---
title: "MDS Query Tool"
url: "https://axoflow.com/docs/axoflow/data-sources/appliances/checkpoint/mds-query-tool/"
last_modified: "2026-05-12T12:48:47+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/llms.txt).

# MDS Query Tool

MDS Query Tool:
CLI tool for querying multi-domain configurations and policies in Check Point environments.

To onboard such a source to Axoflow, complete the [generic appliance onboarding steps](https://axoflow.com/docs/axoflow/data-sources/appliances/index.md).

## Labels

Axoflow automatically adds the following labels to data collected from this source:

| Analytics label | Message field | Value |
| --- | --- | --- |
| `vendor` | [`meta.vendor`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.vendor) | `checkpoint` |
| `product` | [`meta.product`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.product) | `mds-query-tool` |

You can use the labels as:

- **Filter labels** on the [Analytics page](https://axoflow.com/docs/axoflow/metrics/analytics/index.md),
- in the **Filter By Label** field during [log tapping](https://axoflow.com/docs/axoflow/onboard-hosts/log-tapping/index.md).

You can use the message fields

- in [Flow Processing steps](https://axoflow.com/docs/axoflow/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps,
- in AQL expressions in the search bars.

## Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

| sourcetype | index |
| --- | --- |
| `cp_log` | `netops` |

## Sending data to Microsoft Sentinel

When sending the data collected from this source to a [Microsoft Sentinel destination](https://axoflow.com/docs/axoflow/destinations/microsoft/sentinel/index.md), Axoflow normalizes the data and sends it to the following table: `Syslog`.