF priority used in designated-router (DR/BDR) election","provider":"go.mondoo.com/cnquery/providers/junos"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Adjacency state","desc":"OSPF neighbor state machine value: \"Down\", \"Attempt\", \"Init\", \"2Way\", \"ExStart\", \"Exchange\", \"Loading\", or \"Full\". \"Full\" indicates a completed adjacency with synchronized link-state databases.","provider":"go.mondoo.com/cnquery/providers/junos"},"uptime":{"name":"uptime","type":"\u0007","is_mandatory":true,"title":"Time elapsed since the adjacency reached its current state","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos OSPF neighbor adjacency","desc":"OSPF adjacency with a neighboring router from show ospf neighbor, reporting the neighbor interface address and router ID, adjacency state, forming interface, election priority, area, and uptime. Verify fully established adjacencies with `junos.ospfNeighbors.where(state == \"Full\")`; neighbors stuck below \"Full\" (for example \"ExStart\" or \"2Way\") signal MTU mismatches, authentication failures, or DR/BDR election issues.","defaults":"address state id","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.redundancyGroup":{"id":"junos.redundancyGroup","name":"junos.redundancyGroup","fields":{"failoverCount":{"name":"failoverCount","type":"\u0005","is_mandatory":true,"title":"Number of failovers this group has experienced","desc":"Cumulative count of primary/secondary transitions since the cluster came up. A high or climbing value can indicate link flapping or instability.","provider":"go.mondoo.com/cnquery/providers/junos"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Redundancy group ID","desc":"Numeric identifier of the redundancy group. Group 0 governs Routing Engine mastership; groups 1 and higher govern redundant interface (reth) failover.","provider":"go.mondoo.com/cnquery/providers/junos"},"monitoredObjectCount":{"name":"monitoredObjectCount","type":"\u0005","is_mandatory":true,"title":"Number of monitored objects that influence failover","desc":"Count of monitored interfaces, IP addresses, and upstream objects whose failure debits the group priority and can trigger a failover.","provider":"go.mondoo.com/cnquery/providers/junos"},"node0Priority":{"name":"node0Priority","type":"\u0005","is_mandatory":true,"title":"Priority of node 0","desc":"Configured failover priority for node 0 (0 to 255). The node with the higher priority becomes primary when preempt is enabled.","provider":"go.mondoo.com/cnquery/providers/junos"},"node0Status":{"name":"node0Status","type":"\u0007","is_mandatory":true,"title":"Role of node 0 in this group","desc":"One of \"primary\", \"secondary\", \"secondary-hold\", \"hold\", \"ineligible\", \"disabled\", or \"lost\". \"primary\" is the active node; \"secondary\" is the standby; \"hold\" means the node is not yet ready; \"secondary-hold\" is the post-manual-failover cooldown; \"ineligible\" is the control-link-failure countdown state; \"disabled\" means the node is out of service; \"lost\" means the peer cannot reach this node.","provider":"go.mondoo.com/cnquery/providers/junos"},"node1Priority":{"name":"node1Priority","type":"\u0005","is_mandatory":true,"title":"Priority of node 1","desc":"Configured failover priority for node 1 (0 to 255). The node with the higher priority becomes primary when preempt is enabled.","provider":"go.mondoo.com/cnquery/providers/junos"},"node1Status":{"name":"node1Status","type":"\u0007","is_mandatory":true,"title":"Role of node 1 in this group","desc":"One of \"primary\", \"secondary\", \"secondary-hold\", \"hold\", \"ineligible\", \"disabled\", or \"lost\". See node0Status for the meaning of each value.","provider":"go.mondoo.com/cnquery/providers/junos"},"preempt":{"name":"preempt","type":"\u0004","is_mandatory":true,"title":"Whether preempt is enabled","desc":"True when preempt is configured, so the higher-priority node reclaims the primary role as soon as it becomes available. False (default) leaves the current primary in place until it fails.","provider":"go.mondoo.com/cnquery/providers/junos"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Group status","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos chassis cluster redundancy group","desc":"Chassis-cluster (high-availability) redundancy group from the get-chassis-cluster-information