Create a real-time search query using syntax

When you want to search for real-time data or hunt for a threat on managed endpoints, create queries using the real-time search syntax that includes projection and filter.

Use this detailed example to create powerful, real-time search queries.

Get the names and IDs of processes that execute 10 or more threads.

Processes name, id where Processes threadcount greater than 10

Projection

The projection clause specifies which columns to show in the search results table. This example shows only two columns: process name and id.

Processes name, id

Term	Name	Description
`Processes`	Collector name	Specifies the search capabilities and output fields of the specific collector. In the example, the collector for running processes is selected.
`name`, `id`	Collector output fields	Selects an output field from the collector. In the projection, the output field represents a column in the result table.

Filter

The filter clause specifies conditions to match in the returned data. Only data that matches the filter appear in the search results table. In this example, only processes that execute 10 or more threads match the filter.

where Processes threadCount greater equal than 10

Term	Name	Description
`where`	Filter keyword	The keyword that starts a filter clause.
`Processes`	Collector name	Specifies the search capabilities and output fields of the specific collector. In the example, the collector for running processes is selected.
`threadcount`	Collector output field	Specifies which data must be matched against the condition output field from the collector.
`greater equal than`	Comparison operator	The operator that defines the condition to match. Different operators are available for different literal types.
`10`	Literal	A literal value.

Logical operators

Operator	Used in	Usage	Description
`and`	Projections and filters	Projection: `Processes name and Files dir` Filter: `where Processes name starts with "abc" and Processes threadCount equals 5`	In a projection, `and` selects output fields from different collectors. In a filter, it displays a result record if both the first condition `and` the second condition are true.
`or`	Filters	`where Processes name starts with "abc" or Processes name starts with "xyz"`	Displays a result record if either the first condition `or` the second condition is true.
`not`	Filters	`where Processes name not starts with "abc"`	Negates a comparison operator, so that the condition returns `true` if the comparison is `false`, or returns `false` if the comparison is `true`.
`and` and `or`	Filters	`where HostInfo hostname contains "xyz" and HostInfo ip address contains 10.76.15.0/24 or HostInfo ip_address contains 192.168.1.0/24 and Process name equals "abc"` This is a single query with 3 conditions: Condition 1 — `HostInfo hostname contains "xyz"` Condition 2 — `HostInfo ip_address contains 10.76.15.0/24 or HostInfo ip_address contains 192.168.1.0/24` Condition 3 — `Processes name equals "abc"`	This type of filter is not supported in a single query with 3 conditions as brackets are not supported to prioritize conditions.
`and` and `or`	Filters	`where Files sha256 equals "abc" and HostInfo hostname equals "pqr" or Files sha256 equals "xyz" and HostInfo hostname equals "lmn"` There are 2 queries combined with `or`: Query 1 — `Files Sha256 equals "abc" and HostInfo hostname equals "pqr"` Query 2 — `Files Sha256 equals "xyz" and HostInfo hostname equals "lmn"`	Displays a combined record result of both queries with the condition of having same sequence of collectors to be used in both queries (that is, `Files and HostInfo in first query and Files and HostInfo in second query as well`)

Comparison operators

Data type	Operator	Sample usage
Timestamp	`before`	`where Files last_access before "yyyy-mm-dd"`
Timestamp	`after`	`where Files last_access after "yyyy-mm-dd"`
Number	`equals`	`where Files size equals 1234`
	`greater than`	`where Files size greater than 1234`
	`greater equal than`	`where Files size greater equal than 1234`
	`less than`	`where Files size less than 1234`
	`less equal than`	`where Files size less equal than 1234`
String Note All string comparisons are case insensitive.	`equals`	`where Files name equals "abc"`
	`contains`	`where Files name contains "abc"`
	`starts with`	`where Files name starts with "abc"`
	`ends with`	`where Files name ends with "abc"`
String Note Search using Perl regular expression syntax.	`matches`	`where Files name matches "^file_[0-9]+.exe$"`
IP Note Filtering by IPv4 omits IPv6 results and, likewise, filtering by IPv6 omits IPv4 results.	`equals`	`where NetworkFlow src_ip equals 10.250.45.15`
	`contains`	`where NetworkFlow src_ip contains 10.250.0.0/24`

Literals

When searching for a path, you must enter an additional \ character in directory paths, for example, Users\Administrator\Documents. When searching for a value that includes a double quotation mark, use the \ character before the quotation, for example, Files where File name contains \".

Type	Sample values
Timestamp	`"2019"`, `"2019-07"`, `"2019-07-28"`, `"2019-07-28 05:30:45"`
Number	`123`, `123.45`
IP	`10.250.45.15`, `10.250.45.15/24`, `2001:0DB8::1428:57ab`, `2001:0DB8::1428:57ab/96`
String	`"aString123"`, `"This is another string"`, `"quotes\"in\"string"`
Win Registry String	`"My Computer\HKEY_LOCAL_MACHINE\HARDWARE\VIDEO"`, `"0x00000001"`