{"resources":{"certificate":{"id":"certificate","name":"certificate","fields":{"authorityKeyID":{"name":"authorityKeyID","type":"\u0007","title":"Authority key identifier","provider":"go.mondoo.com/mql/providers/network"},"crlDistributionPoints":{"name":"crlDistributionPoints","type":"\u0019\u0007","title":"CRL distribution points","provider":"go.mondoo.com/mql/providers/network"},"expiresIn":{"name":"expiresIn","type":"\t","title":"Expiration duration","provider":"go.mondoo.com/mql/providers/network"},"extendedKeyUsage":{"name":"extendedKeyUsage","type":"\u0019\u0007","title":"Extended key usage","provider":"go.mondoo.com/mql/providers/network"},"extensions":{"name":"extensions","type":"\u0019\u001bpkix.extension","title":"Extensions","provider":"go.mondoo.com/mql/providers/network"},"fingerprints":{"name":"fingerprints","type":"\u001a\u0007\u0007","title":"Certificate fingerprints","desc":"Keyed by hash algorithm: `sha1`, `sha256`, and `md5`, each mapping to the hex-encoded digest of the certificate's DER encoding.","provider":"go.mondoo.com/mql/providers/network"},"hasSCTs":{"name":"hasSCTs","type":"\u0004","title":"Whether Signed Certificate Timestamps (SCTs) are present (Certificate Transparency)","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/network"},"isCA":{"name":"isCA","type":"\u0004","title":"Whether the certificate is a certificate authority (CA) certificate","provider":"go.mondoo.com/mql/providers/network"},"isExpired":{"name":"isExpired","type":"\u0004","title":"Whether the certificate has expired","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/network"},"isRevoked":{"name":"isRevoked","type":"\u0004","title":"Whether this certificate has been revoked","desc":"Determined from OCSP, or from the certificate's CRL when it names no OCSP responder or the responder cannot be reached. Null when neither could answer, so an unchecked certificate never reports itself as good. Read `revocationChecked` first, or assert on it alongside this, because a null does not fail a check written as `isRevoked == false`.","provider":"go.mondoo.com/mql/providers/network"},"isVerified":{"name":"isVerified","type":"\u0004","title":"Whether the certificate is valid (based on its chain)","provider":"go.mondoo.com/mql/providers/network"},"issuer":{"name":"issuer","type":"\u001bpkix.name","title":"Distinguished name of the certificate issuer","provider":"go.mondoo.com/mql/providers/network"},"issuingCertificateUrl":{"name":"issuingCertificateUrl","type":"\u0019\u0007","title":"Issuing certificate URL","provider":"go.mondoo.com/mql/providers/network"},"keyUsage":{"name":"keyUsage","type":"\u0019\u0007","title":"Key usage","provider":"go.mondoo.com/mql/providers/network"},"maxPathLen":{"name":"maxPathLen","type":"\u0005","title":"Maximum CA chain depth (null if unconstrained, 0 = no intermediates allowed)","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/network"},"notAfter":{"name":"notAfter","type":"\t","title":"End of the validity period, after which the certificate has expired","provider":"go.mondoo.com/mql/providers/network"},"notBefore":{"name":"notBefore","type":"\t","title":"Start of the validity period, before which the certificate is not valid","provider":"go.mondoo.com/mql/providers/network"},"ocspServer":{"name":"ocspServer","type":"\u0019\u0007","title":"OCSP responder URLs for revocation checking","provider":"go.mondoo.com/mql/providers/network"},"pem":{"name":"pem","type":"\u0007","is_mandatory":true,"title":"PEM content","provider":"go.mondoo.com/mql/providers/network"},"policyIdentifier":{"name":"policyIdentifier","type":"\u0019\u0007","title":"Policy identifier","provider":"go.mondoo.com/mql/providers/network"},"publicKeyAlgorithm":{"name":"publicKeyAlgorithm","type":"\u0007","title":"Public key algorithm (e.g., RSA, ECDSA, Ed25519)","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/network"},"publicKeyBits":{"name":"publicKeyBits","type":"\u0005","title":"Public key size in bits (e.g., 2048, 256, 384)","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/network"},"revocationChecked":{"name":"revocationChecked","type":"\u0004","title":"Whether the certificate's revocation status could be determined","desc":"False when the certificate names no OCSP responder and no CRL, and when every responder and distribution point it does name could not be reached or returned something unusable. `isRevoked` is null in that case rather than false, so a policy that must not pass on an unchecked certificate should require this.  Certificates that are the last in a served chain are not checked: there is no issuer below them to check against, and a trust anchor's revocation is not a question its own chain can answer.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"revokedAt":{"name":"revokedAt","type":"\t","title":"The time at which this certificate was revoked","desc":"Null when the certificate is not revoked, and null when revocation could not be determined.","provider":"go.mondoo.com/mql/providers/network"},"sanExtension":{"name":"sanExtension","type":"\u001bpkix.sanExtension","title":"SAN extension value params","min_provider_version":"9.1.2","provider":"go.mondoo.com/mql/providers/network"},"serial":{"name":"serial","type":"\u0007","title":"Serial number","provider":"go.mondoo.com/mql/providers/network"},"signature":{"name":"signature","type":"\u0007","title":"Signature","provider":"go.mondoo.com/mql/providers/network"},"signingAlgorithm":{"name":"signingAlgorithm","type":"\u0007","title":"Signature algorithm ID","provider":"go.mondoo.com/mql/providers/network"},"subject":{"name":"subject","type":"\u001bpkix.name","title":"Distinguished name of the certificate subject","provider":"go.mondoo.com/mql/providers/network"},"subjectKeyID":{"name":"subjectKeyID","type":"\u0007","title":"Subject key identifier","provider":"go.mondoo.com/mql/providers/network"},"version":{"name":"version","type":"\u0005","title":"Version number","provider":"go.mondoo.com/mql/providers/network"}},"title":"X.509 certificate","desc":"Single X.509 certificate parsed from its PEM encoding, exposing the identity and trust properties auditors care about: the subject and issuer distinguished names, the validity window (notBefore, notAfter, and the expiresIn countdown), the public-key algorithm and bit length, the isCA and key-usage constraints, and the revocation, verification, and expiration status. Useful for flagging weak keys, expired or soon-to-expire leaf certificates, and untrusted or revoked chains.","min_provider_version":"9.0.0","defaults":"serial subject.commonName subject.dn","provider":"go.mondoo.com/mql/providers/network","global":true},"certificates":{"id":"certificates","name":"certificates","fields":{"list":{"name":"list","type":"\u0019\u001bcertificate","provider":"go.mondoo.com/mql/providers/network"},"pem":{"name":"pem","type":"\u0007","is_mandatory":true,"title":"PEM content","provider":"go.mondoo.com/mql/providers/network"},"unparseable":{"name":"unparseable","type":"\u0005","title":"Number of certificate blocks in pem that could not be parsed","desc":"Counts the blocks skipped while decoding pem, for example a certificate carrying a negative serial number, which older trust stores still ship. Any value above zero means the list is an incomplete view of pem, so assert on it before treating the list as the full contents of the bundle.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"}},"list_type":"\u001bcertificate","title":"X.509 certificate bundle","desc":"Certificates parsed from PEM content, typically a full chain of a leaf, its intermediates, and a root. The list supports per-certificate checks across the chain (validity window, key usage, signing algorithm, revocation, and expiration), and the raw `pem` field returns the original source. Blocks that cannot be decoded are left out of the list and counted in unparseable, so a bundle holding one malformed certificate still yields the rest.","min_provider_version":"9.0.0","provider":"go.mondoo.com/mql/providers/network","global":true},"dns":{"id":"dns","name":"dns","fields":{"authoritativeParams":{"name":"authoritativeParams","type":"\n","refs":["\"fqdn\""],"title":"DNS query results from the zone's authoritative nameservers","desc":"Same shape as `params`, resolved against the nameservers authoritative for the zone rather than through a caching resolver. The records match; the TTLs are the values configured in the zone.","min_provider_version":"13.2.9","provider":"go.mondoo.com/mql/providers/network"},"authoritativeRecords":{"name":"authoritativeRecords","type":"\u0019\u001bdns.record","refs":["\"authoritativeParams\""],"title":"Successful DNS records as published in the zone","desc":"Same records as `records`, carrying the TTL configured in the zone rather than the time remaining on a resolver's cached copy. Use this whenever a TTL is being asserted on: a caching resolver counts its cached TTL down toward zero, so a record configured at 300 answers 300, then 208, then 144 as the entry ages, and a threshold check on that flaps depending on when the scan ran.  Unlike `records`, this does not follow CNAMEs, because the zone's own nameservers answer only for what the zone contains. A name published as a CNAME therefore appears here as a CNAME and not as the address it eventually resolves to: `records` for a CNAME'd name returns A and CNAME, while this returns CNAME alone. Filtering to `type == \"A\"` on such a name yields an empty list, so guard against that rather than letting an `all()` pass vacuously.","min_provider_version":"13.2.9","provider":"go.mondoo.com/mql/providers/network"},"dkim":{"name":"dkim","type":"\u0019\u001bdns.dkimRecord","refs":["\"params\""],"title":"DKIM TXT records","provider":"go.mondoo.com/mql/providers/network"},"dkimRecord":{"name":"dkimRecord","type":"\u001bdns.dkimRecord","title":"DKIM public-key DNS record (RFC 6376)","desc":"Parsed DKIM TXT record: the raw DNS text, the selector domain, the version, the acceptable hash algorithms, the key type, the base64-encoded public-key data, the service-type restrictions, the DKIM flags, free-form notes, and a `valid()` predicate that validates the record and its public key.","provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"dmarc":{"name":"dmarc","type":"\u001bdns.dmarcRecord","title":"Parsed DMARC record published at the domain's _dmarc subdomain","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/network"},"dmarcRecord":{"name":"dmarcRecord","type":"\u001bdns.dmarcRecord","title":"DMARC policy record (RFC 7489)","desc":"Parsed DMARC record from a domain's `_dmarc` TXT record: the policy applied to failing mail, the subdomain policy, the aggregate and forensic report destinations, the percentage of mail the policy covers, and the SPF/DKIM identifier alignment modes. Reachable as `dns(fqdn: \"example.com\").dmarc`, which resolves the `_dmarc` subdomain itself.","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"dnssec":{"name":"dnssec","type":"\u001bdns.dnssecConfig","refs":["\"params\""],"title":"DNSSEC signing state for the domain","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/network"},"dnssecConfig":{"name":"dnssecConfig","type":"\u001bdns.dnssecConfig","title":"DNSSEC configuration for a domain","desc":"How a domain's zone is signed: whether it publishes DNSKEY records, the parsed signing keys and their algorithms and lengths, the delegation the parent zone publishes, and the way the zone proves a name does not exist. This is the zone's configuration, which is stable between re-signings. What a resolution of the domain actually returned is a separate question, answered by `dnssecValidation` on the parent dns resource. `enabled` reflects published DNSKEY records and does not, on its own, mean the chain of trust resolves.","provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"dnssecKey":{"name":"dnssecKey","type":"\u001bdns.dnssecKey","title":"DNSKEY record (RFC 4034)","desc":"Single published DNSSEC key: its flags, protocol, algorithm number and length, and the base64-encoded public key. `keySigningKey` is true for a key-signing key, the one whose Secure Entry Point bit is set, as opposed to a zone-signing key. The flags are read bit by bit rather than compared against 256 and 257, so a revoked key-signing key (flags 385) is still reported as one.  