RPC, reporting its status, failover count, per-node priorities and states, monitored-object count, and preempt setting. Redundancy group 0 controls the Routing Engine mastership; groups 1 and above control data-plane interface failover. Empty on standalone (non-clustered) devices. Use it to verify the cluster is healthy and each node holds the expected primary/secondary role, for example `junos.redundancyGroups.where(node0Status != \"primary\" \u0026\u0026 node1Status != \"primary\")`.","defaults":"id status","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.route":{"id":"junos.route","name":"junos.route","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether this is the active route","desc":"True when this next-hop is the active route selected for forwarding (marked with \"*\" in show route output); false for less-preferred or backup entries.","provider":"go.mondoo.com/cnquery/providers/junos"},"destination":{"name":"destination","type":"\u0007","is_mandatory":true,"title":"Destination prefix in CIDR notation","provider":"go.mondoo.com/cnquery/providers/junos"},"metric":{"name":"metric","type":"\u0005","is_mandatory":true,"title":"Route metric used to compare routes within the same protocol","provider":"go.mondoo.com/cnquery/providers/junos"},"nextHop":{"name":"nextHop","type":"\u0007","is_mandatory":true,"title":"Next-hop","desc":"Next-hop gateway address for the route. Empty for directly connected, local, or reject/discard routes that have no resolved gateway.","provider":"go.mondoo.com/cnquery/providers/junos"},"preference":{"name":"preference","type":"\u0005","is_mandatory":true,"title":"Route preference","desc":"Junos route preference (administrative distance) used to choose between protocols offering the same prefix; the lower value wins.","provider":"go.mondoo.com/cnquery/providers/junos"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Source protocol","desc":"Protocol that contributed the route, such as \"Static\", \"Direct\", \"Local\", \"OSPF\", \"OSPF3\", \"BGP\", \"IS-IS\", \"RIP\", \"LDP\", \"RSVP\", \"Access\", or \"Aggregate\".","provider":"go.mondoo.com/cnquery/providers/junos"},"table":{"name":"table","type":"\u0007","is_mandatory":true,"title":"Routing table name, such as \"inet.0\" (IPv4 unicast) or \"inet6.0\" (IPv6 unicast)","provider":"go.mondoo.com/cnquery/providers/junos"},"via":{"name":"via","type":"\u0007","is_mandatory":true,"title":"Outgoing (egress) interface for the next-hop","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos routing table entry","desc":"Route from a device routing table (show route), expanded to one row per next-hop so that multipath (ECMP) routes appear as separate entries. Reports the destination prefix, next-hop, source protocol, preference, metric, outgoing interface, whether it is the active (forwarding-installed) route, and the owning table. Audit for unexpected static routes, default routes, or routes learned from an unintended protocol, for example `junos.routes.where(destination == \"0.0.0.0/0\")`.","defaults":"destination nextHop protocol","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.routingEngine":{"id":"junos.routingEngine","name":"junos.routingEngine","fields":{"cpuSystem":{"name":"cpuSystem","type":"\u0005","is_mandatory":true,"title":"CPU usage percentage spent in system/kernel space (0-100)","provider":"go.mondoo.com/cnquery/providers/junos"},"cpuUser":{"name":"cpuUser","type":"\u0005","is_mandatory":true,"title":"CPU usage percentage spent in user space (0-100)","provider":"go.mondoo.com/cnquery/providers/junos"},"lastRebootReason":{"name":"lastRebootReason","type":"\u0007","is_mandatory":true,"title":"Last reboot reason","provider":"go.mondoo.com/cnquery/providers/junos"},"memoryTotal":{"name":"memoryTotal","type":"\u0005","is_mandatory":true,"title":"Total memory in MB","provider":"go.mondoo.com/cnquery/providers/junos"},"memoryUsed":{"name":"memoryUsed","type":"\u0005","is_mandatory":true,"title":"Memory buffer utilization percentage (0-100)","provider":"go.mondoo.com/cnquery/providers/junos"},"model":{"name":"model","type":"\u0007","is_mandatory":true,"title":"Routing engine model","provider":"go.mondoo.com/cnquery/providers/junos"},"slot":{"name":"slot","type":"\u0005","is_mandatory":true,"title":"Routing engine slot number","desc":"Physical slot of the routing