# Cloud Security Query Orders

This document provides details on the query order fields and directions that are supported by each provider for each operation. Orders can be used to specify the direction of the results of an operation, such as ordering by a specific field in ascending or descending order. If a provider or operation does not support ordering, it will not be listed here.

## Query Cloud Resource Inventory

| Field | AWS Cloud Security | AWS EventBridge SQS | CrowdStrike Falcon® Insight EDR | [MOCK] CrowdStrike Falcon® Insight EDR | Microsoft Defender for Cloud | Google Security Command Center | Palo Alto Networks Cortex Cloud Security | Upwind Cloud Security | Wiz |
|  --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| cloud.account.name |  |  | asc, desc | asc, desc |  |  |  |  |  |
| device.created_time |  |  |  |  | asc, desc |  |  |  |  |
| device.first_seen_time |  |  |  |  |  |  | asc, desc |  | asc, desc |
| device.first_seen_time_dt |  |  |  |  |  |  |  |  | asc, desc |
| device.name |  |  |  |  |  |  | asc, desc |  |  |
| start_time |  |  |  |  |  |  |  |  | asc, desc |
| start_time_dt |  |  |  |  |  |  |  |  | asc, desc |
| time | asc, desc |  |  |  |  |  |  |  |  |


## Query Compliance Findings

| Field | AWS Cloud Security | AWS EventBridge SQS | CrowdStrike Falcon® Insight EDR | [MOCK] CrowdStrike Falcon® Insight EDR | Microsoft Defender for Cloud | Google Security Command Center | Palo Alto Networks Cortex Cloud Security | Upwind Cloud Security | Wiz |
|  --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| actor.authorizations.policy.desc |  |  | asc, desc | asc, desc |  |  |  |  |  |
| actor.authorizations.policy.uid |  |  | asc, desc | asc, desc |  |  |  |  |  |
| cloud.provider | asc, desc |  |  |  |  |  |  |  |  |
| compliance.control |  |  | asc, desc | asc, desc |  |  |  |  |  |
| compliance.requirements |  |  | asc, desc | asc, desc |  |  |  |  |  |
| compliance.standards |  |  | asc, desc | asc, desc |  |  |  |  |  |
| finding_info.created_time |  |  |  |  |  |  |  |  | asc, desc |
| finding_info.created_time_dt |  |  |  |  |  |  |  |  | asc, desc |
| finding_info.first_seen_time |  |  |  |  |  | asc, desc | asc, desc |  | asc, desc |
| finding_info.first_seen_time_dt |  |  |  |  |  | asc, desc |  |  | asc, desc |
| finding_info.last_seen_time |  |  |  |  |  | asc, desc |  |  |  |
| finding_info.last_seen_time_dt |  |  |  |  |  | asc, desc |  |  |  |
| finding_info.title | asc, desc |  |  |  |  | asc, desc |  |  |  |
| finding_info.uid |  |  |  |  |  | asc, desc |  |  | asc, desc |
| metadata.event_code |  |  |  |  |  | asc, desc |  |  |  |
| metadata.uid |  |  |  |  |  | asc, desc |  |  |  |
| resources.uid |  |  |  |  |  | asc, desc |  |  |  |
| severity |  |  |  |  |  |  | asc, desc |  |  |
| severity_id | asc, desc |  | asc, desc | asc, desc |  |  |  |  |  |
| start_time |  |  | asc, desc | asc, desc |  |  |  |  | asc, desc |
| start_time_dt |  |  |  |  |  |  |  |  | asc, desc |
| status | asc, desc |  |  |  |  | asc, desc |  |  |  |
| time | asc, desc |  | asc, desc | asc, desc |  | asc, desc | asc, desc |  |  |
| time_dt |  |  |  |  |  | asc, desc |  |  |  |


## Query Events

| Field | AWS Cloud Security | AWS EventBridge SQS | CrowdStrike Falcon® Insight EDR | [MOCK] CrowdStrike Falcon® Insight EDR | Microsoft Defender for Cloud | Google Security Command Center | Palo Alto Networks Cortex Cloud Security | Upwind Cloud Security | Wiz |
|  --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| time | asc, desc |  |  |  |  |  |  |  |  |


## Query IOMs

| Field | AWS Cloud Security | AWS EventBridge SQS | CrowdStrike Falcon® Insight EDR | [MOCK] CrowdStrike Falcon® Insight EDR | Microsoft Defender for Cloud | Google Security Command Center | Palo Alto Networks Cortex Cloud Security | Upwind Cloud Security | Wiz |
|  --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| finding_info.first_seen_time |  |  |  |  |  | asc, desc | asc, desc |  |  |
| finding_info.first_seen_time_dt |  |  |  |  |  | asc, desc |  |  |  |
| finding_info.last_seen_time |  |  |  |  |  | asc, desc |  |  |  |
| finding_info.last_seen_time_dt |  |  |  |  |  | asc, desc |  |  |  |
| finding_info.title |  |  |  |  |  | asc, desc |  |  |  |
| finding_info.uid |  |  |  |  |  | asc, desc |  |  |  |
| metadata.event_code |  |  |  |  |  | asc, desc |  |  |  |
| metadata.uid |  |  |  |  |  | asc, desc |  |  |  |
| resources.uid |  |  |  |  |  | asc, desc |  |  |  |
| severity |  |  |  |  |  |  | asc, desc |  |  |
| status |  |  |  |  |  | asc, desc |  |  |  |
| time |  |  |  |  |  | asc, desc | asc, desc |  |  |
| time_dt |  |  |  |  |  | asc, desc |  |  |  |


## Query Threats

| Field | AWS Cloud Security | AWS EventBridge SQS | CrowdStrike Falcon® Insight EDR | [MOCK] CrowdStrike Falcon® Insight EDR | Microsoft Defender for Cloud | Google Security Command Center | Palo Alto Networks Cortex Cloud Security | Upwind Cloud Security | Wiz |
|  --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| finding_info.created_time |  |  |  |  |  |  |  |  | asc, desc |
| finding_info.created_time_dt |  |  |  |  |  |  |  |  | asc, desc |
| finding_info.first_seen_time |  |  |  |  |  | asc, desc |  |  |  |
| finding_info.first_seen_time_dt |  |  |  |  |  | asc, desc |  |  |  |
| finding_info.last_seen_time |  |  |  |  |  | asc, desc |  |  |  |
| finding_info.last_seen_time_dt |  |  |  |  |  | asc, desc |  |  |  |
| finding_info.modified_time |  |  |  |  |  |  |  |  | asc, desc |
| finding_info.modified_time_dt |  |  |  |  |  |  |  |  | asc, desc |
| finding_info.title |  |  |  |  |  | asc, desc |  |  |  |
| finding_info.uid |  |  |  |  |  | asc, desc |  |  |  |
| metadata.event_code |  |  |  |  |  | asc, desc |  |  |  |
| metadata.uid |  |  |  |  |  | asc, desc |  |  |  |
| resources.uid |  |  |  |  |  | asc, desc |  |  |  |
| severity |  |  |  |  |  |  |  |  | asc, desc |
| status |  |  |  |  |  | asc, desc |  |  |  |
| time |  |  |  |  |  | asc, desc |  |  | asc, desc |
| time_dt |  |  |  |  |  | asc, desc |  |  | asc, desc |