The key tag and the signature bytes are deliberately not exposed. They change every time the zone is re-signed, so a check built on either reports a different answer on a schedule the operator did not choose. Algorithm, key length and the flag bits survive re-signing and are what an audit should assert on.","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"dnssecValidation":{"name":"dnssecValidation","type":"\u001bdns.dnssecValidationResult","refs":["\"fqdn\""],"title":"Outcome of a DNSSEC-validating resolution of the domain","desc":"What a validating query actually got back, as opposed to what the zone publishes. Issues an EDNS0 query with the DNSSEC OK bit set, reports whether the resolver returned the Authenticated Data flag, whether the answer carried RRSIG records, whether those signatures verify against the zone's published keys, and whether the chain of trust links to the root. Use `dnssec` to audit how a zone is signed; use this to audit whether resolving it validates.  Depends on fqdn rather than params, so it issues its own targeted queries instead of a full record-type sweep, which keeps it affordable to instantiate per element of a list.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"dnssecValidationResult":{"name":"dnssecValidationResult","type":"\u001bdns.dnssecValidationResult","title":"DNSSEC validation result for a domain","desc":"What a DNSSEC-validating resolution of a domain actually returned, as distinct from what the zone publishes. Reports whether the resolver honored the DNSSEC OK bit, whether it set the Authenticated Data flag, whether the answer carried signatures, whether those signatures verify against the zone's published keys, and whether the chain of trust links all the way to the root trust anchor. Reachable as `dns(fqdn: \"example.com\").dnssecValidation`.  Nothing here raises an error when validation does not succeed. An unsigned zone, an unreachable resolver, a resolver that does not return DNSSEC records, and a genuinely broken chain of trust all report their state in these fields with `error` explaining which one happened, so a scan of a fleet that includes unsigned domains still completes.  The last of those is not a statement about the zone: when `dnssecOk` is false the resolver answered without signatures whatever the zone publishes, so the verdict fields are null rather than false.","provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"dsRecord":{"name":"dsRecord","type":"\u001bdns.dsRecord","title":"DS record (RFC 4034)","desc":"One delegation signer record published by the parent zone, which is what ties a child zone's key into the chain of trust. Carries the algorithm and digest type, the digest itself, and whether that digest matches a key the child zone currently publishes.  The key tag is deliberately not exposed: it changes on every key rollover. Assert on `matchesPublishedKey`, the algorithm, and the digest type, which do not.","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"fqdn":{"name":"fqdn","type":"\u0007","is_mandatory":true,"title":"Fully qualified domain name (FQDN)","provider":"go.mondoo.com/mql/providers/network"},"mx":{"name":"mx","type":"\u0019\u001bdns.mxRecord","refs":["\"params\""],"title":"Successful DNS MX records","provider":"go.mondoo.com/mql/providers/network"},"mxRecord":{"name":"mxRecord","type":"\u001bdns.mxRecord","title":"DNS MX record","desc":"Mail-exchange (MX) record for the domain: the record name, the resolved target `domainName`, and the `preference` value used to choose between multiple MX records.","provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"params":{"name":"params","type":"\n","refs":["\"fqdn\""],"title":"DNS query results keyed by record type","desc":"Map keyed by DNS record type (such as `A`, `AAAA`, `MX`, or `TXT`), where each value carries that query's `name`, `ttl`, `class`, `type`, `rData` payload, and `rCode` response status. The `records`, `mx`, `dkim`, `spf`, `dmarc`, and `dnssec` fields parse this into records.","provider":"go.mondoo.com/mql/providers/network"},"record":{"name":"record","type":"\u001bdns.record","title":"DNS record","desc":"Single resolved DNS record: name, type, class, TTL, and the rdata payload (IP addresses, hostnames, or other values depending on the record type).","provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"records":{"name":"records","type":"\u0019\u001bdns.record","refs":["\"params\""],"title":"Successful DNS records","provider":"go.mondoo.com/mql/providers/network"},"reverse":{"name":"reverse","type":"\u0019\u001bdns.record","refs":["\"params\""],"title":"Reverse DNS (PTR) records for the domain's resolved addresses","desc":"Deprecated in favor of `reverseRecords`.  Returns the same records as reverseRecords, but derives the addresses from params, which queries every DNS record type. That is affordable once for the scanned asset, where the other fields reuse the same result, but it makes this field too expensive to instantiate per element of a list — resolvers rate-limit at that volume and PTR lookups then come back empty, which is indistinguishable from a missing PTR record.","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/network","maturity":"deprecated"},"reverseRecords":{"name":"reverseRecords","type":"\u0019\u001bdns.record","refs":["\"fqdn\""],"title":"Reverse DNS (PTR) records for the domain's resolved addresses","desc":"Resolves the domain's A and AAAA addresses, then looks up the PTR record for each — the forward-confirmed reverse DNS round trip. Use it to confirm an address resolves back to the expected hostname without hand-building `in-addr.arpa` names.  Depends on fqdn rather than params, so it issues two address queries instead of a full record-type sweep. That keeps it affordable to instantiate per element of a list, such as checking the reverse DNS of every mail exchanger.","min_provider_version":"13.2.9","provider":"go.mondoo.com/mql/providers/network"},"rrsigRecord":{"name":"rrsigRecord","type":"\u001bdns.rrsigRecord","title":"RRSIG record (RFC 4034)","desc":"One signature covering a resolved record set: the record type it covers, the algorithm that produced it, the zone that signed it, and the validity window it is usable in. Reachable through `dnssecValidation` on a dns resource, which collects the signatures a validating query returned.  The key tag and the signature bytes are deliberately not exposed, because both change every time the zone is re-signed. The validity window does not change in the same way: a zone re-signed weekly with a fourteen day window reports roughly the same remaining validity whenever it is looked at, which is what makes `expiresIn` something an audit can assert on.","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"spf":{"name":"spf","type":"\u0019\u001bdns.spfRecord","refs":["\"params\""],"title":"Parsed SPF (Sender Policy Framework) records","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/network"},"spfRecord":{"name":"spfRecord","type":"\u001bdns.spfRecord","title":"SPF policy record (RFC 7208)","desc":"Parsed Sender Policy Framework record from a domain's TXT records: the version, the ordered list of mechanisms, and the qualifier on the terminating `all` mechanism that decides how unauthorized senders are handled. Select a domain's records with `dns(fqdn: \"example.com\").spf`.","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"zone":{"name":"zone","type":"\u001bdns","refs":["\"fqdn\""],"title":"Apex of the zone that contains this name","desc":"The closest enclosing name that is served as a zone of its own, which is where a zone-wide question has an answer. DNSKEY, NS and SOA records exist at a zone apex and nowhere else inside the zone, so `zone.dnssec` and `zone.records` report how the containing zone is signed and served even when the name itself publishes neither. Comparing `fqdn` against `zone.fqdn` tells an apex from a name that merely sits inside a zone, which is what scopes a zone-wide audit to the one name it can hold for.  The zone is established by delegation rather than by the public suffix list, so it is the zone the name belongs to and not the registrable domain. The two agree for `www.example.com`, whose zone is `example.com`. They differ for a delegated subdomain such as `corp.example.com`, which is a zone of its own, signed with its own keys and served by its own nameservers. Null when nothing answers as a zone, such as for a name that does not resolve or a scan target given as an IP address.