engine. On single-RE platforms that omit the slot element, the position in the list is used as the slot number.","provider":"go.mondoo.com/cnquery/providers/junos"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (e.g., \"OK\")","provider":"go.mondoo.com/cnquery/providers/junos"},"temperature":{"name":"temperature","type":"\u0007","is_mandatory":true,"title":"Current CPU temperature","provider":"go.mondoo.com/cnquery/providers/junos"},"uptime":{"name":"uptime","type":"\u0007","is_mandatory":true,"title":"System uptime","provider":"go.mondoo.com/cnquery/providers/junos"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Junos OS version running on this RE","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos routing engine information","desc":"Routing engine (control-plane processor) with its slot, model, status, temperature, memory and CPU utilization, uptime, last reboot reason, and running Junos version. Dual-RE and chassis-cluster platforms report one entry per engine.","defaults":"slot model status","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.screen":{"id":"junos.screen","name":"junos.screen","fields":{"icmpPingDeath":{"name":"icmpPingDeath","type":"\u0004","is_mandatory":true,"title":"Whether ICMP ping-of-death protection is enabled (drops oversized ICMP packets)","provider":"go.mondoo.com/cnquery/providers/junos"},"ipSourceRoute":{"name":"ipSourceRoute","type":"\u0004","is_mandatory":true,"title":"Whether IP source-route-option protection is enabled (drops packets carrying source-route options)","provider":"go.mondoo.com/cnquery/providers/junos"},"ipTearDrop":{"name":"ipTearDrop","type":"\u0004","is_mandatory":true,"title":"Whether IP tear-drop protection is enabled (blocks overlapping fragment attacks)","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Screen profile (ids-option) name","provider":"go.mondoo.com/cnquery/providers/junos"},"options":{"name":"options","type":"\u0019\u0007","is_mandatory":true,"title":"All configured screen options","desc":"Enabled protections listed by their configuration keyword, including \"icmp-ping-death\", \"ip-source-route-option\", \"ip-tear-drop\", \"tcp-syn-flood\", \"tcp-land\", and \"tcp-winnuke\". Additional protections configured in the profile appear here even when they lack a dedicated boolean field.","provider":"go.mondoo.com/cnquery/providers/junos"},"tcpLand":{"name":"tcpLand","type":"\u0004","is_mandatory":true,"title":"Whether TCP land-attack protection is enabled (blocks spoofed same-source-and-destination SYN packets)","provider":"go.mondoo.com/cnquery/providers/junos"},"tcpSynFlood":{"name":"tcpSynFlood","type":"\u0004","is_mandatory":true,"title":"Whether TCP SYN-flood protection is enabled","provider":"go.mondoo.com/cnquery/providers/junos"},"tcpWinNuke":{"name":"tcpWinNuke","type":"\u0004","is_mandatory":true,"title":"Whether TCP WinNuke protection is enabled (blocks out-of-band data to port 139)","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos IDS screen profile","desc":"Screen (IDS) profile from the security configuration (security screen ids-option) that protects a zone against common network attacks. Each well-known protection is exposed as an individual boolean, and the options field lists every enabled protection by its configuration keyword so that protections beyond the named booleans are still visible. A profile takes effect only when attached to a zone through the zone screen field. Audit internet-facing zones for missing flood and malformed-packet protections, for example `junos.screens.where(!tcpSynFlood)`.","defaults":"name","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.securityPolicy":{"id":"junos.securityPolicy","name":"junos.securityPolicy","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Policy action (\"permit\", \"deny\", or \"reject\")","provider":"go.mondoo.com/cnquery/providers/junos"},"applications":{"name":"applications","type":"\u0019\u0007","is_mandatory":true,"title":"Applications matched by this policy (application names or \"any\")","provider":"go.mondoo.com/cnquery/providers/junos"},"count":{"name":"count","type":"\u0004","is_mandatory":true,"title":"Whether traffic counting is enabled","provider":"go.mondoo.com/cnquery/providers/junos"},"destinationAddresses":{"name":"destinationAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Destination