xenXDRby FluenceSecurity
Book a demo

Query syntax

The search grammar of the Logs page and of native detection rules.

Terms

FormMeaning
wordFree text against message and the raw document.
"quoted phrase"Exact phrase.
field:valueEquality on a field. Values with spaces go in quotes.
field:value*Prefix match. * also works at the start.
field:>10 field:<=200Numeric and date comparisons.
field:[a TO b]Ranges, inclusive.
field:*The field exists.
-field:value or NOT field:valueNegation.
a AND b, a OR b, (a OR b) AND cBoolean logic, uppercase, with parentheses. Adjacent terms are AND.

Fields

Field names are the canonical dotted names from the field dictionary: host.name, user.name, process.command_line, source.ip. The query bar autocompletes them and shows each field's type and description. Aliases from the dictionary are accepted and rewritten: ;pe expands to process.executable.

Examples

text
event.severity:high host.name:NL-WS-0* "failed logon"
event.module:sysmon event.code:1 process.parent.executable:*\cmd.exe
source.ip:[192.0.2.0 TO 192.0.2.255] AND NOT user.name:svc-*
event.type:logon_failed user.name:j.kowalski @timestamp:>now-1h

Time

Relative time uses now-15m, now-24h, now-7d. Absolute time is ISO 8601. The time range control and @timestamp terms combine.

In detection rules

Native rules use the same grammar for their query. Sequence and correlation rules add stages and windows on top; see Writing rules.