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"}},"init":{"args":[{"name":"fqdn","type":"\u0007"}]},"title":"DNS resource","desc":"DNS records published for a fully-qualified domain name. Select a domain with `dns(fqdn: \"example.com\")`. Surfaces every resolved record, the MX record list, DNSSEC signing state, and parsed SPF, DMARC, and DKIM policy records, so mail-authentication and zone-signing audits run without hand-building DNS lookups.","min_provider_version":"9.0.1","defaults":"fqdn","provider":"go.mondoo.com/mql/providers/network","global":true},"dns.dkimRecord":{"id":"dns.dkimRecord","name":"dns.dkimRecord","fields":{"dnsTxt":{"name":"dnsTxt","type":"\u0007","is_mandatory":true,"title":"DNS text representation","provider":"go.mondoo.com/mql/providers/network"},"domain":{"name":"domain","type":"\u0007","is_mandatory":true,"title":"DKIM selector domain","provider":"go.mondoo.com/mql/providers/network"},"flags":{"name":"flags","type":"\u0019\u0007","is_mandatory":true,"title":"DKIM flags (e.g., y for testing, s to require exact selector match)","provider":"go.mondoo.com/mql/providers/network"},"hashAlgorithms":{"name":"hashAlgorithms","type":"\u0019\u0007","is_mandatory":true,"title":"Acceptable hash algorithms","provider":"go.mondoo.com/mql/providers/network"},"keyType":{"name":"keyType","type":"\u0007","is_mandatory":true,"title":"Key type","provider":"go.mondoo.com/mql/providers/network"},"notes":{"name":"notes","type":"\u0007","is_mandatory":true,"title":"Free-form notes about the DKIM record","provider":"go.mondoo.com/mql/providers/network"},"publicKeyData":{"name":"publicKeyData","type":"\u0007","is_mandatory":true,"title":"Public key data base64-encoded","provider":"go.mondoo.com/mql/providers/network"},"serviceTypes":{"name":"serviceTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Service types this DKIM key is restricted to (e.g., email, *)","provider":"go.mondoo.com/mql/providers/network"},"valid":{"name":"valid","type":"\u0004","title":"Whether the DKIM entry and public key is valid","provider":"go.mondoo.com/mql/providers/network"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Version","provider":"go.mondoo.com/mql/providers/network"}},"title":"DKIM public-key DNS record (RFC 6376)","desc":"Parsed DKIM TXT record: the raw DNS text, the selector domain, the version, the acceptable hash algorithms, the key type, the base64-encoded public-key data, the service-type restrictions, the DKIM flags, free-form notes, and a `valid()` predicate that validates the record and its public key.","min_provider_version":"9.0.1","defaults":"dnsTxt","provider":"go.mondoo.com/mql/providers/network"},"dns.dmarcRecord":{"id":"dns.dmarcRecord","name":"dns.dmarcRecord","fields":{"aggregateReportUris":{"name":"aggregateReportUris","type":"\u0019\u0007","is_mandatory":true,"title":"Aggregate report destination URIs (the `rua=` tag)","provider":"go.mondoo.com/mql/providers/network"},"dkimAlignment":{"name":"dkimAlignment","type":"\u0007","is_mandatory":true,"title":"DKIM identifier alignment mode (the `adkim=` tag): `r` relaxed or `s` strict","provider":"go.mondoo.com/mql/providers/network"},"dnsTxt":{"name":"dnsTxt","type":"\u0007","is_mandatory":true,"title":"Raw TXT record","provider":"go.mondoo.com/mql/providers/network"},"forensicReportUris":{"name":"forensicReportUris","type":"\u0019\u0007","is_mandatory":true,"title":"Forensic report destination URIs (the `ruf=` tag)","provider":"go.mondoo.com/mql/providers/network"},"percentage":{"name":"percentage","type":"\u0005","is_mandatory":true,"title":"Percentage of failing mail the policy is applied to (the `pct=` tag)","desc":"Defaults to 100 when the tag is absent.","provider":"go.mondoo.com/mql/providers/network"},"policy":{"name":"policy","type":"\u0007","is_mandatory":true,"title":"Policy applied to mail that fails DMARC","desc":"One of `none`, `quarantine`, or `reject` (the `p=` tag).","provider":"go.mondoo.com/mql/providers/network"},"spfAlignment":{"name":"spfAlignment","type":"\u0007","is_mandatory":true,"title":"SPF identifier alignment mode (the `aspf=` tag): `r` relaxed or `s` strict","provider":"go.mondoo.com/mql/providers/network"},"subdomainPolicy":{"name":"subdomainPolicy","type":"\u0007","is_mandatory":true,"title":"Policy applied to subdomains (the `sp=` tag); empty when not set","provider":"go.mondoo.com/mql/providers/network"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Version tag, e.g. \"DMARC1\"","provider":"go.mondoo.com/mql/providers/network"}},"title":"DMARC policy record (RFC 7489)","desc":"Parsed DMARC record from a domain's `_dmarc` TXT record: the policy applied to failing mail, the subdomain policy, the aggregate and forensic report destinations, the percentage of mail the policy covers, and the SPF/DKIM identifier alignment modes. Reachable as `dns(fqdn: \"example.com\").dmarc`, which resolves the `_dmarc` subdomain itself.","private":true,"min_provider_version":"13.1.1","defaults":"policy","provider":"go.mondoo.com/mql/providers/network"},"dns.dnssecConfig":{"id":"dns.dnssecConfig","name":"dns.dnssecConfig","fields":{"algorithms":{"name":"algorithms","type":"\u0019\u0005","is_mandatory":true,"title":"Distinct DNSSEC algorithm numbers across all published keys","desc":"Algorithm numbers as defined in RFC 8624, e.g. 8 (RSASHA256) or 13 (ECDSAP256SHA256). Use it to flag deprecated algorithms such as 5/7 (RSASHA1) or 3 (DSA).","provider":"go.mondoo.com/mql/providers/network"},"delegationSigned":{"name":"delegationSigned","type":"\u0004","is_mandatory":true,"title":"Whether the parent zone publishes a DS record for this zone","desc":"A zone can be signed and still be an insecure delegation: without a DS record in the parent, a validating resolver has no way to reach the zone's keys and treats the whole zone as unsigned. Signing without delegating is the most common way a DNSSEC deployment silently does nothing, so this is a different question from `enabled`.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"denialOfExistence":{"name":"denialOfExistence","type":"\u0007","is_mandatory":true,"title":"How the zone proves that a name does not exist","desc":"`NSEC3` when the zone publishes an NSEC3PARAM record, `NSEC` when the zone is signed and publishes none, and empty when the zone is not signed. NSEC lets anyone walk the zone and enumerate every name in it; NSEC3 publishes hashes instead.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"dsDigestsMatchKeys":{"name":"dsDigestsMatchKeys","type":"\u0004","is_mandatory":true,"title":"Whether every published DS record matches a published DNSKEY","desc":"False when the parent still publishes a DS for a key the zone has rolled away from, or when the child publishes keys the parent has never been told about. Either breaks validation for part of the internet while the zone continues to look correctly signed from the inside. True when there is at least one DS record and every one of them matches a key.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"dsRecords":{"name":"dsRecords","type":"\u0019\u001bdns.dsRecord","is_mandatory":true,"title":"DS records the parent zone publishes for this zone","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the domain publishes DNSKEY records","provider":"go.mondoo.com/mql/providers/network"},"keys":{"name":"keys","type":"\u0019\u001bdns.dnssecKey","is_mandatory":true,"title":"Published DNSKEY signing keys","provider":"go.mondoo.com/mql/providers/network"},"nsec3HashAlgorithm":{"name":"nsec3HashAlgorithm","type":"\u0005","is_mandatory":true,"title":"NSEC3 hash algorithm number, or 0 when the zone does not use NSEC3","desc":"Only 1 (SHA-1) is assigned.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"nsec3Iterations":{"name":"nsec3Iterations","type":"\u0005","is_mandatory":true,"title":"NSEC3 hash iteration count, or 0 when the zone does not use NSEC3","desc":"Additional iterations beyond the first. RFC 9276 recommends 0: the extra rounds cost the server and every validating resolver far more than they cost an attacker, and resolvers increasingly treat high counts as insecure rather than doing the work.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"nsec3OptOut":{"name":"nsec3OptOut","type":"\u0004","is_mandatory":true,"title":"Whether NSEC3 opt-out is enabled, allowing unsigned delegations to go unproven","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"nsec3SaltLength":{"name":"nsec3SaltLength","type":"\u0005","is_mandatory":true,"title":"NSEC3 salt length in bytes, or 0 when there is no salt","desc":"A zone with no salt publishes `-`, which is zero bytes rather than a one-character salt. RFC 9276 recommends an empty salt, because the salt only helps against precomputation that a zone re-signing already defeats.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"}},"title":"DNSSEC configuration for a domain","desc":"How a domain's zone is signed: whether it publishes DNSKEY records, the parsed signing keys and their algorithms and lengths, the delegation the parent zone publishes, and the way the zone proves a name does not exist. This is the zone's configuration, which is stable between re-signings. What a resolution of the domain actually returned is a separate question, answered by `dnssecValidation` on the parent dns resource. `enabled` reflects published DNSKEY records and does not, on its own, mean the chain of trust resolves.","min_provider_version":"13.2.1","defaults":"enabled","provider":"go.mondoo.com/mql/providers/network"},"dns.dnssecKey":{"id":"dns.dnssecKey","name":"dns.dnssecKey","fields":{"algorithm":{"name":"algorithm","type":"\u0005","is_mandatory":true,"title":"DNSSEC algorithm number (RFC 8624), e.g. 8 (RSASHA256) or 13 (ECDSAP256SHA256)","provider":"go.mondoo.com/mql/providers/network"},"algorithmName":{"name":"algorithmName","type":"\u0007","is_mandatory":true,"title":"IANA mnemonic for the algorithm number, e.g. RSASHA256 or ECDSAP256SHA256","desc":"Empty when the algorithm number is unassigned, so an unknown algorithm reads as unknown instead of being reported under someone else's name.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"flags":{"name":"flags","type":"\u0005","is_mandatory":true,"title":"DNSKEY flags field, e.g. 256 for a zone-signing key or 257 for a key-signing key","provider":"go.mondoo.com/mql/providers/network"},"keyLength":{"name":"keyLength","type":"\u0005","is_mandatory":true,"title":"Key length in bits","desc":"Derived from the published key material rather than assumed from the algorithm, so a malformed key does not report a confident wrong size. 0 means the length could not be determined, not that the key is empty.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"keySigningKey":{"name":"keySigningKey","type":"\u0004","is_mandatory":true,"title":"Whether this is a key-signing key (the Secure Entry Point bit is set)","provider":"go.mondoo.com/mql/providers/network"},"protocol":{"name":"protocol","type":"\u0005","is_mandatory":true,"title":"Protocol field, always 3 for DNSSEC","provider":"go.mondoo.com/mql/providers/network"},"publicKey":{"name":"publicKey","type":"\u0007","is_mandatory":true,"title":"Base64-encoded public key","provider":"go.mondoo.com/mql/providers/network"},"revoked":{"name":"revoked","type":"\u0004","is_mandatory":true,"title":"Whether the key carries the RFC 5011 revoke bit","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"zoneKey":{"name":"zoneKey","type":"\u0004","is_mandatory":true,"title":"Whether the key may be used to sign zone data (the Zone Key bit is set)","desc":"A DNSKEY without this bit is published in the zone but must not validate any record in it.