Press CTRL+K to open search

Advanced field searches

  • Published on Sep 4, 2026
  • 4 minute(s) read
Prev Next

Advanced queries allow you to refine your search results further by creating exceptions, removing automatic completion operations associated with particular field names, or both. This section provides instructions for constructing the most common types of advanced queries using Structured-Pills, Boolean operators, and advanced query syntax in Context Help mode, Default mode, and Expert mode.

Important

You cannot perform an advanced search using .analyzed in Context Sensitive Help mode.

Method 1: Using structured-pills and boolean operators

You can construct an advanced query using Structured-Pills and Boolean operators. For example, if you want to search the session data for all documents that contain a doc_values_type: of smtp AND a sourceIPV4address: of 172.16.112.149, enter the following query.

In Context Sensitive Help mode:

In Default mode:

Multiple Filters and Operator02.png

  1. Click inside the Query bar to display a list of field names. Select doc_values_type and click Enter.

  2. Type smtp immediately following the colon and click Enter.

  3. Begin typing OPERATOR in the Query bar to display the Operator pill and click Enter to automatically complete the Operator pill.

  4. Select AND from the Operator drop-down menu and click Enter.

  5. Click inside the Query Bar to display a list of field names. Select sourceIPV4address and click Enter.

  6. Enter 172.16.112.149 immediately following the colon and click Enter.

  7. Click the time picker and select start and end time.

  8. Click the search icon in the Query Bar to run the search.

Method 2: Using querystring and boolean operators

The Querystring search syntax allows you to create your own Structured-Pill that ignores any automatic completion operations NDR associates with a particular field. For example, you can use Querystring to search the session data for all documents that contain any instance of Google OR Chrome in the httpUserAgent field AND match a sourceTransportPort of 80. The Boolean Operators section provides more information about using the default OR operator between Google and Chrome.

In Default mode: actually default mode

adv_field_search_method2_context_help.png

  1. Type querystring and click Enter.

  2. Enter "httpUserAgent:Google Chrome" and click Enter.

  3. Select AND from the drop-down menu and click Enter.

  4. Click inside the Query Bar to display a list of field names. Select sourceTransportPort and click Enter.

  5. Enter 80 immediately following the filter colon and click Enter.

  6. Click the time picker and select the start and end time for your session search.

  7. Click the search icon in the Query Bar to run your search.

In Default mode:

The Querystring search syntax is recognized by

Querystring and Operator.png

  1. Type querystring and click Enter.

  2. Enter "httpUserAgent:Google Chrome" in the Query Bar, and click Enter.

  3. Click inside the Query Bar to display a list of field names. Select the OPERATOR pill and click Enter to automatically complete the pill in the Query Bar.

  4. SelectAND from the Operator drop-down menu and click Enter.

  5. Click inside the Query Bar to display a list of field names. Select the sourceTransportPort Structured-Pill and click enter.

  6. Enter 80 immediately following the filter colon and click Enter.

  7. Click the time picker and select the start and end time for your session search.

  8. Click the search icon in the Query Bar to run your search.

Method 2: Using .analyzed

The .analyzed query syntax searches the NDR index and returns documents that contain any character instance of the field term or value you entered following the fieldname. The .analyzed search syntax is not case-sensitive. When you apply .analyzed to a field filter, NDR automatically applies a lowercase rule to all indexed text in the document field.

For example, the steps below show you how to construct a query that searches the session data, analyzes the httpUserAgent field for all instances of Mozilla, and returns all documents matching this term AND an httpMethod of GET.

In Context Sensitive Help mode:

  1. Enter httpUserAgent.analyzed, ignoring the contextual suggestion, httpUserAgent.

  2. Enter Mozilla.

  3. Enter AND followed by HTTPMETHOD:GET and click Enter.

  4. Click the time picker and select the time range for your session search.

  5. Click the search icon in the Query Bar to run your search.

In Default mode:

Analyzed Boolean Operator.png

  1. Type httpUserAgent.analyzed: immediately followed by the Mozilla in the Query Bar, and click Enter.

  2. Type AND followed by HTTPMETHOD:GET and click Enter. NDR separates the AND operator and the field term into separate Structured-Pills.

  3. Click the time picker and select the time range for your session search.

  4. Click the search icon in the Query Bar to run your search.

In Expert mode:

Method 3: Using querystring and .analyzed

In this example, using Querystring and .analyzed in a query, instructs NDR to ignore any auto completion operations associated with the httpUserAgent filter, search the index, and return documents that contain any character instance of Mozilla in the httpUserAgent field AND an httpMethod of GET. Follow the steps below to construct a search query using Querystring and .analyzed:

Querystring and Analyzed02.png

  1. Type Querystring:httpUserAgent.analyzed: followed by the Mozilla in the Query Bar, and click Enter.

  2. Type the operator AND followed by httpMethod:GET.

  3. Click the time picker and select the time range for your session search.

  4. Click the search icon in the Query Bar to run your search.

Method 4: Using querystring, .analyzed, and double quotes

The field filter is only valid for the term it directly precedes. For example, the query described in Basic Field Searches: Method 2, Querystring:httpUserAgent: Google Chrome ignores any automatic completion operations associated with the httpUserAgent field. It also treats "Google" and "Chrome" as two separate terms. The term Google is applied to the httpUserAgent field and Chrome is searched as text.

To search for all instances of Google Chrome, use double quotes around the phrase. Follow the steps below to construct this query type:

QAZ02.png

  1. Type Querystring:httpUserAgent.analyzed: followed by "Google Chrome" in the Query Bar.

  2. Click Esc and Enter to accept the query as it is written. NDR accepts the query, applies the double quotes around Google Chrome, but removes the double quotes from the final the Structured-Pill.

  3. Type AND and click Enter.

  4. Type httpMethod:GET and click Enter.

  5. Click the time picker and select the time range for your session search.

  6. Click the search icon in the Query Bar to run your search.

Related articles
  • Basic field searches
    Intrusion Prevention System (IPS) > Network Detection and Response (NDR) > NDR 4.x > Network Detection and Response Product Guide 4.x > Investigation and Analysis > Searching with Trellix NDR Console
  • Entering Queries
    Intrusion Prevention System (IPS) > Network Detection and Response (NDR) > NDR 4.x > Network Detection and Response Product Guide 4.x > Investigation and Analysis > Searching with Trellix NDR Console
  • Boolean Operators
    Intrusion Prevention System (IPS) > Network Detection and Response (NDR) > NDR 4.x > Network Detection and Response Product Guide 4.x > Investigation and Analysis > Searching with Trellix NDR Console > Applying search components
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy.
Products
Company
Top Features
Solutions
Existing Users
Connect With Us
Sales and Support
Copyright © Abc Inc. All Rights Reserved