Real-time search query examples

You can use the Real-time Search dashboard to search current processes and events happening on the endpoints.

The search box uses a query syntax and combines collectors to build powerful search expressions. A search expression consists of two parts, namely projection and filter.

For detailed examples categorized based on collectors, compliance, Indicators of Attack (IOAs) and Indicators of Compromise (IOCs), see Search real-time data of endpoints for investigation and threat hunting.

Projection

A projection specifies the data that Trellix EDR returns. A projection must contain at least one collector, and can include multiple collectors. The projection lists the output fields that appear as columns in the Search results table. If no output fields are specified, the default output fields are presented.

Filter

A filter specifies logical conditions to match result criteria. Filters are optional components of the search expression. Only data that matches the filter appears in the Search results table.

Note
When online devices do not respond due to network issues, all searches time out automatically after a configurable amount of time.

Example: Simple search expression

Get all records returned by the Processes collector.

Processes

Example: Search expression with projected fields

Get the name, SHA-1, and MD5 values for all records returned by the Processes collector.

Processes name,sha1,md5

Example: Search expression with filtered values

Get the name, SHA-1, and MD5 values from the Processes collector, for processes files that have the .exe extension.

Processes name, sha1, md5 where Processes name contains ".exe"

Get the name of the processes running on a device with the particular IP address.

Processes name where HostInfo ip_address equals 192.168.254.200

Example: Search expression with multiple collectors in the projection

Get the name and path of process files that currently spawn more than five threads.

Processes name and Files dir where Processes threadCount greater than 5

Example: Search expression with multiple collectors with projections and multiple filters

Get the name of the device with the particular IP address and also the name, SHA-1, and MD5 values for processes with name "suspiciousPayload.exe".

HostInfo hostname and Processes name, sha1, md5 where HostInfo ip_address equals "192.168.254.200" and Processes name contains "suspiciousPayload.exe"

Improved error management

You can use the Real-time Search dashboard to search for information about a specific threat or alert in real time . You can obtain information about processes currently running on devices using real-time search queries. Real-time searches run queries directly on devices to obtain current data.