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"}},"title":"DNSKEY record (RFC 4034)","desc":"Single published DNSSEC key: its flags, protocol, algorithm number and length, and the base64-encoded public key. `keySigningKey` is true for a key-signing key, the one whose Secure Entry Point bit is set, as opposed to a zone-signing key. The flags are read bit by bit rather than compared against 256 and 257, so a revoked key-signing key (flags 385) is still reported as one.  The key tag and the signature bytes are deliberately not exposed. They change every time the zone is re-signed, so a check built on either reports a different answer on a schedule the operator did not choose. Algorithm, key length and the flag bits survive re-signing and are what an audit should assert on.","private":true,"min_provider_version":"13.2.1","defaults":"algorithm keySigningKey","provider":"go.mondoo.com/mql/providers/network"},"dns.dnssecValidationResult":{"id":"dns.dnssecValidationResult","name":"dns.dnssecValidationResult","fields":{"authenticatedData":{"name":"authenticatedData","type":"\u0004","is_mandatory":true,"title":"Whether the resolver set the Authenticated Data flag on the response","desc":"This is the resolver's own verdict: it validated the answer and vouches for it. It says nothing when the resolver does not validate, which is why `chainOfTrustValidated` is computed here rather than taken on trust.","provider":"go.mondoo.com/mql/providers/network"},"brokenAtZone":{"name":"brokenAtZone","type":"\u0007","is_mandatory":true,"title":"Zone the chain of trust broke at, empty when it validated","desc":"Names the first zone walking upward whose link to its parent could not be established, which is the zone whose operator has something to fix.","provider":"go.mondoo.com/mql/providers/network"},"chain":{"name":"chain","type":"\u0019\u0007","is_mandatory":true,"title":"Zones the chain of trust walk traversed, from the signed answer up to the root","provider":"go.mondoo.com/mql/providers/network"},"chainOfTrustValidated":{"name":"chainOfTrustValidated","type":"\u0004","is_mandatory":true,"title":"Whether the chain of trust validated from this answer up to the root","desc":"Verified here rather than delegated to the resolver: each zone's DNSKEY set is checked against the DS record its parent publishes, up to the IANA root trust anchor. False for an unsigned zone, an insecure delegation, a DS that no longer matches a published key, and any zone the walk could not reach. Null when dnssecOk is false, because the answer the walk would start from never carried a signature.","provider":"go.mondoo.com/mql/providers/network"},"dnssecOk":{"name":"dnssecOk","type":"\u0004","is_mandatory":true,"title":"Whether the resolver returned DNSSEC records for a query that asked for them","desc":"False when the path to the resolver strips EDNS0 or the resolver does not support DNSSEC. Every resolver the host is configured with is tried before this reports false. When it does, the answer describes the resolver rather than the zone, so signed, signaturesVerified, signaturesCurrentlyValid and chainOfTrustValidated are all null instead of reporting a verdict, and error says which case this is.","provider":"go.mondoo.com/mql/providers/network"},"earliestSignatureExpiry":{"name":"earliestSignatureExpiry","type":"\t","is_mandatory":true,"title":"When the earliest-expiring signature over the answer expires","desc":"Null when the answer carried no signatures.","provider":"go.mondoo.com/mql/providers/network"},"error":{"name":"error","type":"\u0007","is_mandatory":true,"title":"Why validation did not complete, empty when the chain of trust validated","desc":"Distinguishes the cases that all otherwise read as an unvalidated resolution: a zone that is not signed, a resolver that could not be reached, a signature that did not verify, and a delegation with no DS record at the parent.","provider":"go.mondoo.com/mql/providers/network"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name that was queried","provider":"go.mondoo.com/mql/providers/network"},"recordType":{"name":"recordType","type":"\u0007","is_mandatory":true,"title":"Record type that was queried","provider":"go.mondoo.com/mql/providers/network"},"responseCode":{"name":"responseCode","type":"\u0007","is_mandatory":true,"title":"Response code of the validating query, e.g. NOERROR, SERVFAIL, or NXDOMAIN","desc":"A validating resolver answers SERVFAIL, not NOERROR, when a zone's signatures do not verify, so a bogus zone and a broken server look alike from the response code alone. Read `error` to tell them apart.","provider":"go.mondoo.com/mql/providers/network"},"signatureAlgorithms":{"name":"signatureAlgorithms","type":"\u0019\u0005","is_mandatory":true,"title":"Distinct DNSSEC algorithm numbers across the answer's signatures","desc":"The algorithm that actually signed the answer, which is not necessarily every algorithm the zone publishes a key for. A zone mid-migration publishes keys for both and signs with one.","provider":"go.mondoo.com/mql/providers/network"},"signatureExpiresIn":{"name":"signatureExpiresIn","type":"\t","is_mandatory":true,"title":"How long the earliest-expiring signature over the answer has left","desc":"Negative once that signature has expired. Null when the answer carried no signatures.","provider":"go.mondoo.com/mql/providers/network"},"signatures":{"name":"signatures","type":"\u0019\u001bdns.rrsigRecord","is_mandatory":true,"title":"Signatures covering the answer","provider":"go.mondoo.com/mql/providers/network"},"signaturesCurrentlyValid":{"name":"signaturesCurrentlyValid","type":"\u0004","is_mandatory":true,"title":"Whether every signature over the answer is inside its validity window now","desc":"False when any signature has expired or has not yet become valid, and false when the answer carried no signatures at all, so it cannot pass vacuously on an unsigned zone. Null when dnssecOk is false.","provider":"go.mondoo.com/mql/providers/network"},"signaturesVerified":{"name":"signaturesVerified","type":"\u0004","is_mandatory":true,"title":"Whether every signature over the answer verified against a published DNSKEY","desc":"The cryptographic check of the answer itself, independent of anything the resolver claims. False when no signature could be verified, including when the answer carried none. Null when dnssecOk is false.","provider":"go.mondoo.com/mql/providers/network"},"signed":{"name":"signed","type":"\u0004","is_mandatory":true,"title":"Whether the answer carried at least one RRSIG record","desc":"Null when dnssecOk is false: a resolver that did not return DNSSEC records answers the same way for a signed zone and an unsigned one, so an unsigned answer is not evidence that the zone is unsigned.","provider":"go.mondoo.com/mql/providers/network"},"signerNames":{"name":"signerNames","type":"\u0019\u0007","is_mandatory":true,"title":"Distinct zones that signed the answer","provider":"go.mondoo.com/mql/providers/network"}},"title":"DNSSEC validation result for a domain","desc":"What a DNSSEC-validating resolution of a domain actually returned, as distinct from what the zone publishes. Reports whether the resolver honored the DNSSEC OK bit, whether it set the Authenticated Data flag, whether the answer carried signatures, whether those signatures verify against the zone's published keys, and whether the chain of trust links all the way to the root trust anchor. Reachable as `dns(fqdn: \"example.com\").dnssecValidation`.  Nothing here raises an error when validation does not succeed. An unsigned zone, an unreachable resolver, a resolver that does not return DNSSEC records, and a genuinely broken chain of trust all report their state in these fields with `error` explaining which one happened, so a scan of a fleet that includes unsigned domains still completes.  The last of those is not a statement about the zone: when `dnssecOk` is false the resolver answered without signatures whatever the zone publishes, so the verdict fields are null rather than false.","min_provider_version":"13.3.1","defaults":"chainOfTrustValidated authenticatedData","provider":"go.mondoo.com/mql/providers/network"},"dns.dsRecord":{"id":"dns.dsRecord","name":"dns.dsRecord","fields":{"algorithm":{"name":"algorithm","type":"\u0005","is_mandatory":true,"title":"DNSSEC algorithm number of the key this record delegates to","provider":"go.mondoo.com/mql/providers/network"},"algorithmName":{"name":"algorithmName","type":"\u0007","is_mandatory":true,"title":"IANA mnemonic for the algorithm number, empty when unassigned","provider":"go.mondoo.com/mql/providers/network"},"digest":{"name":"digest","type":"\u0007","is_mandatory":true,"title":"Hex-encoded digest of the delegated key","desc":"Changes whenever the key it covers is rolled, so audit `matchesPublishedKey` rather than comparing this against a pinned value.","provider":"go.mondoo.com/mql/providers/network"},"digestType":{"name":"digestType","type":"\u0005","is_mandatory":true,"title":"Digest type number: 1 (SHA-1), 2 (SHA-256), or 4 (SHA-384)","provider":"go.mondoo.com/mql/providers/network"},"digestTypeName":{"name":"digestTypeName","type":"\u0007","is_mandatory":true,"title":"IANA mnemonic for the digest type, empty when unassigned","provider":"go.mondoo.com/mql/providers/network"},"matchesPublishedKey":{"name":"matchesPublishedKey","type":"\u0004","is_mandatory":true,"title":"Whether this digest matches a DNSKEY the zone currently publishes","desc":"False for a DS the parent has kept past a key rollover, which is a chain of trust that fails for resolvers while the zone still looks signed.","provider":"go.mondoo.com/mql/providers/network"}},"title":"DS record (RFC 4034)","desc":"One delegation signer record published by the parent zone, which is what ties a child zone's key into the chain of trust. Carries the algorithm and digest type, the digest itself, and whether that digest matches a key the child zone currently publishes.  