# Scanner

## SCANNER

- [What is Scanner](https://docs.scanner.dev/scanner/what-and-why/readme.md): Index your security data where it lives. Full visibility, hyper-fast search, and continuous detections, without SIEM-scale costs.
- [How it Works](https://docs.scanner.dev/scanner/what-and-why/how-it-works.md)
- [How Scanner Achieves Fast Queries](https://docs.scanner.dev/scanner/what-and-why/how-it-works/how-scanner-achieves-fast-queries.md)
- [Detection Rule Engine](https://docs.scanner.dev/scanner/what-and-why/how-it-works/detection-rule-engine.md)
- [Bring Your Own Cloud (BYOC) / Self-Hosted](https://docs.scanner.dev/scanner/what-and-why/how-it-works/bring-your-own-cloud-byoc-self-hosted.md)
- [Quick Setup Overview](https://docs.scanner.dev/scanner/getting-started/quick-setup-overview.md): This guide walks you through connecting Scanner to your AWS environment and ingesting your first logs. The entire process typically takes 30-45 minutes.
- [Step 1: AWS Infrastructure Setup](https://docs.scanner.dev/scanner/getting-started/step-1-aws-infrastructure-setup.md): Before Scanner can analyze logs, you must establish a secure connection to your AWS account. This creates the IAM roles, S3 buckets, and EventBridge resources Scanner requires.
- [AWS CloudFormation](https://docs.scanner.dev/scanner/getting-started/step-1-aws-infrastructure-setup/aws-cloudformation.md): Getting started with CloudFormation
- [Terraform](https://docs.scanner.dev/scanner/getting-started/step-1-aws-infrastructure-setup/terraform.md): Getting started with Terraform
- [Manual Setup - AWS CloudShell](https://docs.scanner.dev/scanner/getting-started/step-1-aws-infrastructure-setup/manual-setup-aws-cloudshell.md)
- [Troubleshooting AWS Errors](https://docs.scanner.dev/scanner/getting-started/step-1-aws-infrastructure-setup/troubleshooting-aws-errors.md): A guide to understanding and resolving AWS configuration and permission errors that appear in the Scanner UI.
- [Step 2: Connect Your First Data Source using Scanner Collect](https://docs.scanner.dev/scanner/getting-started/step-2-connect-your-first-data-source-using-scanner-collect.md)
- [Step 3: Validate & Test](https://docs.scanner.dev/scanner/getting-started/step-3-validate-and-test.md): Once you have set up a new source you can expect to see data flowing into Scanner within a few minutes. Follow the steps below to get started exploring your data.
- [Scanner Collect: Data Ingestion](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion.md): Learn what Scanner Collect is, how it delivers your SaaS and cloud logs into S3 storage you control, and how it simplifies ingestion, indexing, and detection.
- [Sources](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources.md)
- [1Password](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/1password.md)
- [Atlassian](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/atlassian.md)
- [Auth0](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/auth0.md)
- [AWS Aurora](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-aurora.md)
- [AWS CloudTrail](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-cloudtrail.md)
- [AWS CloudWatch](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-cloudwatch.md)
- [AWS ECS](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-ecs.md)
- [AWS EKS](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-eks.md)
- [AWS GuardDuty](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-guardduty.md)
- [AWS Lambda](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-lambda.md)
- [AWS Route53 Resolver](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-route53-resolver.md)
- [AWS VPC Flow](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-vpc-flow.md)
- [AWS VPC Transit Gateway Flow](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-vpc-transit-gateway-flow.md)
- [AWS WAF](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-waf.md)
- [Azure Activity](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/azure-activity.md)
- [Azure Blob Storage](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/azure-blob-storage.md)
- [Cloudflare](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/cloudflare.md)
- [Crowdstrike](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/crowdstrike.md)
- [Custom Logs - AWS S3](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/custom-logs-aws-s3.md)
- [Custom Logs - HTTP](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/custom-logs-http.md)
- [Custom via Fluentd](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/custom-via-fluentd.md)
- [Fastly](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/fastly.md)
- [Github](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/github.md)
- [Google Cloud Platform (GCP) Audit](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-cloud-platform-gcp-audit.md)
- [Google Cloud Storage (GCS)](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-cloud-storage-gcs.md)
- [Google Workspace](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-workspace.md)
- [Google Workspace Activity](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-workspace/google-workspace-activity.md)
- [Google Workspace Alerts](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-workspace/google-workspace-alerts.md)
- [Jamf](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/jamf.md)
- [Lacework](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/lacework.md)
- [Okta](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/okta.md)
- [Osquery](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/osquery.md)
- [OSSEC](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/ossec.md)
- [SentinelOne](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/sentinelone.md)
- [Slack](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/slack.md)
- [Snowflake](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/snowflake.md)
