Run a Query Pack

Query packs let you bundle multiple queries and run them together. You can find query packs in the cnquery GitHub repo.

Let cnquery choose the right query pack

cnquery comes with query packs out of the box for most systems:

cnquery scan local

Without any more specifics, cnquery tries to find and run the default query pack for the given system.

To specify a query pack, use the -f flag and --querypack argument:

cnquery scan TARGET -f YAMLFILE --querypack PACKNAME

For...	Substitute...
`TARGET`	The asset to query, such as `local` or a transport to a remote machine.
`YAMLFILE`	The query pack file, such as `mondoo-aws-incident-response.mql.yaml`.
`PACKNAME`	The name of the pack to run.

For example:

cnquery scan local --querypack incident-response

Custom query packs let you bundle queries to meet your specific needs. You can find simple query pack examples in the cnquery repo's examples folder.

To learn about Mondoo Platform, read the Mondoo Platform docs or visit mondoo.com.