The key tag is deliberately not exposed: it changes on every key rollover. Assert on `matchesPublishedKey`, the algorithm, and the digest type, which do not.","private":true,"min_provider_version":"13.3.1","defaults":"algorithm digestType matchesPublishedKey","provider":"go.mondoo.com/mql/providers/network"},"dns.mxRecord":{"id":"dns.mxRecord","name":"dns.mxRecord","fields":{"domainName":{"name":"domainName","type":"\u0007","is_mandatory":true,"title":"Domain name","provider":"go.mondoo.com/mql/providers/network"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Record name","provider":"go.mondoo.com/mql/providers/network"},"preference":{"name":"preference","type":"\u0005","is_mandatory":true,"title":"Which mail server used if multiple MX records exist","provider":"go.mondoo.com/mql/providers/network"}},"title":"DNS MX record","desc":"Mail-exchange (MX) record for the domain: the record name, the resolved target `domainName`, and the `preference` value used to choose between multiple MX records.","min_provider_version":"9.0.1","defaults":"domainName","provider":"go.mondoo.com/mql/providers/network"},"dns.record":{"id":"dns.record","name":"dns.record","fields":{"class":{"name":"class","type":"\u0007","is_mandatory":true,"title":"DNS class","provider":"go.mondoo.com/mql/providers/network"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"DNS name","provider":"go.mondoo.com/mql/providers/network"},"rdata":{"name":"rdata","type":"\u0019\u0007","is_mandatory":true,"title":"DNS record response data (IP addresses, hostnames, or other values depending on record type)","provider":"go.mondoo.com/mql/providers/network"},"ttl":{"name":"ttl","type":"\u0005","is_mandatory":true,"title":"Time-to-live (TTL) in seconds","provider":"go.mondoo.com/mql/providers/network"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"DNS type","provider":"go.mondoo.com/mql/providers/network"}},"title":"DNS record","desc":"Single resolved DNS record: name, type, class, TTL, and the rdata payload (IP addresses, hostnames, or other values depending on the record type).","min_provider_version":"9.0.1","defaults":"name type","provider":"go.mondoo.com/mql/providers/network"},"dns.rrsigRecord":{"id":"dns.rrsigRecord","name":"dns.rrsigRecord","fields":{"algorithm":{"name":"algorithm","type":"\u0005","is_mandatory":true,"title":"DNSSEC algorithm number that produced the signature","provider":"go.mondoo.com/mql/providers/network"},"algorithmName":{"name":"algorithmName","type":"\u0007","is_mandatory":true,"title":"IANA mnemonic for the algorithm number, empty when unassigned","provider":"go.mondoo.com/mql/providers/network"},"expiration":{"name":"expiration","type":"\t","is_mandatory":true,"title":"When the signature stops being valid","provider":"go.mondoo.com/mql/providers/network"},"expired":{"name":"expired","type":"\u0004","is_mandatory":true,"title":"Whether the signature's validity has already ended","provider":"go.mondoo.com/mql/providers/network"},"expiresIn":{"name":"expiresIn","type":"\t","is_mandatory":true,"title":"How long the signature has left before it expires","desc":"Negative once the signature has already expired. Assert a floor on this to catch a zone whose re-signing has stopped, which takes the zone down for validating resolvers at the moment the last signature lapses, with no warning from anything else.","provider":"go.mondoo.com/mql/providers/network"},"inception":{"name":"inception","type":"\t","is_mandatory":true,"title":"When the signature became valid","provider":"go.mondoo.com/mql/providers/network"},"labels":{"name":"labels","type":"\u0005","is_mandatory":true,"title":"Number of labels in the original signed name","provider":"go.mondoo.com/mql/providers/network"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name the signed record set belongs to","provider":"go.mondoo.com/mql/providers/network"},"notYetValid":{"name":"notYetValid","type":"\u0004","is_mandatory":true,"title":"Whether the signature's validity has not yet begun","desc":"A resolver rejects a signature from the future exactly as harshly as an expired one, so a clock skewed forward on the signing server breaks the zone the same way a lapsed signature does.","provider":"go.mondoo.com/mql/providers/network"},"originalTtl":{"name":"originalTtl","type":"\u0005","is_mandatory":true,"title":"Original TTL of the signed record set, as it appears in the zone","provider":"go.mondoo.com/mql/providers/network"},"signerName":{"name":"signerName","type":"\u0007","is_mandatory":true,"title":"Zone that produced the signature","provider":"go.mondoo.com/mql/providers/network"},"typeCovered":{"name":"typeCovered","type":"\u0007","is_mandatory":true,"title":"Record type this signature covers, e.g. A, DNSKEY, or CNAME","provider":"go.mondoo.com/mql/providers/network"}},"title":"RRSIG record (RFC 4034)","desc":"One signature covering a resolved record set: the record type it covers, the algorithm that produced it, the zone that signed it, and the validity window it is usable in. Reachable through `dnssecValidation` on a dns resource, which collects the signatures a validating query returned.  The key tag and the signature bytes are deliberately not exposed, because both change every time the zone is re-signed. The validity window does not change in the same way: a zone re-signed weekly with a fourteen day window reports roughly the same remaining validity whenever it is looked at, which is what makes `expiresIn` something an audit can assert on.","private":true,"min_provider_version":"13.3.1","defaults":"typeCovered algorithm signerName","provider":"go.mondoo.com/mql/providers/network"},"dns.spfRecord":{"id":"dns.spfRecord","name":"dns.spfRecord","fields":{"allQualifier":{"name":"allQualifier","type":"\u0007","is_mandatory":true,"title":"Qualifier on the terminating `all` mechanism","desc":"One of `+` (pass), `-` (fail), `~` (softfail), or `?` (neutral). A bare `all` is reported as `+` (the SPF default). Empty when the record has no `all` mechanism.","provider":"go.mondoo.com/mql/providers/network"},"dnsTxt":{"name":"dnsTxt","type":"\u0007","is_mandatory":true,"title":"Raw TXT record","provider":"go.mondoo.com/mql/providers/network"},"mechanisms":{"name":"mechanisms","type":"\u0019\u0007","is_mandatory":true,"title":"Ordered SPF mechanisms and modifiers","desc":"All terms after the version, in order, including the terminating `all` term — for example `[\"ip4:192.0.2.0/24\", \"include:_spf.example.com\", \"-all\"]`. The `all` qualifier is also surfaced separately as `allQualifier`.","provider":"go.mondoo.com/mql/providers/network"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Version tag, e.g. \"spf1\"","provider":"go.mondoo.com/mql/providers/network"}},"title":"SPF policy record (RFC 7208)","desc":"Parsed Sender Policy Framework record from a domain's TXT records: the version, the ordered list of mechanisms, and the qualifier on the terminating `all` mechanism that decides how unauthorized senders are handled. Select a domain's records with `dns(fqdn: \"example.com\").spf`.","private":true,"min_provider_version":"13.1.1","defaults":"dnsTxt allQualifier","provider":"go.mondoo.com/mql/providers/network"},"domainName":{"id":"domainName","name":"domainName","fields":{"effectiveTLDPlusOne":{"name":"effectiveTLDPlusOne","type":"\u0007","is_mandatory":true,"title":"Effective top-level domain plus one label (the registrable domain)","provider":"go.mondoo.com/mql/providers/network"},"fqdn":{"name":"fqdn","type":"\u0007","is_mandatory":true,"title":"Fully qualified domain name (FQDN)","provider":"go.mondoo.com/mql/providers/network"},"labels":{"name":"labels","type":"\u0019\u0007","is_mandatory":true,"title":"Domain labels","provider":"go.mondoo.com/mql/providers/network"},"tld":{"name":"tld","type":"\u0007","is_mandatory":true,"title":"Top-level domain","provider":"go.mondoo.com/mql/providers/network"},"tldIcannManaged":{"name":"tldIcannManaged","type":"\u0004","is_mandatory":true,"title":"Whether the TLD is ICANN managed","provider":"go.mondoo.com/mql/providers/network"}},"init":{"args":[{"name":"fqdn","type":"\u0007"}]},"title":"Domain name","desc":"Parsed view of a fully qualified domain name, broken into its registrable parts. Select the name with `domainName(fqdn: \"x.example.com\")`. Use it to reason about the registrable domain (the effective TLD plus one label) and the top-level domain independently of subdomain labels, for example to group hosts by their owning domain or to check whether a name sits under an ICANN-managed TLD.","min_provider_version":"9.0.1","defaults":"fqdn","provider":"go.mondoo.com/mql/providers/network","global":true},"http":{"id":"http","name":"http","fields":{"get":{"name":"get","type":"\u001bhttp.get","title":"HTTP GET request","desc":"Result of an HTTP GET against a URL, for probing how a web endpoint responds. Initialize with `http.get(\"https://example.com\", true)`, where the second argument decides whether redirects are followed. The `header` sub-resource parses the response's security headers (HSTS, CSP, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Referrer-Policy, Content-Type, and Set-Cookie) into individually queryable values.","provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"header":{"name":"header","type":"\u001bhttp.header","title":"HTTP header","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true}},"title":"HTTP endpoint","desc":"Entry point for HTTP probing. Use `http.get(\"https://...\")` to perform a GET against a URL and inspect the response status, headers (parsed into sub-resources for HSTS, CSP, cookies, and other security headers), and body.","min_provider_version":"9.0.5","provider":"go.mondoo.com/mql/providers/network","global":true},"http.get":{"id":"http.get","name":"http.get","fields":{"body":{"name":"body","type":"\u0007","title":"Body returned from this request","provider":"go.mondoo.com/mql/providers/network"},"followRedirects":{"name":"followRedirects","type":"\u0004","is_mandatory":true,"title":"Follow redirects","provider":"go.mondoo.com/mql/providers/network"},"header":{"name":"header","type":"\u001bhttp.header","title":"Header returned from this request","provider":"go.mondoo.com/mql/providers/network"},"statusCode":{"name":"statusCode","type":"\u0005","title":"Status returned from this request","provider":"go.mondoo.com/mql/providers/network"},"url":{"name":"url","type":"\u001burl","is_mandatory":true,"title":"URL for this request","provider":"go.mondoo.com/mql/providers/network"},"version":{"name":"version","type":"\u0007","title":"Version of the HTTP request, (e.g., 1.1)","provider":"go.mondoo.com/mql/providers/network"}},"init":{"args":[{"name":"rawUrl","type":"\u0007"},{"name":"followRedirects","type":"\u0004"}]},"title":"HTTP GET request","desc":"Result of an HTTP GET against a URL, for probing how a web endpoint responds. Initialize with `http.get(\"https://example.com\", true)`, where the second argument decides whether redirects are followed. The `header` sub-resource parses the response's security headers (HSTS, CSP, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Referrer-Policy, Content-Type, and Set-Cookie) into individually queryable values.","min_provider_version":"9.0.5","defaults":"url statusCode","provider":"go.mondoo.com/mql/providers/network"},"http.header":{"id":"http.header","name":"http.header","fields":{"contentType":{"name":"contentType","type":"\u001bhttp.header.contentType","title":"Content-Type header","provider":"go.mondoo.com/mql/providers/network"},"csp":{"name":"csp","type":"\u001a\u0007\u0007","title":"Content-Security-Policy header directives","desc":"The parsed Content-Security-Policy header, keyed by directive name lowercased (for example `default-src`, `script-src`, or `frame-ancestors`) with that directive's source list as the value. Null when no Content-Security-Policy header is present.","provider":"go.mondoo.com/mql/providers/network"},"params":{"name":"params","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Raw response headers, keyed by header name","desc":"Each key is a canonical response header name (for example `Content-Type` or `Set-Cookie`) and each value is the list of values sent for that header. The other fields on this resource parse individual headers out of this map into structured values.","provider":"go.mondoo.com/mql/providers/network"},"referrerPolicy":{"name":"referrerPolicy","type":"\u0007","title":"Referrer-Policy header","desc":"Controls how much referrer information the browser sends with requests. One of no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin, or unsafe-url. Empty when no Referrer-Policy header is sent.","provider":"go.mondoo.com/mql/providers/network"},"server":{"name":"server","type":"\u0007","title":"Server header value, e.g. \"nginx\" or \"Apache/2.4.62\"","desc":"The product token(s) the server discloses about itself. Empty when no Server header is sent. Frequently flagged by hardening policies because it leaks the server software and sometimes its version.