Supported fields and operations for the Historical Search

This section provides information on supported fields and operations for the Historical Search. See the relevant section below:

Supported fields

Name	Display Value	Artifacts
All Events	Default (Empty)	All
Activity	Activity	All
Command line	CommandLine	Process
Device name	DeviceName	All
IP address	IpAddress	Network
MD5	MD5	File
Parent Process ID	Ppid	Process
Parent Process Name	ParentProcessName	Process
Process ID	Pid	Process
Process name	ProcessName	Process
Sha1	Sha1	File
Sha256	Sha256	File
User name	UserName	All

Note
When you use MD5, SHA-1, or SHA-256, it means the hashes correspond to a file.
When you use IP address, it means the destination address.

Supported logical operators

AND
OR

Note
DeviceName can be joined with any other field using the AND logical operator.
For client systems with EDR client version 3.3.x or earlier, the result doesn't appear on the Historical Search dashboard when searched with the AND logical operator for artifacts DeviceName and ProcessName.
Example: DeviceName = 7ws3342 AND ProcessName = cmd.exe
CommandLine and IpAddress can't be joined using the AND logical operator, but can be joined using the OR logical operator.
CommandLine and ProcessName can be joined using the AND logical operator.

Supported operators

Name	Display Value
Activity	`Equals,not equals,contains,not contains,starts with`
DeviceName	`Equals,not equals,contains,starts with,not contains`
ProcessName	`Equals,not equals,contains,starts with,not contains`
CommandLine	`Equals,not equals,contains,starts with,not contains`
IpAddress	`Equals,not equals,contains,starts with,not contains`
ParentProcessName	`Equals,not equals,contains,not contains,starts with`
Pid	`Equals,not equals=,!=`
Ppid	`Equals,not equals`
Sha256	`Equals,not equals,in`
MD5	`Equals,not equals,in`
Sha1	`Equals,not equals,in`
UserName	`Equals,not equals,contains,not contains,starts with`
Network DstPort	`Equals,not equals,Greater than,Less than,Greater than equal to,Less than equal to`
Score	`Equals,not equals,Greater than,Less than,Greater than equal to,Less than equal to`
Integrity	`Equals,not equals,Greater than,Less than,Greater than equal to,Less than equal to`
Logon LogonId	`Equals,not equals,Greater than,Less than,Greater than equal to,Less than equal to`

Note
contains only applies if the time range is <= 24 hours.

Allowed operations

=
!=
- The values passed to = and != are case-sensitive.
- When a field is included in a search, the results returned must contain a value in the field included in the search.
- If the search is based on an IP address, only the results with values in the IP address field are returned.
  Example:
  "fieldName != value" means "(fieldName exists and fieldName != value)"
  ipAddress != 10.1.1.1 and DeviceName = '7xblah'
  ipAddress = destination IP at that moment.
  Excludes all network traces with that IP address.
starts with
in
contains
not contains
- The value passed to in is case-sensitive.
- The values passed to starts with, contains, and not contains are case-insensitive.
- Queries with the operators starts with and contains, all special characters, and " " (blank space) need to be escaped.
  Note
  This isn't the case for the equals and not equals operators.
- When a value in the query contains double quotes that need to be escaped, the value must be enclosed in double quotes as shown below:
  Example: CommandLine = "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
  To be written as: CommandLine = "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe\" /ua /installsource scheduler
- When the value contains a space, the whole value must be enclosed in double quotes as shown below:
  Example: CommandLine = C:\Windows\System32\svchost.exe -k wsappx
  To be written as: CommandLine = "C:\Windows\System32\svchost.exe -k wsappx"
- For the contains, not contains, and starts with operators, all special characters need to be escaped with backslashes as shown below:
  Example: Value = C:\Windows\System32\svchost.exe -k wsappx
  To be written as: CommandLine contains "C\:\\Windows\\System32\\svchost.exe\ -k\ wsappx"
This behavior applies to both Historical Search and Device Search.
Example: "fieldName not contains value" means "(fieldName exists and fieldName not contains value)".