Views:

Construct powerful query strings to pinpoint the data or objects in your environment that you want to examine.

Explorer provides various filters along with a query language to efficiently identify, categorize, and retrieve query results. You can automate the process by saving queries, configuring the Watchlist, and configuring email notifications when you find new data.
The following table outlines the actions available in Explorer.
Action
Description
Run queries
On the Events tab, select a Data source / processor and Log type from the drop-down lists, and then specify a query and time range. Click Run query to execute the query.
Note
Note
The following log types are available:
  • All
  • Detection events: Events correlated from detections related to known threats and unusual behavior
  • Telemetry events: Events correlated from data collected by various sources to monitor, analyze, and respond to security threats in real time
  • System events: Events correlated from suspicious behavior related to user access, network traffic, systems, and software
Retrieve archival data
Query results display analytic data from up to the last 30 days which is immediately available. To query archival data (i.e. older stored data that is not instantly retrievable), click the search bar at the top of the screen and enter a query. If your results include archival data, you can click Retrieve archival data to retrieve the data.
Add event labels
On the Labeled events tab, select labels from the drop-down list to display the events with those labels, or click Manage event labels to add, edit, or remove event labels.
Investigate hosts
On the Host investigation tab, specify a hostname or IP address to efficiently hunt and monitor security threats.
Tip
Tip
You can add all of the results of your host investigation to the Host Investigation tab in the Dashboards app for further monitoring by clicking Add Host to Dashboards. To add specific data source detections, click Add to Dashboards.
Connect data sources
Click Data sources to manage data sources and connectors.
Create custom filters
Click Create custom filter to create custom filters based on queries for monitoring of suspicious events. Combine multiple custom filters into custom detection models to facilitate the threat hunting process for your organization.
Search for predefined threat hunting queries
Click Threat Hunting Queries to search for predefined threat hunting queries from TrendAI™ and Cyborg Security based on known threats to aid you in constructing powerful queries in your own environment.
View query history
Click Query History to display a list of previous queries.
Click search=GUID-6FF43673-2DC5-4AF4-9DB1-22D4BB64FDDE=1=en-us=Low.png to load a previous query or begin a new query. TrendAI™ recommends saving queries for future use.
Chat with TrendAI™ Companion
Click TrendAICompanionIcon=d358490c-a35e-44ad-8a23-ac451629cce1.jpg to start a conversation with TrendAI™ Companion.
Begin your prompts with Query to have TrendAI™ Companion create queries.
  • Click Add to Query to add the generated query to the search box.
  • TrendAI™ Companion automatically selects the suggested search method when adding queries to the search box.
Save queries
After running a query, click Save Query, specify a name, and click Save.
  • Saved queries do not contain query results.
  • You can only have up to 200 saved queries.
View saved queries
Click Saved Queries to view saved queries.
View queries in the Watchlist
Click watchlist_button=ed41c963-d16b-4c34-8e1a-7b5926521ac7.png to see all saved queries included in the Watchlist.
Select or modify query result views
Click View to select how results are displayed.
For more information, see Create a custom view for query results.
Import query result views
Click View and select Import Views to import one or more JSON files containing query result views.
Export query results
Click export_button=GUID-C683DEEE-C19C-484D-A5B1-4CA9D1794756=1=en-us=Low.jpg and select from the drop-down menu to export up to a maximum of 1,000,000 query results in CSV or JSON format.
Related information