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/network"},"setCookie":{"name":"setCookie","type":"\u001bhttp.header.setCookie","title":"Set-Cookie header","desc":"Deprecated in favor of setCookies. Reports only the first cookie the response sets, so an assertion made over it silently ignores every other cookie. Null when the response sets no cookies. Will be removed in the next major release.","provider":"go.mondoo.com/mql/providers/network","maturity":"deprecated"},"setCookies":{"name":"setCookies","type":"\u0019\u001bhttp.header.setCookie","title":"Every cookie the response sets, one entry per Set-Cookie header","desc":"Null when the response sets no cookies. Each entry parses one Set-Cookie header, so attributes stay attached to the cookie that carried them.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/network"},"sts":{"name":"sts","type":"\u001bhttp.header.sts","title":"HTTP Strict-Transport-Security (HSTS) header","provider":"go.mondoo.com/mql/providers/network"},"xContentTypeOptions":{"name":"xContentTypeOptions","type":"\u0007","title":"X-Content-Type-Options header: nosniff","provider":"go.mondoo.com/mql/providers/network"},"xFrameOptions":{"name":"xFrameOptions","type":"\u0007","title":"X-Frame-Options header: DENY, SAMEORIGIN, or ALLOW-FROM origin (obsolete)","provider":"go.mondoo.com/mql/providers/network"},"xXssProtection":{"name":"xXssProtection","type":"\u001bhttp.header.xssProtection","title":"X-XSS-Protection header","provider":"go.mondoo.com/mql/providers/network"},"xssProtection":{"name":"xssProtection","type":"\u001bhttp.header.xssProtection","title":"HTTP header X-XSS-Protection","desc":"Configuration of the legacy browser XSS filter, parsed from the X-XSS-Protection response header. Now outdated (replaced by Content-Security-Policy) and, when enabled, capable of introducing security vulnerabilities of its own, so hardening policies generally expect it disabled.","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true}},"title":"HTTP header","private":true,"min_provider_version":"9.0.5","defaults":"length=params.length","provider":"go.mondoo.com/mql/providers/network"},"http.header.contentType":{"id":"http.header.contentType","name":"http.header.contentType","fields":{"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Content-Type parameters, keyed by parameter name","desc":"Parameters that follow the media type, keyed by name lowercased (for example `charset` or `boundary`) with the parameter value. Empty when the Content-Type header carries no parameters.","provider":"go.mondoo.com/mql/providers/network"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"MIME type for the content","provider":"go.mondoo.com/mql/providers/network"}},"title":"HTTP header Content-Type","private":true,"min_provider_version":"9.0.5","defaults":"type","provider":"go.mondoo.com/mql/providers/network"},"http.header.setCookie":{"id":"http.header.setCookie","name":"http.header.setCookie","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the cookie to set","provider":"go.mondoo.com/mql/providers/network"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Cookie attributes, keyed by attribute name","desc":"Attributes set on the cookie, keyed by name lowercased (for example `path`, `domain`, `secure`, `httponly`, `samesite`, `max-age`, or `expires`) with the attribute value. Flag attributes such as `secure` and `httponly` carry an empty value.","provider":"go.mondoo.com/mql/providers/network"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Value of the cookie to set","provider":"go.mondoo.com/mql/providers/network"}},"title":"HTTP header Set-Cookie","private":true,"min_provider_version":"9.0.5","defaults":"name value","provider":"go.mondoo.com/mql/providers/network"},"http.header.sts":{"id":"http.header.sts","name":"http.header.sts","fields":{"includeSubDomains":{"name":"includeSubDomains","type":"\u0004","is_mandatory":true,"title":"Whether caching applies to subdomains","provider":"go.mondoo.com/mql/providers/network"},"maxAge":{"name":"maxAge","type":"\t","is_mandatory":true,"title":"How long to cache HTTPS-only policy in seconds","provider":"go.mondoo.com/mql/providers/network"},"preload":{"name":"preload","type":"\u0004","is_mandatory":true,"title":"Non-standard directive for preloading STS","provider":"go.mondoo.com/mql/providers/network"}},"title":"HTTP header Strict-Transport-Security","private":true,"min_provider_version":"9.0.5","defaults":"maxAge includeSubDomains preload","provider":"go.mondoo.com/mql/providers/network"},"http.header.xssProtection":{"id":"http.header.xssProtection","name":"http.header.xssProtection","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the header is enabled (Enabled when the header value is set to 1; disabled if set to 0)","provider":"go.mondoo.com/mql/providers/network"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Mode for XSS filtering","provider":"go.mondoo.com/mql/providers/network"},"report":{"name":"report","type":"\u0007","is_mandatory":true,"title":"Report endpoint for violations (Chromium only)","provider":"go.mondoo.com/mql/providers/network"}},"title":"HTTP header X-XSS-Protection","desc":"Configuration of the legacy browser XSS filter, parsed from the X-XSS-Protection response header. Now outdated (replaced by Content-Security-Policy) and, when enabled, capable of introducing security vulnerabilities of its own, so hardening policies generally expect it disabled.","private":true,"min_provider_version":"9.0.5","defaults":"enabled mode report","provider":"go.mondoo.com/mql/providers/network"},"network":{"id":"network","fields":{"host":{"name":"host","type":"\u001bnetwork.host","title":"Remote host","desc":"The host this connection targets, addressed by a domain name or an IP. What the provider can tell you about it hangs off here: `domainName` parses the name into its registrable domain and labels, `dns` reads its records, and `tls` inspects its TLS endpoint. Each of those also stands on its own with an explicit target, which is how they were reached before this resource existed.","provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true}},"is_extension":true},"network.host":{"id":"network.host","name":"network.host","fields":{"asset":{"name":"asset","type":"\u001basset","title":"Asset this root belongs to","desc":"Platform, version, identity and labels of the asset this root describes.","provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"dns":{"name":"dns","type":"\u001bdns","title":"DNS records for this host","provider":"go.mondoo.com/mql/providers/network"},"domainName":{"name":"domainName","type":"\u001bdomainName","title":"Parsed domain name","desc":"The target broken into its registrable domain, TLD and labels. Empty of meaning for an IP target.","provider":"go.mondoo.com/mql/providers/network"},"fqdn":{"name":"fqdn","type":"\u0007","title":"Domain name or IP address this connection targets","provider":"go.mondoo.com/mql/providers/network"},"scheme":{"name":"scheme","type":"\u0007","title":"URL scheme the target was given with, e.g. https","desc":"Empty when the target carried none, which is deliberate rather than unknown: the connection leaves it empty and each resource decides what that means to it. `tls` and `http.get` both read an unschemed target as HTTPS, so `host example.com` inspects the HTTPS endpoint.","provider":"go.mondoo.com/mql/providers/network"},"tls":{"name":"tls","type":"\u001btls","title":"TLS endpoint of this host","provider":"go.mondoo.com/mql/providers/network"}},"title":"Remote host","desc":"The host this connection targets, addressed by a domain name or an IP. What the provider can tell you about it hangs off here: `domainName` parses the name into its registrable domain and labels, `dns` reads its records, and `tls` inspects its TLS endpoint. Each of those also stands on its own with an explicit target, which is how they were reached before this resource existed.","min_provider_version":"13.3.1","defaults":"fqdn","provider":"go.mondoo.com/mql/providers/network","root":true},"openpgp":{"id":"openpgp","fields":{"entities":{"name":"entities","type":"\u001bopenpgp.entities","title":"List of OpenPGP entities parsed from a string","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"entity":{"name":"entity","type":"\u001bopenpgp.entity","title":"OpenPGP entity","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"identity":{"name":"identity","type":"\u001bopenpgp.identity","title":"OpenPGP identity","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"publicKey":{"name":"publicKey","type":"\u001bopenpgp.publicKey","title":"OpenPGP public key","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"signature":{"name":"signature","type":"\u001bopenpgp.signature","title":"OpenPGP signature","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true}},"is_extension":true},"openpgp.entities":{"id":"openpgp.entities","name":"openpgp.entities","fields":{"content":{"name":"content","type":"\u0007","is_mandatory":true,"provider":"go.mondoo.com/mql/providers/network"},"list":{"name":"list","type":"\u0019\u001bopenpgp.entity","refs":["\"content\""],"provider":"go.mondoo.com/mql/providers/network"}},"list_type":"\u001bopenpgp.entity","title":"List of OpenPGP entities parsed from a string","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/network"},"openpgp.entity":{"id":"openpgp.entity","name":"openpgp.entity","fields":{"identities":{"name":"identities","type":"\u0019\u001bopenpgp.identity","title":"Entity's