Terms
| Form | Meaning |
|---|---|
word | Free text. Bare words match whole words anywhere in the document. |
"quoted phrase" | Exact phrase. |
field:value | Equality on a field, case-insensitive. Quote values with spaces. |
field:WKS-04* | Wildcards: * for any run of characters, ? for one. |
field>10 field:>=200 | Numeric comparisons: >, >=, <, <=. |
field in (a, b) or field:(a or b) | Any of a list of values. |
field:/regex/ | Regular expression. |
field:* | The field exists. |
not field:value, -field:value, field!=value | Negation. |
a and b, a or b, (a or b) and c | Boolean logic, in any case. Adjacent terms are joined with and. |
Fields
Field names are the canonical dotted names from the field dictionary: host.name, user.name, process.command_line, source.ip. The query bar autocompletes them one dotted part at a time and shows each field's type and description. After a ;, the initials of a field's parts expand to it: ;pe becomes process.executable.
A field the source sent under its own name can be queried by that name too.
Time
The time range picker sets the window for every query. Drag across the histogram to narrow it.
Pipelines
On the Logs page a query can continue with stages after |, each working on the output of the one before:
| Stage | Does |
|---|---|
stats count, dc(user.name) by host.name | Aggregates: count, dc, sum, avg, min, max. |
top 10 user.name, rare process.executable | Most and least common values. |
where count > 50 | Filters an aggregated result. |
fields host.name, user.name, fields - message | Chooses or drops columns. |
dedup host.name, rename count as hits | One row per key; renames a column. |
sort count desc, head 50, tail 20 | Shapes the result. |
seq within 10m by user.name then event.code:4624 | This, then that, for the same key. |
Examples
event.severity:high host.name:NL-WS-0* "failed logon"
event.module:sysmon event.code:1 process.parent.executable:*\cmd.exe
event.code:4625 | stats count by user.name | where count > 20
event.type:logon_failed user.name:j.kowalski
In detection rules
Query rules use the same language without pipelines; count with a threshold rule instead. Sequence and correlation rules add stages and windows on top; see Writing rules.