addresses matched by this policy (address-book names or \"any\")","provider":"go.mondoo.com/cnquery/providers/junos"},"fromZone":{"name":"fromZone","type":"\u0007","is_mandatory":true,"title":"Source security zone","provider":"go.mondoo.com/cnquery/providers/junos"},"logClose":{"name":"logClose","type":"\u0004","is_mandatory":true,"title":"Whether session-close logging is enabled","provider":"go.mondoo.com/cnquery/providers/junos"},"logInit":{"name":"logInit","type":"\u0004","is_mandatory":true,"title":"Whether session-init logging is enabled","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/cnquery/providers/junos"},"sourceAddresses":{"name":"sourceAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Source addresses matched by this policy (address-book names or \"any\")","provider":"go.mondoo.com/cnquery/providers/junos"},"toZone":{"name":"toZone","type":"\u0007","is_mandatory":true,"title":"Destination security zone","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos security policy rule","desc":"Zone-pair security policy controlling traffic between a source and destination zone. Combines the match criteria (source and destination addresses, applications) with the action taken (permit, deny, reject) and logging or counting flags. Overly broad permit rules (for example matching the \"any\" address) are a common finding.","defaults":"name fromZone toZone action","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.securityZone":{"id":"junos.securityZone","name":"junos.securityZone","fields":{"hostInboundProtocols":{"name":"hostInboundProtocols","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed host-inbound-traffic protocols (e.g., \"ospf\", \"bgp\")","provider":"go.mondoo.com/cnquery/providers/junos"},"hostInboundServices":{"name":"hostInboundServices","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed host-inbound-traffic system services (e.g., \"ssh\", \"ping\", \"https\")","provider":"go.mondoo.com/cnquery/providers/junos"},"interfaces":{"name":"interfaces","type":"\u0019\u0007","is_mandatory":true,"title":"Interfaces bound to this zone","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Zone name (e.g., \"trust\", \"untrust\")","provider":"go.mondoo.com/cnquery/providers/junos"},"screen":{"name":"screen","type":"\u0007","is_mandatory":true,"title":"Screen profile applied to this zone; empty when none is configured","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos security zone","desc":"Security zone grouping interfaces into a trust boundary. Reports the member interfaces, any applied screen profile, and the host-inbound system services and protocols permitted to reach the device itself through this zone. Host-inbound entries are collected from both the zone-level and per-interface configuration and deduplicated.","defaults":"name","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.service":{"id":"junos.service","name":"junos.service","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service name","desc":"One of the recognized services: \"ssh\", \"netconf\", \"web-management\" (J-Web HTTP/HTTPS), \"ftp\", \"telnet\", \"finger\", \"dhcp\", \"xnm-ssl\" (Junoscript over SSL), or \"rest\" (REST API). \"telnet\", \"ftp\", and \"finger\" transmit in cleartext and should not be enabled.","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos system service","desc":"Management or access service enabled under [system services] in the running configuration. Only services that are configured (and therefore enabled) are returned, so the presence of an entry means the service is on. Detection covers the recognized set ssh, netconf, web-management, ftp, telnet, finger, dhcp, xnm-ssl, and rest. Useful for flagging insecure cleartext services with `junos.services.where(name == \"telnet\" || name == \"ftp\" || name == \"finger\")`.","defaults":"name","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.snmpCommunity":{"id":"junos.snmpCommunity","name":"junos.snmpCommunity","fields":{"authorization":{"name":"authorization","type":"\u0007","is_mandatory":true,"title":"Access level granted to the community","desc":"Either \"read-only\" (SNMP GET) or \"read-write\" (SNMP GET plus SET, able to modify device configuration). \"read-write\" is high-risk over SNMPv1/v2c because the community travels in