Username

Searches for a username. Windows and macOS host endpoints can be searched using this token. Exhaustive searches for registry and Windows event records apply only to Windows endpoints.

Field Format	Exhaustive Search?	Exhaustive Search Details
string	Optional	Includes searching for a file on disk, a process, a registry key, or a Windows event record. Allows you to filter by path name and specify the following disk search options: folder depth minimum file size maximum file size This token also allows you to filter the search by Windows registry hive path. The default registry hive path used is `HKEY_LOCAL_MACHINE\Software` when no path is specified. Filtering by registry hive augments the default registry search, possibly returning results that were not found in a quick search using the same query. (ENDPT-7838/ENDPT-4198)

Field Format

Exhaustive Search?

Exhaustive Search Details

string

Optional

Includes searching for a file on disk, a process, a registry key, or a Windows event record.

Allows you to filter by path name and specify the following disk search options:

folder depth
minimum file size
maximum file size

This token also allows you to filter the search by Windows registry hive path. The default registry hive path used is HKEY_LOCAL_MACHINE\Software when no path is specified. Filtering by registry hive augments the default registry search, possibly returning results that were not found in a quick search using the same query. (ENDPT-7838/ENDPT-4198)