Search Syntax: Simple Search

The Search app allows you to perform free form searches to access your Endpoint Activity Data and Detections.

To perform a simple search, you must enclose your search string in double quotation marks ("").

Important:
  • Simple search does not support Message Activity Data or Network Activity Data.

  • To search both the Endpoint Activity Data and Detections, select the General search method. Select either Endpoint Activity Data or Detections to search a specific set of data.

The following table outlines different search syntax and provides example strings.

Search Target

Description

Syntax

Example

Partial match

Provides all results that contain the search string in any data field

"search_string"

"john"

Returns all results that contain the string "john" in any data field

Full match

Not available

-

-

Logical operator: Multiple fields

Provides all results that match the requirements specified for multiple fields using the following operators:

  • AND

  • OR

  • NOT

"search_string1" OPERATOR "search_string2"

"john_doe" AND "credit"

Only returns results in which the log data contains both "john_doe" and "credit" in any field (example: objectUser=john_doe2; fileName=creditcard.txt)

"john_doe" AND NOT "home"

Only returns results in which the log data contains "john_doe" but does not contain "home" in any field

When using the Simple Search method, take note of the following limitations:

  • Ensure that the use of the space character exactly matches the results that you want. A double space within the search string omits any results that only include one space character in the same location.

  • The performance of the search decreases when using multiple logical operators.

  • Some search fields display substituted text for ID values and you cannot search for the text value. For example, "eventID" stores the numerical value "1" in the database but displays "TELEMETRY_PROCESS" in the search results. You cannot search for "TELEMETRY_PROCESS".