cleartext.","provider":"go.mondoo.com/cnquery/providers/junos"},"clients":{"name":"clients","type":"\u0019\u0007","is_mandatory":true,"title":"Client source addresses or prefixes allowed to use this community (an","desc":"SNMP client access list). Empty means any source address may poll with the community, a broader exposure.","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Community string clients present to authenticate SNMP requests. This is","desc":"the shared secret itself, so a guessable value is exploitable.","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos SNMP community configuration","desc":"SNMPv1/v2c community from [edit snmp community], with its authorization level and the client addresses permitted to poll with it. Read-write communities, communities open to any client, and weak or default community strings (for example \"public\" or \"private\") are common findings. Flag unrestricted or writable access with `junos.snmpCommunities.where(authorization == \"read-write\" || clients == empty)`.","defaults":"name authorization","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.sshConfig":{"id":"junos.sshConfig","name":"junos.sshConfig","fields":{"ciphers":{"name":"ciphers","type":"\u0019\u0007","is_mandatory":true,"title":"Configured ciphers","desc":"Encryption algorithms the SSH server will negotiate, in configured order. Empty means the platform default set is used. Presence of legacy algorithms (for example any 3des or arcfour entry) indicates a weak configuration.","provider":"go.mondoo.com/cnquery/providers/junos"},"connectionLimit":{"name":"connectionLimit","type":"\u0005","is_mandatory":true,"title":"Maximum concurrent unauthenticated connections","desc":"Maximum number of concurrent connections in the pre-authentication state. 0 when not set (no configured limit).","provider":"go.mondoo.com/cnquery/providers/junos"},"fingerprintHash":{"name":"fingerprintHash","type":"\u0007","is_mandatory":true,"title":"Configured fingerprint hash algorithm","desc":"Hash the SSH server uses when displaying key fingerprints, either \"md5\" or \"sha2-256\". Empty when not set (Junos defaults to sha2-256).","provider":"go.mondoo.com/cnquery/providers/junos"},"hostKeyAlgorithms":{"name":"hostKeyAlgorithms","type":"\u0019\u0007","is_mandatory":true,"title":"Configured host key algorithms","desc":"Host-key algorithms the SSH server offers to clients. Empty means the platform default set is used.","provider":"go.mondoo.com/cnquery/providers/junos"},"keyExchanges":{"name":"keyExchanges","type":"\u0019\u0007","is_mandatory":true,"title":"Configured key exchange algorithms","desc":"Key-exchange methods the SSH server will negotiate. Empty means the platform default set is used.","provider":"go.mondoo.com/cnquery/providers/junos"},"macs":{"name":"macs","type":"\u0019\u0007","is_mandatory":true,"title":"Configured MACs (message authentication codes)","desc":"Integrity algorithms the SSH server will negotiate. Empty means the platform default set is used. Look for weak entries such as hmac-md5 or hmac-sha1.","provider":"go.mondoo.com/cnquery/providers/junos"},"maxSessionsPerConnection":{"name":"maxSessionsPerConnection","type":"\u0005","is_mandatory":true,"title":"Maximum number of sessions per connection","desc":"Cap on multiplexed sessions within a single SSH connection. 0 when not explicitly set (platform default applies).","provider":"go.mondoo.com/cnquery/providers/junos"},"protocolVersion":{"name":"protocolVersion","type":"\u0007","is_mandatory":true,"title":"SSH protocol version","desc":"Explicitly configured protocol version, typically \"v2\". Empty when not set, in which case the platform default applies (modern Junos supports only SSHv2; v1 is deprecated).","provider":"go.mondoo.com/cnquery/providers/junos"},"rateLimit":{"name":"rateLimit","type":"\u0005","is_mandatory":true,"title":"Rate limit for new connection attempts","desc":"Maximum number of new (unauthenticated) SSH connection attempts allowed per minute. 