identities","provider":"go.mondoo.com/mql/providers/network"},"primaryPublicKey":{"name":"primaryPublicKey","type":"\u001bopenpgp.publicKey","is_mandatory":true,"title":"Primary public key, which must be a signing key","provider":"go.mondoo.com/mql/providers/network"}},"title":"OpenPGP entity","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/network"},"openpgp.identity":{"id":"openpgp.identity","name":"openpgp.identity","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Free-form comment from the OpenPGP user ID","provider":"go.mondoo.com/mql/providers/network"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Email address from the OpenPGP user ID","provider":"go.mondoo.com/mql/providers/network"},"fingerprint":{"name":"fingerprint","type":"\u0007","is_mandatory":true,"title":"Primary key fingerprint","provider":"go.mondoo.com/mql/providers/network"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Full name in form of `Full Name (comment) \u003cemail@example.com\u003e`","provider":"go.mondoo.com/mql/providers/network"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Real name from the OpenPGP user ID","provider":"go.mondoo.com/mql/providers/network"},"signatures":{"name":"signatures","type":"\u0019\u001bopenpgp.signature","title":"Identity signatures","provider":"go.mondoo.com/mql/providers/network"}},"title":"OpenPGP identity","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/network"},"openpgp.publicKey":{"id":"openpgp.publicKey","name":"openpgp.publicKey","fields":{"bitLength":{"name":"bitLength","type":"\u0005","is_mandatory":true,"title":"Key bit length","provider":"go.mondoo.com/mql/providers/network"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"Key creation time","provider":"go.mondoo.com/mql/providers/network"},"fingerprint":{"name":"fingerprint","type":"\u0007","is_mandatory":true,"title":"Key fingerprint","provider":"go.mondoo.com/mql/providers/network"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Key ID","provider":"go.mondoo.com/mql/providers/network"},"keyAlgorithm":{"name":"keyAlgorithm","type":"\u0007","is_mandatory":true,"title":"Public key algorithm (e.g., RSA, ECDSA, Ed25519)","provider":"go.mondoo.com/mql/providers/network"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Key version","provider":"go.mondoo.com/mql/providers/network"}},"title":"OpenPGP public key","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/network"},"openpgp.signature":{"id":"openpgp.signature","name":"openpgp.signature","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"Creation time","provider":"go.mondoo.com/mql/providers/network"},"expiresIn":{"name":"expiresIn","type":"\t","is_mandatory":true,"title":"Expiration duration","provider":"go.mondoo.com/mql/providers/network"},"fingerprint":{"name":"fingerprint","type":"\u0007","is_mandatory":true,"title":"Primary key fingerprint","provider":"go.mondoo.com/mql/providers/network"},"hash":{"name":"hash","type":"\u0007","is_mandatory":true,"title":"Signature hash","provider":"go.mondoo.com/mql/providers/network"},"identityName":{"name":"identityName","type":"\u0007","is_mandatory":true,"title":"Identity name","provider":"go.mondoo.com/mql/providers/network"},"keyAlgorithm":{"name":"keyAlgorithm","type":"\u0007","is_mandatory":true,"title":"Public-key algorithm of the signing key (e.g., RSA, ECDSA, Ed25519)","provider":"go.mondoo.com/mql/providers/network"},"keyExpiresIn":{"name":"keyExpiresIn","type":"\t","is_mandatory":true,"title":"Key expiration duration","provider":"go.mondoo.com/mql/providers/network"},"keyLifetimeSecs":{"name":"keyLifetimeSecs","type":"\u0005","is_mandatory":true,"title":"Key lifetime in seconds","provider":"go.mondoo.com/mql/providers/network"},"lifetimeSecs":{"name":"lifetimeSecs","type":"\u0005","is_mandatory":true,"title":"Signature lifetime in seconds","provider":"go.mondoo.com/mql/providers/network"},"signatureType":{"name":"signatureType","type":"\u0007","is_mandatory":true,"title":"Signature type","desc":"One of binary, text, generic_cert, persona_cert, casual_cert, positive_cert, subkey_binding, primary_key_binding, direct_signature, key_revocation, subkey_revocation, or cert_revocation.","provider":"go.mondoo.com/mql/providers/network"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Signature version","provider":"go.mondoo.com/mql/providers/network"}},"title":"OpenPGP signature","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/network"},"pkix":{"id":"pkix","fields":{"extension":{"name":"extension","type":"\u001bpkix.extension","title":"X.509 PKIX extension","desc":"Single extension carried by an X.509 certificate, identified by its OID (for example 2.5.29.37 for extKeyUsage). The `critical` flag marks whether a client that does not recognize the extension must reject the certificate, and `value` holds the raw extension bytes.","provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"name":{"name":"name","type":"\u001bpkix.name","title":"X.509 PKIX name","desc":"Distinguished name (DN) parsed per RFC 5280: the structured identity of a certificate's subject or issuer. Exposes the canonical DN string, common name, country, organization and organizational unit, locality, province, street address, postal code, serial number, and any additional named attributes, so you can audit who a certificate was issued to and who issued it.","provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"sanExtension":{"name":"sanExtension","type":"\u001bpkix.sanExtension","title":"X.509 certificate PKIX Subject Alternative Name (SAN) extension","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true}},"is_extension":true},"pkix.extension":{"id":"pkix.extension","name":"pkix.extension","fields":{"critical":{"name":"critical","type":"\u0004","is_mandatory":true,"title":"Whether the extension is critical","provider":"go.mondoo.com/mql/providers/network"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cache key derived from the extension identifier","min_provider_version":"9.1.3","provider":"go.mondoo.com/mql/providers/network"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Extension identifier (OID, e.g., 2.5.29.37 for extKeyUsage)","provider":"go.mondoo.com/mql/providers/network"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Extension value","provider":"go.mondoo.com/mql/providers/network"}},"title":"X.509 PKIX extension","desc":"Single extension carried by an X.509 certificate, identified by its OID (for example 2.5.29.37 for extKeyUsage). The `critical` flag marks whether a client that does not recognize the extension must reject the certificate, and `value` holds the raw extension bytes.","min_provider_version":"9.0.0","defaults":"id","provider":"go.mondoo.com/mql/providers/network"},"pkix.name":{"id":"pkix.name","name":"pkix.name","fields":{"commonName":{"name":"commonName","type":"\u0007","is_mandatory":true,"title":"Common name","provider":"go.mondoo.com/mql/providers/network"},"country":{"name":"country","type":"\u0019\u0007","is_mandatory":true,"title":"Country","provider":"go.mondoo.com/mql/providers/network"},"dn":{"name":"dn","type":"\u0007","is_mandatory":true,"title":"Canonical distinguished name (DN) string","provider":"go.mondoo.com/mql/providers/network"},"extraNames":{"name":"extraNames","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Non-standard distinguished name attributes by OID","desc":"RDN attributes beyond the dedicated fields (commonName, country, organization, and so on), keyed by attribute OID with the attribute value as the value.","provider":"go.mondoo.com/mql/providers/network"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cache key derived from the distinguished name","provider":"go.mondoo.com/mql/providers/network"},"locality":{"name":"locality","type":"\u0019\u0007","is_mandatory":true,"title":"Locality or city","provider":"go.mondoo.com/mql/providers/network"},"names":{"name":"names","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Distinguished name attributes by OID","desc":"All relative distinguished name (RDN) attributes parsed from the DN, keyed by attribute OID (for example \"2.5.4.3\" for commonName or \"2.5.4.10\" for organization) with the attribute value as the value.","provider":"go.mondoo.com/mql/providers/network"},"organization":{"name":"organization","type":"\u0019\u0007","is_mandatory":true,"title":"Organization","provider":"go.mondoo.com/mql/providers/network"},"organizationalUnit":{"name":"organizationalUnit","type":"\u0019\u0007","is_mandatory":true,"title":"Organizational unit","provider":"go.mondoo.com/mql/providers/network"},"postalCode":{"name":"postalCode","type":"\u0019\u0007","is_mandatory":true,"title":"Postal code","provider":"go.mondoo.com/mql/providers/network"},"province":{"name":"province","type":"\u0019\u0007","is_mandatory":true,"title":"State or province","provider":"go.mondoo.com/mql/providers/network"},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Serial number","provider":"go.mondoo.com/mql/providers/network"},"streetAddress":{"name":"streetAddress","type":"\u0019\u0007","is_mandatory":true,"title":"Street address","provider":"go.mondoo.com/mql/providers/network"}},"title":"X.509 PKIX name","desc":"Distinguished name (DN) parsed per RFC 5280: the structured identity of a certificate's subject or issuer. Exposes the canonical DN string, common name, country, organization and organizational unit, locality, province, street address, postal code, serial number, and any additional named attributes, so you can audit who a certificate was issued to and who issued it.","min_provider_version":"9.0.0","defaults":"id dn commonName","provider":"go.mondoo.com/mql/providers/network"},"pkix.sanExtension":{"id":"pkix.sanExtension","name":"pkix.sanExtension","fields":{"dnsNames":{"name":"dnsNames","type":"\u0019\u0007","is_mandatory":true,"title":"DNS names","provider":"go.mondoo.com/mql/providers/network"},"emailAddresses":{"name":"emailAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Email addresses","provider":"go.mondoo.com/mql/providers/network"},"extension":{"name":"extension","type":"\u001bpkix.extension","is_mandatory":true,"title":"x509 certificate PKIX extension","provider":"go.mondoo.com/mql/providers/network"},"ipAddresses":{"name":"ipAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"IP addresses","provider":"go.mondoo.com/mql/providers/network"},"uris":{"name":"uris","type":"\u0019\u0007","is_mandatory":true,"title":"URIs","provider":"go.mondoo.com/mql/providers/network"}},"title":"X.509 certificate PKIX Subject Alternative Name (SAN) extension","private":true,"min_provider_version":"9.1.2","defaults":"dnsNames","provider":"go.mondoo.com/mql/providers/network"},"socket":{"id":"socket","name":"socket","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Target