Note
Subsearch is only supported in index searches. It will not work in archive search or rules.
Subsearch is supported using a parenthetical expression in TQL. For example:
srcip:(rawmsg:"Trojan") and hostname:"important_machine"
In this example query, the search engine will first locate “Trojan” in all raw messages and return all the source IPs of those events. It will then search for events with one of those source IPs and the hostname “important_machine” and return those events.
In this example, if the subsearch (rawmsg:Trojan) found two unique srcip addresses (172.15.1.10 and 175.15.1.20), then the full searches performed would be:
srcip:"172.15.1.10" and hostname:"important_machine" OR srcip:"175.15.1.20" and hostname:"important_machine"
You can also compare different variables to each other with the “in” operator to specify the field in the subsearch to be used in the comparison. For example:
IOC dsthost:(srchost in fireeye eventlog:/.*back.*/)
For this query, search first resolves the subsearch expression and returns the unique srchost, which it then uses to search the dsthost as search terms in the main query. This can be useful when the direction of the event is different (as with some of the events from other Trellix products) or when trying to look for callback activity from the original infection source.
Subsearch expressions will also respect the difference between the equal (=) and match (:) operators. For example:
uri:(domain in rawmsg:"Trojan")
In this example query, the unique domains returned by resolving the subsearch expression will be used in an analyzed search on the uri field due to the match (:) operator.