0 when not set (no configured limit).","provider":"go.mondoo.com/cnquery/providers/junos"},"rootLogin":{"name":"rootLogin","type":"\u0007","is_mandatory":true,"title":"Root login policy","desc":"One of \"allow\", \"deny\", or \"deny-password\". \"allow\" (the Junos default when unset) permits root SSH login; \"deny\" blocks it entirely; \"deny-password\" permits root login only with key-based (non-password) authentication. Empty when not explicitly configured (defaults to allow).","provider":"go.mondoo.com/cnquery/providers/junos"},"tcpForwarding":{"name":"tcpForwarding","type":"\u0004","is_mandatory":true,"title":"Whether TCP forwarding is allowed","desc":"True when TCP forwarding is permitted. False when \"no-tcp-forwarding\" is configured, which blocks SSH port-forwarding tunnels.","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos SSH server configuration","desc":"SSH server settings under [system services ssh] in the running configuration: root-login policy, protocol version, session and connection limits, and the configured ciphers, MACs, key-exchange and host-key algorithms. Useful for enforcing hardened SSH, for example require `junos.sshConfig.rootLogin == \"deny\"` and check that no weak ciphers appear in the ciphers list.","defaults":"rootLogin","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.syslogHost":{"id":"junos.syslogHost","name":"junos.syslogHost","fields":{"facility":{"name":"facility","type":"\u0007","is_mandatory":true,"title":"Message facility this entry selects","desc":"Junos logging facility whose messages are forwarded to the host. One of \"any\" (all facilities), \"authorization\", \"change-log\", \"conflict-log\", \"daemon\", \"dfc\", \"external\", \"firewall\", \"ftp\", \"interactive-commands\", \"kernel\", \"ntp\", \"pfe\" (Packet Forwarding Engine), \"security\", or \"user\". Empty when the host is configured with no explicit facility/severity entry.","provider":"go.mondoo.com/cnquery/providers/junos"},"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Syslog host address or hostname the messages are sent to","provider":"go.mondoo.com/cnquery/providers/junos"},"logPrefix":{"name":"logPrefix","type":"\u0007","is_mandatory":true,"title":"Text string prepended to every message sent to this host, used to","desc":"identify the originating device or grouping in the collector","provider":"go.mondoo.com/cnquery/providers/junos"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Destination port","desc":"TCP/UDP port the collector listens on. 0 when not explicitly configured, in which case Junos uses the transport default (514 for udp and tcp, 6514 for tls).","provider":"go.mondoo.com/cnquery/providers/junos"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Minimum severity level forwarded","desc":"Lowest severity that is forwarded for this facility. Junos logs messages at the configured level and every more-severe level above it. From most to least severe: \"emergency\", \"alert\", \"critical\", \"error\", \"warning\", \"notice\", \"info\". \"any\" forwards all severities. Empty when the host has no explicit facility/severity entry. (Junos also supports \"none\" to disable a facility; that case is reported as \"any\" here.)","provider":"go.mondoo.com/cnquery/providers/junos"},"sourceAddress":{"name":"sourceAddress","type":"\u0007","is_mandatory":true,"title":"Source address stamped on outgoing syslog packets, overriding the","desc":"egress interface address; empty when not configured","provider":"go.mondoo.com/cnquery/providers/junos"},"transport":{"name":"transport","type":"\u0007","is_mandatory":true,"title":"Transport protocol for delivery","desc":"One of \"udp\", \"tcp\", or \"tls\" (mutual-TLS encrypted transport). Empty when no transport is explicitly configured, in which case Junos defaults to udp. Only \"tls\" protects log confidentiality and integrity in transit.","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos syslog host configuration","desc":"Remote syslog destination from the running configuration ([edit system syslog host]), expanded to one entry per facility/severity combination configured for the host. Reports the destination address, the transport protocol and port, the source address, and any log prefix. Having no syslogHost at all, or forwarding only over plaintext udp, is a common logging-coverage and log-integrity finding: audit with `junos.syslogHosts.where(transport != \"tls\")` or by asserting at least one host exists.","defaults":"host facility severity","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.system":{"id":"junos.system","name":"junos.system","fields":{"hostname":{"name":"hostname","type":"\u0007","is_mandatory":true,"title":"Device