address (hostname or IP)","provider":"go.mondoo.com/mql/providers/network"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Port number","provider":"go.mondoo.com/mql/providers/network"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Transport protocol (e.g., tcp, udp)","provider":"go.mondoo.com/mql/providers/network"}},"title":"Network socket","desc":"Addressable network endpoint identified by its transport `protocol`, `port`, and `address`. Serves as a building block for higher-level resources such as `tls` that need to know what to connect to.","min_provider_version":"9.0.0","defaults":"protocol port address","provider":"go.mondoo.com/mql/providers/network","global":true},"tls":{"id":"tls","name":"tls","fields":{"certificateMatchesDomain":{"name":"certificateMatchesDomain","type":"\u0004","title":"Whether the served leaf certificate covers the connection hostname","desc":"Matches the connection's domain name against the leaf certificate's Subject Alternative Name DNS entries using RFC 6125 wildcard rules, so `*.example.com` covers `api.example.com`. Unlike chain verification, this isolates hostname coverage — it is true when the certificate vouches for the host you connected to, independent of chain trust or expiry. Null when the connection has no domain name to match, such as when connecting directly to an IP address.","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/network"},"certificates":{"name":"certificates","type":"\u0019\u001bcertificate","refs":["\"socket\"","\"domainName\""],"title":"Certificates provided in this TLS/SSL connection","provider":"go.mondoo.com/mql/providers/network"},"cipher":{"name":"cipher","type":"\u001btls.cipher","title":"TLS/SSL cipher suite","desc":"Examine a single negotiable cipher suite broken into its key-exchange, authentication, bulk-encryption, and MAC components, plus derived security properties. Components are parsed best-effort from the IANA/OpenSSL suite name, so audits can select suites by property — for example `forwardSecrecy == false` or `cbc` — instead of matching the raw name with regular expressions. Unknown components are empty.","is_private":true,"provider":"go.mondoo.com/mql/providers/network","is_implicit_resource":true},"cipherSuites":{"name":"cipherSuites","type":"\u0019\u001btls.cipher","refs":["\"params\""],"title":"Supported cipher suites parsed into components and security properties","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/providers/network"},"ciphers":{"name":"ciphers","type":"\u0019\u0007","refs":["\"params\""],"title":"Ciphers supported by this TLS/SSL connection","provider":"go.mondoo.com/mql/providers/network"},"domainName":{"name":"domainName","type":"\u0007","is_mandatory":true,"title":"An optional domain name to test","provider":"go.mondoo.com/mql/providers/network"},"extensions":{"name":"extensions","type":"\u0019\u0007","refs":["\"params\""],"title":"Extensions supported by this TLS/SSL connection","provider":"go.mondoo.com/mql/providers/network"},"negotiatedCipher":{"name":"negotiatedCipher","type":"\u0007","refs":["\"socket\"","\"domainName\""],"title":"Cipher suite negotiated by a modern client (e.g., \"TLS_AES_128_GCM_SHA256\")","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/network"},"negotiatedGroup":{"name":"negotiatedGroup","type":"\u0007","refs":["\"socket\"","\"domainName\""],"title":"Key exchange group negotiated during the TLS handshake (e.g., X25519, X25519MLKEM768)","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/network"},"negotiatedVersion":{"name":"negotiatedVersion","type":"\u0007","refs":["\"socket\"","\"domainName\""],"title":"TLS version negotiated by a modern client (e.g., \"TLS 1.3\")","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/network"},"nonSniCertificates":{"name":"nonSniCertificates","type":"\u0019\u001bcertificate","refs":["\"socket\"","\"domainName\""],"title":"Certificates provided without server name indication (SNI)","provider":"go.mondoo.com/mql/providers/network"},"params":{"name":"params","type":"\n","refs":["\"socket\"","\"domainName\""],"title":"Raw TLS/SSL handshake findings for this connection","desc":"Dict with three keys: `versions`, `ciphers`, and `extensions`. Each maps a protocol version, cipher suite, or extension name to a bool recording whether the endpoint accepts it. The versions, ciphers, and extensions fields expose the accepted entries drawn from this bag.","provider":"go.mondoo.com/mql/providers/network"},"socket":{"name":"socket","type":"\u001bsocket","is_mandatory":true,"title":"Socket of this connection","provider":"go.mondoo.com/mql/providers/network"},"versions":{"name":"versions","type":"\u0019\u0007","refs":["\"params\""],"title":"Version of TLS/SSL that is being used","provider":"go.mondoo.com/mql/providers/network"}},"init":{"args":[{"name":"target","type":"\u0007"}]},"title":"TLS/SSL connection inspection","desc":"TLS posture of a network endpoint. Initialize with `tls(\"host:port\")` (an optional `domainName` enables SNI testing). Surfaces every TLS / SSL version the endpoint accepts, the cipher suites and extensions advertised, the version, cipher, and key-exchange group a modern client actually negotiates, and the served certificate chain (both the SNI-aware chain and the non-SNI fallback). Use it to find weak protocol versions, weak ciphers, expired certs, and missing OCSP / SCT support.","min_provider_version":"9.0.0","defaults":"socket domainName","provider":"go.mondoo.com/mql/providers/network","global":true},"tls.cipher":{"id":"tls.cipher","name":"tls.cipher","fields":{"aead":{"name":"aead","type":"\u0004","is_mandatory":true,"title":"Whether the suite uses authenticated encryption (GCM, CCM, or ChaCha20-Poly1305)","provider":"go.mondoo.com/mql/providers/network"},"anonymous":{"name":"anonymous","type":"\u0004","is_mandatory":true,"title":"Whether the suite is anonymous and performs no server authentication","provider":"go.mondoo.com/mql/providers/network"},"authentication":{"name":"authentication","type":"\u0007","is_mandatory":true,"title":"Authentication algorithm, e.g. \"RSA\", \"ECDSA\", or \"anon\"","provider":"go.mondoo.com/mql/providers/network"},"cbc":{"name":"cbc","type":"\u0004","is_mandatory":true,"title":"Whether the suite uses CBC mode, which is exposed to a class of padding attacks","provider":"go.mondoo.com/mql/providers/network"},"encryption":{"name":"encryption","type":"\u0007","is_mandatory":true,"title":"Bulk encryption algorithm, e.g. \"AES_128_GCM\", \"3DES_EDE_CBC\", or \"RC4_128\"","provider":"go.mondoo.com/mql/providers/network"},"export":{"name":"export","type":"\u0004","is_mandatory":true,"title":"Whether the suite is export-grade (deliberately weakened)","provider":"go.mondoo.com/mql/providers/network"},"forwardSecrecy":{"name":"forwardSecrecy","type":"\u0004","is_mandatory":true,"title":"Whether the suite provides forward secrecy","desc":"True for ephemeral key exchanges (ECDHE, DHE) and all TLS 1.3 suites.","provider":"go.mondoo.com/mql/providers/network"},"keyExchange":{"name":"keyExchange","type":"\u0007","is_mandatory":true,"title":"Key-exchange algorithm, e.g. \"ECDHE\", \"DHE\", or \"RSA\"","desc":"Empty for TLS 1.3 suites, where the key exchange is negotiated separately from the cipher suite.","provider":"go.mondoo.com/mql/providers/network"},"mac":{"name":"mac","type":"\u0007","is_mandatory":true,"title":"Message authentication or PRF hash, e.g. \"SHA256\", \"SHA\", or \"MD5\"","provider":"go.mondoo.com/mql/providers/network"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cipher suite name, e.g. \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\"","provider":"go.mondoo.com/mql/providers/network"},"nullCipher":{"name":"nullCipher","type":"\u0004","is_mandatory":true,"title":"Whether the suite uses null (no) encryption","provider":"go.mondoo.com/mql/providers/network"}},"title":"TLS/SSL cipher suite","desc":"Examine a single negotiable cipher suite broken into its key-exchange, authentication, bulk-encryption, and MAC components, plus derived security properties. Components are parsed best-effort from the IANA/OpenSSL suite name, so audits can select suites by property — for example `forwardSecrecy == false` or `cbc` — instead of matching the raw name with regular expressions. Unknown components are empty.","private":true,"min_provider_version":"13.1.1","defaults":"name","provider":"go.mondoo.com/mql/providers/network"},"url":{"id":"url","name":"url","fields":{"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Host, either registered name or IP (e.g., mondoo.com)","provider":"go.mondoo.com/mql/providers/network"},"password":{"name":"password","type":"\u0007","is_mandatory":true,"title":"Password, an additional optional component of the user info","provider":"go.mondoo.com/mql/providers/network"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path, consisting of segments separated by '/'","provider":"go.mondoo.com/mql/providers/network"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Port, optional decimal number (e.g., 80)","provider":"go.mondoo.com/mql/providers/network"},"query":{"name":"query","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Query, optional, attached to path via '?', parsed via '\u0026' and ';' delimiters","provider":"go.mondoo.com/mql/providers/network"},"rawFragment":{"name":"rawFragment","type":"\u0007","is_mandatory":true,"title":"Fragment, optional raw string attached to path after '#'","provider":"go.mondoo.com/mql/providers/network"},"rawQuery":{"name":"rawQuery","type":"\u0007","is_mandatory":true,"title":"Raw query, optional raw string attached to path after '?'","provider":"go.mondoo.com/mql/providers/network"},"scheme":{"name":"scheme","type":"\u0007","is_mandatory":true,"title":"Scheme (e.g., http, https, ssh)","provider":"go.mondoo.com/mql/providers/network"},"string":{"name":"string","type":"\u0007","title":"The full URL as a string","provider":"go.mondoo.com/mql/providers/network"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"User component (can contain username or token but no password)","provider":"go.mondoo.com/mql/providers/network"}},"init":{"args":[{"name":"raw","type":"\u0007"}]},"title":"Parsed URL","desc":"URL broken into its components, generally represented as `[scheme:][//[user[:password]@]host[:port]][/]path[?query][#fragment]`. Initialize with `url(\"https://user:pass@host:443/p?q=1#f\")` and inspect any of the parsed components individually: scheme, user / password user-info pair, host, port, path, parsed query map, raw query string, and fragment.","min_provider_version":"9.0.5","defaults":"string","provider":"go.mondoo.com/mql/providers/network","global":true}},"dependencies":{"core":{"id":"go.mondoo.com/mql/providers/core","name":"core"}},"provider_roots":{"go.mondoo.com/mql/providers/network":"network.host"}}