Helix Enterprise index search capability lets you search events both as a starting point to find a potential compromise and to locate specific events associated with alerts. Helix Enterprise index search can search billions of events in seconds.
For raw events, Helix Enterprise can search for matching strings.
For parsed events that are normalized according to the Helix Enterprise taxonomy, Helix Enterprise can search for common data across all events from a variety of log sources. See the TQL Reference Guide for more information.
Note
Organization information is included in the federated view, described in Federated view.