About archive searches

After a contractually set time, data from your Helix Enterprise instance is archived and no longer indexed. With an archive search, you can search events in your archived data. Although an archive search is slower than an index search, it provides access to a much larger set of data and allows a significantly longer retention period.

Your Helix Enterprise subscription may include only archive searching. If your Helix Enterprise subscription includes both archive and indexed search, index searches are the default. But you should consider using archive search in the following cases:

You need to search for something specific over a period extending beyond the limit of your index search retention period.
You are required to produce compliance reports that cannot be produced using index search results alone.

Archive search queries can be saved as you would save any search query. See Saving and reusing search queries.

Archive search results can be managed best using the Archive Searches page. The searches can be paused, resumed, rerun, deleted, and the search results can be viewed. See Managing archive searches .

Note
Trellix recommends that you select a date range for archive searches. If you do not, the archive search will search all of your data, which may take a very long time.

Note
Organization information is included in the federated view, described in Federated view.

Best practice for archive searches

Consider the following when running an archive search:

Do not run queries on raw logs or raw fields. This consumes a large amount of resources which impacts the performance of archive search.
Run narrowed queries, for example use meta_cbname or meta_cbid to perform individual searches for each sender. Broad queries such as has:rawmsghostname may search too much data and may not return specific counts.
To avoid redundancy and performance overheads, do not use the has function if you are searching for specific values in a field. For example, instead of the query has:srcipv4 search for srcipv4=10.10.10.10, and instead of has(srcipv4,dstipv4)[srcipv4,dstipv4]:[10.10.10.10,10.10.10.11 search for [srcipv4,dstipv4]:[10.10.10.10,10.10.10.11].
If you use the groupby transform in an archive search, not all results may be returned. This is because the groupby transform is attempting to find unique values to show in the search results.
Consider the following limits for archive search results:
- Count limit: The maximum number of results counted is approximately 100,000.
- S3 limit: The maximum number of results stored in S3 is 20,000.
This means that if archive searches do not return the expected results, and the number of events is over 20,000, you must split the query into smaller time intervals, or narrow the query.