hostname","provider":"go.mondoo.com/cnquery/providers/junos"},"model":{"name":"model","type":"\u0007","is_mandatory":true,"title":"Hardware model (e.g., \"SRX340\", \"MX240\", \"EX4300\")","provider":"go.mondoo.com/cnquery/providers/junos"},"osName":{"name":"osName","type":"\u0007","is_mandatory":true,"title":"Operating system name","provider":"go.mondoo.com/cnquery/providers/junos"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Device serial number","provider":"go.mondoo.com/cnquery/providers/junos"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Junos OS software version","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos system information","desc":"Hostname, hardware model, serial number, and software version of the connected device. Use to record which platform and Junos release an audit evaluated.","defaults":"hostname model version","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.user":{"id":"junos.user","name":"junos.user","fields":{"class":{"name":"class","type":"\u0007","is_mandatory":true,"title":"Login class assigned to the user","desc":"The login class controls the account's permissions. Built-in classes include \"super-user\", \"operator\", \"read-only\", and \"unauthorized\"; custom classes may also be defined.","provider":"go.mondoo.com/cnquery/providers/junos"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Full name (description) configured for the account","provider":"go.mondoo.com/cnquery/providers/junos"},"hasPassword":{"name":"hasPassword","type":"\u0004","is_mandatory":true,"title":"Whether an encrypted password is configured for the account","desc":"True when an encrypted-password hash is set for local password authentication. False accounts rely on SSH keys or remote (RADIUS/TACACS+) authentication.","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Username","provider":"go.mondoo.com/cnquery/providers/junos"},"sshKeys":{"name":"sshKeys","type":"\u0019\u0007","is_mandatory":true,"title":"SSH public keys configured for this user","desc":"All authorized SSH public keys for the account, combining the ssh-rsa, ssh-dsa, ssh-ecdsa, and ssh-ed25519 entries under the account's authentication stanza.","provider":"go.mondoo.com/cnquery/providers/junos"},"uid":{"name":"uid","type":"\u0005","is_mandatory":true,"title":"Numeric user ID (UID) assigned to the account","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos local user account","desc":"Local login account from the running configuration (system login user) with its login class, UID, full name, whether an encrypted password is set, and any configured SSH public keys. The login class determines the account's permissions and authorization. Audit privileged accounts, accounts without a password, and their key-based authentication, for example `junos.users.where(class == \"super-user\")`.","defaults":"name class","provider":"go.mondoo.com/cnquery/providers/junos"},"junos.vlan":{"id":"junos.vlan","name":"junos.vlan","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-text VLAN description; empty when not configured","provider":"go.mondoo.com/cnquery/providers/junos"},"interfaces":{"name":"interfaces","type":"\u0019\u0007","is_mandatory":true,"title":"Interfaces assigned as members of this VLAN","provider":"go.mondoo.com/cnquery/providers/junos"},"l3Interface":{"name":"l3Interface","type":"\u0007","is_mandatory":true,"title":"Integrated routing and bridging (IRB) interface that provides the","desc":"Layer 3 gateway for this VLAN (for example \"irb.100\"); empty when the VLAN has no routed interface","provider":"go.mondoo.com/cnquery/providers/junos"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Configured VLAN name","provider":"go.mondoo.com/cnquery/providers/junos"},"vlanId":{"name":"vlanId","type":"\u0005","is_mandatory":true,"title":"802.1Q VLAN identifier, 1 through 4094","provider":"go.mondoo.com/cnquery/providers/junos"}},"title":"Junos VLAN configuration","desc":"VLAN definition from [edit vlans], with its 802.1Q tag, member interfaces, and any associated Layer 3 (routed) interface. Selected by its configured name. Useful for auditing VLAN-to-interface assignments and confirming which VLANs are routed. For example `junos.vlans.where(l3Interface != \"\")` lists VLANs with a routed gateway.","defaults":"name vlanId","provider":"go.mondoo.com/cnquery/providers/junos"}}}