Gravwell is an enterprise data fusion platform that enables security teams to investigate, collaborate, and analyze data from any source, on demand, all with unlimited data collection and retention. Ingest everything. Investigate anything.
Welcome to 1997! We’re happy to report that beginning in version 5.2, Gravwell now has a full featured editing environment, complete with suggestions (autocomplete), diagnostics (those little red squiggles when you misspell a word), and more.
In this article, we’ll quickly walk you through the new editor features in Gravwell 5.2.
Gravwell now supports completion hints for most parts of the query language. This includes tag names, modules, flags, enumerated values, and resources. We’re adding more features as we go (such as support for macros), but the bulk of the query language is supported already. Just start typing a query and Gravwell will provide hints as you go!
Furthermore, you can access things like documentation by expanding the competition hints on modules as shown below.
We’ve also added diagnostics to the query language instead of the previous “big red bar with an error” message. This helps narrow down where errors occur, and can even provide warnings and hints about better ways to write your query. To view a diagnostic, just hover your mouse over the word that's being called out.
FoLds, and Formatting
The last two features are small quality of life additions when writing queries. Folding allows you to collapse compound query segments, while formatting (which you can access via right clicking or by pressing F1) pretty prints your entire query.
The Command Palette
Additional editor commands are available in the Command Palette, which is accessible by right clicking in the editor or by pressing F1. If the Command Palette looks familiar to you VSCode readers, it’s because Gravwell is using the same editor component, Monaco, that VSCode uses.
Several more features are planned for the new editor interface, including code actions that can rewrite your query based on feedback from Gravwell, and more documentation and help through highlighting and diagnostics.
Try it and Discuss
Love It! Hate it? or just want to share what you discovered? Come join us in our community discord and discuss Gravwell 5.2.
Topics: Releases and Updates