Exabeam SearchExabeam Search Guide

Use to select a set of fields, from the event store, to be included in an output table.

Syntax Example 1: SELECT id

Outputs a table with only the id column displayed.

Syntax Example 2: SELECT activity, vendor

Outputs a table with only the activity and vendor columns displayed.

Syntax Example 3: SELECT *

Outputs a table with all columns displayed.

Use within a SELECT clause to create an alias for a selected field or for a set of results (table aliasing). An alias can be useful for referring to a calculated field or for reusing a set of results in a subsequent query. It can make results more readable and easier to use in further filtering.

Syntax Example 1: SELECT activity AS aliased_activity

Outputs the activity column with the alias name.

Syntax Example 2: SELECT vendor AS aliased_vendor, product AS aliased_product

Outputs the vendor and product columns with the alias names.

Syntax Example 3: WHERE vendor:"Microsoft" AS aliased_table

Outputs the filtered results, where vendor = Microsoft, in a new aliased table.

Use to specify filter conditions to narrow down the result set. A simple search query without the SELECT and WHERE clause is treated implicitly as a WHERE statement. For example, the following two queries return the same results:

Syntax Example 1: WHERE vendor:"Microsoft"

Syntax Example 2: vendor:"Microsoft"

Used to sort the resulting set in ascending (ASC) or descending (DESC) order.

Syntax Example: ORDER-BY product ASC

Output the results sorted by the values in the product column, in ascending order.

Use to group rows of results that have the same values into summary rows. Can be used with aggregation functions to group the result set by one or more columns.

Syntax Example: GROUP-BY vendor

Outputs a row for each vendor value.

Use to limit the number of rows returned in the result set.

Syntax Example: limit 3

Outputs only the first three rows of results.

Use to separate clauses in a query statement. The pipe operator feeds the result set from an initial clause into the next clause. In more complex queries, the pipe operator can be used to chain together a sequence of query statements. You can use up to five pipe operators to chain together six query statements.

Avoid using the pipe operator in basic queries where an AND operator or WHERE clause can be used just as effectively. Reserve the use of pipe operators for cases where you want to act on the results of the base query, such as grouping or other aggregate functions.

Syntax Example:

SELECT product, AVG(raw_log_size) AS avgLogSize GROUP-BY product ORDER-BY avgLogSize DESC | avgLogSize > 2000

The clauses to the left of the pipe operator produce a table of products which lists the average log size that each handles. The log sizes are listed in a new avgLogSize column, in descending numerical order by log size. The clause to the right of the pipe operator filters the table to show only those rows where the average log size is greater than 2000.

Use to run a search function on every row of a results set returned by a previous query or by an earlier clause in a complex, pipe-separated (|) query.

Keep in mind the following points for building queries that include a FOREACH clause:

Syntax Example: id: "76734bee-54dc-4fdd-95dd-801028d3873" | FOREACH vendor [vendor: @vendor]

The first clause returns rows with the specified ID. After the pipe operator, the FOREACH clause selects the value of the vendor column in the results from the ID match, which in this case = microsoft. In the subsequent search, [vendor: @vendor] is treated as a WHERE clause that searches a newly-defined shard table for each result where the vendor value = microsoft. The resulting output is the following table:

Complex Syntax Example:

subject: "endpoint" | FOREACH dest_host [ select src_host WHERE src_host: @dest_host AND subject: "network" AND activity_type: "network-connection" ] | SELECT src_host, count(src_host) AS src_host_count GROUP-BY src_host

This complex example is explained in the color coded image below.

This search outputs a table that lists the count of each src_host that matched the query criteria, as shown in the image below.