- [Sophos](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/sophos.md)
- [Streams (Kafka, Kinesis, and More)](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams.md)
- [Apache Kafka](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/kafka.md)
- [AWS Kinesis](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/aws-kinesis.md)
- [AWS MSK](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/aws-msk.md)
- [Confluent Cloud](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/confluent-cloud.md)
- [Cribl Stream](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/cribl.md)
- [Redpanda](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/redpanda.md)
- [Syslog](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/syslog.md)
- [Sublime Security](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/sublime-security.md)
- [Suricata](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/suricata.md)
- [Teleport](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/teleport.md)
- [Windows Defender](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/windows-defender.md)
- [Windows Sysmon](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/windows-sysmon.md)
- [Wiz](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/wiz.md)
- [Zeek](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/zeek.md)
- [Log Event Structure](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/log-event-structure.md)
- [Index Organization](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/index-organization.md)
- [Regular Expressions in Index Rules](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/regular-expressions-in-index-rules.md)
- [Data Transformation & Enrichment](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment.md)
- [Data Transformations](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/data-transformations.md)
- [Custom VRL](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/custom-vrl.md)
- [Lookup Table Enrichment](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/lookup-table-enrichment.md)
- [Custom Lookup Tables](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/lookup-table-enrichment/custom-lookup-tables.md)
- [Threat Intelligence](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/lookup-table-enrichment/threat-intelligence.md)
- [GeoIP](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/lookup-table-enrichment/geoip.md)
- [Querying & Analysis](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis.md)
- [Query Syntax](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/query-syntax.md): Here is how you search through your log events
- [Understanding Tokens and Query Performance](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/tokens-and-query-performance.md)
- [Data Exploration](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/data-exploration.md)
- [Aggregation Functions](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions.md)
- [avg()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/avg.md)
- [count()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/count.md)
- [countdistinct()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/countdistinct.md)
- [eval()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/eval.md)
- [groupbycount()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/groupbycount.md)
- [head()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/head.md)
- [max()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/max.md)
- [min()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/min.md)
- [percentile()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/percentile.md)
- [rename()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/rename.md)
- [stats()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/stats.md)
- [sum()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/sum.md)
- [table()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/table.md)
- [tail()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/tail.md)
- [var()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/var.md)
- [where()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/where.md)
- [Built-in Indexes](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/built-in-indexes.md)
- [\_audit](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/built-in-indexes/_audit.md)
- [\_usage](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/built-in-indexes/_usage.md)
- [Detections & Alerting](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting.md)
- [Detection Rules](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules.md): Scanner provides built-in threat detection rules - or you can write your own. These rules run continuously and send you notifications when the rule criteria are met.
- [Out-of-the-Box Detection Rules](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/out-of-the-box-detection-rules.md)
- [Detection Rules as Code](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code.md): Collaborate on, review, and continuously test detection rules.
- [Getting Started](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/getting-started.md)
- [Writing Detection Rules](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/writing-detection-rules.md)
- [CLI](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/cli.md)
- [Managing Synced Detection Rules](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/managing-synced-detection-rules.md)
- [Detection Alert Formatting](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-alert-formatting.md): Custom formatting for detection alerts
- [Customizing PagerDuty Alerts](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-alert-formatting/customizing-pagerduty-alerts.md)
- [MITRE Tags](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/mitre-tags.md): Below are the default MITRE tags in Scanner. These are populated in the list of tags on the detection rule create and edit pages.
