Creating an Exhaustive Search

You can perform an exhaustive search for conditions that include specific tokens. Some tokens require an exhaustive search. However, if any condition in an Enterprise Search does not support an exhaustive search, an exhaustive search is not performed. To determine which tokens allow exhaustive searches and which require exhaustive searches, see the Search token reference .

Note
To run an exhaustive search, you must have an Endpoint Security (HX) Power license.

To create an exhaustive search:

Select Enterprise Search from the Investigate section of the main menu in the Endpoint Security (HX) Web UI.
Click the plus sign (+) on the left side of the search bar and select a token that allows an exhaustive search from the drop-down list. See Search token reference .
The drop-down list provides a filter area you can use to quickly locate your token. Start typing the token name. The tokens that match the characters you enter are shown.
Select an operator in the drop-down list. See Search condition operators .
Supply the token value or values for which you wish to search. No wild card characters are supported.
Remove any trailing spaces in the values you specify. Enterprise Search does not remove these trailing spaces and your search may fail because of them. (HXEP-9325)
Note
When Japanese or Chinese characters are entered in the Enterprise Search bar using a Japanese or Chinese Input Method Editor (IME) in Firefox or Internet Explorer 11, the cursor moves unexpectedly or starts the search before the search request is complete. (HXEP-6440)
When you click at the end of the search string in the search bar, a message appears indicating which types of host endpoints can run the search. (ENDPT-7844 partial)
Select Enable exhaustive search. The exhaustive search area expands.
Optionally, supply values for exhaustive search options, described in Exhaustive search options.
After all optional exhaustive search options are specified, start the search. See Starting a search .

Exhaustive search options

The following possible exhaustive search options are available for some search tokens.

Option

Description

Filter by macOS Path

Specify the macOS path in which you want the search to be performed.

Filter by Windows path

Specify the Windows path in which you want the search to be performed. The environment variable %systemdrive% (C:\) is the default. Specify a precise path name or another appropriate path-based Windows environment variable. Here are some examples of other valid Windows environment variables:

`%appdata%`	`C:\Users\{username}\AppData\Roaming`
`%commonprogramfiles%`	`C:\Program Files (x86)\Common Files` (x86)
`%localappdata%`	`C:\Users\{username}\AppData\Local`
`%programdata%`	`C:\ProgramData`
`%programfiles%`	`C:\Program Files`
`%systemdrive%`	`C:\`
`%systemroot%`	the path where Windows is installed, usually `C:\Windows`
`%temp%` `%tmp%`	`C:\Users\{Username}\AppData\Local\Temp`
`%userprofile%`	`%SystemDrive%\Users\<username>`

Filter by Registry Hive

Specify the registry hive in which you want the search to be performed.

Look <nn> folders deep

Specify the folder depth that should be searched, where <nn> is the folder depth. Valid values are positive integers, 0, and -1.

Specifying -1 requests a search at all directory levels (an unlimited search depth).
Specifying 0 in Windows environments does not search at any level. Specifying 0 in macOS environments requests a search at the current directory level. (ENDPT-413)
Specifying 1 in Windows environments requests a search at the current directory level. Specifying 1 in macOS environments requests a search at the current directory level and one level lower. (ENDPT-413)
Specifying any other positive integer in Windows environments searches folders at a depth that includes the current directory level. For example, specifying 2 requests a search at the current directory level and one level lower. (ENDPT-413)
Specifying any other positive integer in macOS environments sets the search depth from the current directory level. For example, specifying 2 requests a search at the current directory level and two levels lower. (ENDPT-413)

Maximum file size

Specify the maximum file size, in bytes, that should be included in the search. Valid values are integers greater than or equal to -1 (negative 1). Specifying -1 indicates that no maximum file size limit should be enforced. Specifying 0 indicates that only files that have a size of zero bytes should be reported.

If the size (in bytes) of an Enterprise Search exceeds the maximum file size of the exhaustive search, the search is still created. (HXEP-6042)

In macOS environments, an exhaustive Enterprise Search that specifies 0 for the Maximum file size option does not correctly search for files with sizes of zero. (ENDPT-517 and XAGT-1818)

Minimum file size

Specify the minimum file size, in bytes, that should be included in the search. Valid values are integers greater than or equal to -1 (negative 1). Specifying -1 or 0 indicate that no minimum file size limit should be enforced.