{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-guides/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["partial"]},"type":"markdown"},"seo":{"title":"How Synqly Labs works","siteUrl":"https://docs.synqly.com","lang":"en-US"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Availability","attributes":{"type":"pre-release"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This feature is actively being developed. Breaking changes should be expected. Synqly Labs is"," ","available only in Synqly Mesh."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Please contact us before using this feature."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"how-synqly-labs-works","__idx":0},"children":["How Synqly Labs works"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page explains where Labs data comes from, what happens to the changes you make, and where"," ","Labs behaves differently from the real provider. Read it when Labs gives you an answer you did not"," ","expect."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"acme-corp","__idx":1},"children":["ACME Corp"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every provider in Labs serves synthetic data about the same fictional company, ACME Corp. The company"," ","has tens to hundreds of each kind of record: devices, users, groups, alerts, indicators, and so on."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Because the company is shared, the providers agree with each other. A device that more than one"," ","provider reports, such as a laptop in both CrowdStrike and Claroty, has the same hostname, IP address,"," ","and MAC address in each. This lets you test workflows that join data across providers, such as"," ","matching an EDR alert to an asset record."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The company keeps working while you use it. New activity, such as alerts, sign-ins, and endpoint"," ","events, arrives every 5 minutes, and records change over time: a device goes offline, or a user's"," ","status changes. A query for the last hour returns recent data on any day."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The data uses names and addresses that are reserved for documentation, so it can't be mistaken"," ","for real data:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Hostnames and email addresses use the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["acme.example"]}," domain."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Public IP addresses come from the ranges set aside for documentation (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["192.0.2.0/24"]},","," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["198.51.100.0/24"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["203.0.113.0/24"]},") and for benchmarking (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["198.18.0.0/15"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Internal IP addresses use private address ranges."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"your-changes","__idx":2},"children":["Your changes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Labs keeps changes per Synqly ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/concepts/accounts"},"children":["account"]},". Your organization can have"," ","many accounts, usually one for each of your customers, and each account has its own copy of ACME"," ","Corp. When an integration makes a change, such as creating an indicator, quarantining a device, or"," ","disabling a user, every integration in the same account sees it. Integrations in your other"," ","accounts, and in other organizations, keep seeing the original data."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your changes behave the way they would on the real provider:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A record you create appears in later queries."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A change to a record, such as a device's network state, appears the next time you read it."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A record you delete disappears from your account's queries. Other accounts still see it."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Labs keeps an account's changes for 15 days, counted from the first change in that account. After"," ","that, the account returns to the original data, even if you are still using it. Write your tests so they"," ","create the data they need instead of relying on changes from an earlier run."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-labs-differs-from-the-real-provider","__idx":3},"children":["How Labs differs from the real provider"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Labs aims to answer every request the way the provider would, but there are a few cases where it does"," ","not."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"operations-labs-does-not-serve","__idx":4},"children":["Operations Labs does not serve"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Some operations a connector supports are not available on Labs yet. A request to one of them returns"," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["501 Not Implemented"]}," with a message that names the operation. The main gaps are:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["CrowdStrike Real Time Response (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["execute_command"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["execute_remote_script"]},", and"," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["retrieve_file"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["SentinelOne Remote Ops (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["execute_command"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["retrieve_file"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Exclusions and policies on CrowdStrike and SentinelOne (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["query_exclusions"]}," and"," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["query_policies"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Alert updates (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["update_alert"]},") on SentinelOne. On CrowdStrike, only comments are available."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["SentinelOne cloud security compliance findings, IOMs, and threats."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each provider's Labs page has the full list."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"filters-and-sorts-that-do-not-work-yet","__idx":5},"children":["Filters and sorts that do not work yet"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A small number of filters and sorts return an error or the wrong results on Labs. Each provider's Labs"," ","page lists them under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Not on Labs"]},". The list"," ","shrinks as they are fixed."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"errors","__idx":6},"children":["Errors"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When Labs rejects a request, the error has the same format the provider uses. The connector reports"," ","it to you the same way it would report an error from the real provider."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":7},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"You see"},"children":["You see"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What it means"},"children":["What it means"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["501 Not Implemented"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The operation is not available on Labs. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#operations-labs-does-not-serve"},"children":["Operations Labs does not serve"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["400 Bad Request"]}," on a filtered query"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The filter or sort is not supported on Labs. Check the provider's Labs page."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A query returns no records"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Either no record in ACME Corp matches your filter, or an integration in your account deleted the matching records."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A record you created is gone"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["More than 15 days have passed since your account's first change. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#your-changes"},"children":["Your changes"]},"."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-documents","__idx":8},"children":["Related documents"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/labs/overview"},"children":["Synqly Labs"]},": what Labs is and where to find each provider's page."]}]}]},"headings":[{"value":"How Synqly Labs works","id":"how-synqly-labs-works","depth":1},{"value":"ACME Corp","id":"acme-corp","depth":2},{"value":"Your changes","id":"your-changes","depth":2},{"value":"How Labs differs from the real provider","id":"how-labs-differs-from-the-real-provider","depth":2},{"value":"Operations Labs does not serve","id":"operations-labs-does-not-serve","depth":3},{"value":"Filters and sorts that do not work yet","id":"filters-and-sorts-that-do-not-work-yet","depth":3},{"value":"Errors","id":"errors","depth":3},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"Related documents","id":"related-documents","depth":2}],"frontmatter":{"slug":"labs/how-labs-works","seo":{"title":"How Synqly Labs works"}},"lastModified":"2026-11-13T16:55:41.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/labs/how-labs-works","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}