- [Event Sinks](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/event-sinks.md): Event sinks are alert destinations.
- [Administration](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/administration.md)
- [Authentication & SSO](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/administration/authentication-and-sso.md): Use Single Sign On to connect your enterprise's identity provider to Scanner.
- [SCIM](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/administration/authentication-and-sso/scim.md): Use SCIM to automate user provisioning, deprovisioning, and role synchronization from your enterprise's identity provider to Scanner.
- [Role-Based Access Control (RBAC)](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/administration/role-based-access-control-rbac.md)
- [MCP & AI SecOps](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops.md): Connect AI SecOps agents to your security data via Model Context Protocol.
- [Getting Started](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/getting-started.md)
- [Scanner MCP Tools Reference](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/mcp-tools-reference.md)
- [Using MCP for Security Operations](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations.md)
- [Interactive Investigations](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations/interactive-investigations.md)
- [Detection Engineering](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations/detection-engineering.md)
- [Autonomous Workflows](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations/autonomous-workflows.md)
- [Deploying Agents](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/deploying-agents.md): Deploy autonomous SOC agents to your infrastructure using pre-built, production-ready examples from the scanner-inc/agents repository.
- [Deploy via n8n](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/deploying-agents/n8n.md): Deploy Scanner SOC agents as n8n workflows. Import, configure credentials, activate.
- [Deploy via AWS](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/deploying-agents/aws.md): Deploy Scanner SOC agents to AWS using the Claude Agent SDK and Terraform.
- [Other AI Features](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/other-ai-features.md)
- [Developer Tools](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools.md)
- [API](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api.md): Scanner lets you turn your logs in S3 into an API, giving you the ability to execute ad hoc queries, create detection rules, and more.
- [Ad hoc queries](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries.md): You can execute ad hoc queries with the Scanner API, which allows you to run an arbitrary query over a specified time range.
- [Detection Rules](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules.md): A detection rule is a query that runs continuously on new logs as they arrive in Scanner. You can create create, read, update, and delete detection rules with the Scanner API.
- [Event Sinks](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks.md): Event sinks are event alert destinations. You can create, read, update, and delete event sinks with the Scanner API.
- [Git Sync](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/git-sync.md)
- [Indexes](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/indexes.md): Indexes are the containers your ingested log events live in, referenced by @index / @index\_id in queries. You can list and read indexes with the Scanner API.
- [Lookup Tables](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/lookup-tables.md): Manage lookup table files via the Scanner API. Upload CSV or MMDB files, preview their contents, edit metadata, and delete them.
- [Info Queries](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/info.md): Info API endpoints are endpoints that yield information about Scanner such as metrics or configuration values. You can read Info with the Scanner API.
- [Validating YAML files](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api/validating-yaml-files.md)
- [Beta Features](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features.md)
- [Jupyter Notebooks](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/jupyter-notebooks.md): Powerful threat hunting and investigation with Jupyter notebooks.
- [Getting Started with Jupyter Notebooks](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/jupyter-notebooks/getting-started-with-jupyter-notebooks.md)
- [Scanner Notebooks on Github](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/jupyter-notebooks/scanner-notebooks-on-github.md)
- [Scalar Functions and Operators](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators.md)
- [coalesce()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/coalesce.md)
- [if()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/if.md)
- [arr.join()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/arr.join.md)
- [math.abs()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/math.abs.md)
- [math.round()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/math.round.md)
- [num.parse()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/num.parse.md)
- [num.to\_str()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/num.to_str.md)
- [regex.extract()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.extract.md)
- [regex.is\_match()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.is_match.md)
- [regex.replace()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.replace.md)
- [regex.replace\_all()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.replace_all.md)
- [str.uriencode()](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/str.uriencode.md)
- [Unstable APIs](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/unstable.md)
- [Lookup Tables](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/unstable/lookup-tables.md): Manage lookup table files via the Scanner API. These endpoints are unstable and may change without notice.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on a page URL with the `ask` query parameter:
```
GET https://docs.scanner.dev/scanner/what-and-why/readme.md?ask=<question>
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.