Skip to main content

Exabeam SearchExabeam Search Guide

Basic Search

In the Basic search mode, you can select search terms and fields from prebuilt lists to build a query that will search your data. You can remove a query term by clicking the cancel icon on the term.

Pre-built Basic Search Lists

Lists specific to your environment:

  • Subjects, Vendors, and Products — These lists are specific to your environment, if you do not have any logs from a particular vendor, you will not see that vendor in the list.

  • Common Event fields — This is a list of all default Common Information Model fields that are specific to your environment.

  • Entities — This is a list of user or account entities, specific to your environment, that can be selected for search. Entity search options include the following:

    • User Entity – This option leverages the Exabeam True Identity functionality. It consolidates all of the identifiers associated with a user account and allows you to search all of them at once. When you select this option, you can enter a full first and last name, a username, or an email address to find the desired user. In addition, the results will include all of the identifiers that are associated with the user in your environment, including the full name, any usernames, and any email addresses. For more information about managing and viewing entities in your environment, see the Attack Surface Insights guide.

      When you have added the user entity to your query, you can click on the tooltip next to it and display a list of all the usernames and emails associated with the user entity. This list reflects all of the user identifiers you will find in the search results.

      user-entity-tooltip.png

    • Username – This option allows you to search for a user by a specific username associated with that user's account.

    • Email – This option allows you to search for a user by a specific email address associated with that user's account.

    Note

    License Requirement for Entities Search

    Currently, searching by the Entities tab is available only if you have either the New-Scale Analytics license or the New-Scale Fusion license. For more information about these licenses,see New-Scale Security Operations Portfolio Licenses.

    For more information about managing and viewing entities in your environment, see the Attack Surface Insights guide.

  • Metadata fields — These fields are specific to your environment. These fields start with an m_.

  • Anomalies — These fields are specific to your environment, and are a result of anomalies that have been detected.

  • Custom fields — These fields are specific to you, and are a result of a custom parser applied to the ingested logs. These fields start with a c_ and can be used in searches the same way any Common Information Model field would be used.

Lists that are not specific to your environment:

  • Audit Logs — Audit logs are activity logs for user and asset activity in your organization. Specific activities related to Exabeam product administrators and users are logged, including activities within the UI as well as configuration and server changes. In Basic search mode, you can search these audit logs for key attributes. To search within the Exabeam Audit Logs, first select Audit Log under Exabeam, in the Vendors & Products section, and then select fields from the Audit Logs list. This list is not specific to your environment.

Building a Basic Search

To build a Basic search:

  1. From the Search Mode drop down menu under the search bar, select the Basic option.

    basic-search-empty.png

  2. To start building your search, click in the search bar. A dialog box opens displaying lists of search terms and fields.

    SearchQueryBuilderFeaturePanel.png

    Note

    Use the search box in the upper right corner of the panel to search across subjects, products and vendors, and fields.

  3. Select from the available lists to build your query, as described in the points below.

    Note

    Hover your curser over any Common Information Model subject or field name to view information about the field, such as data type and description.

    SearchSubjectandFieldDescriptions.png

    • Click on Subject, Vendor, or Product terms in the right two columns to add those terms to your query in the search bar. If you select multiple terms, they are joined in the query with an AND operator. You can then click the AND operator and select a different connector option from the drop down menu.

      search-connectors.png

    • Find a field name from the tabbed lists on the right: Common event fields, Metadata, Anomalies, Audit Logs , or Custom fields. You can use the Search field in the upper right to quickly find a specific field name.

      Tip

      .If you search for geo, rule, or mitre field names, you can find certain structured fields represented by dot notation, such as geo_dest_ip.country, rules.rule_source, or rules.mitre_labels_technique.

      basic-search-dot-notation.png

      Click the field name and a panel opens where you can define a value and a connection type as follows:

      SearchQueryBuilderFieldNamePanel.jpg

      • Select an AND or AND NOT connection operator to define how the selected field will be joined to the query you are building.

      • Enter one or more values for the selected field. To enter multiple values, click Enter on your keyboard after each value.

      • If you want to search for values that are located in a specific context table, click Add Context Table and select a table to add to the query. You can add a maximum of two context tables to the query. For more information, see Context Tables in Search.

      • If you want to search for values that are missing, click the Empty (null) check box. Or conversely, find values that are not null by using the AND NOT option in combination with the check box.

        Note

        If you type in the value "null" instead of selecting the check box, the query treats the value as a string and the search returns only fields where there is a literal value of "null". Ex.: activity_type: "null"

        If you use the Empty (null) check box, the search returns fields where the value is empty. Ex.: activity_type: null

      • Click Add to Query to add the selected fields and values to the query in the search bar.

  4. When you are satisfied with your query, click outside of the panel to dismiss the Basic search panel. Click in an empty section of the search bar at any time to return to the Basic search panel.

  5. After your query has been built, it can still be edited.

    • To delete a term or field from the query, click the X next to it.

    • To change the operators used in the query, click on the operator in the search bar and select the operator you want to use (AND, OR, AND NOT, OR NOT).

    Note

    In the search bar you can only delete sections and change operators, you cannot edit the values you have assigned to fields. To do this, you must delete that field from the query, return to the Basic search panel, and re-add that field with your desired value.

  6. Select a time range for the search results by clicking the time range icon (icon-time-range.png) in the top left corner of the search bar. A dialog box opens where you can select various Quick, Relative, or Absolute time ranges.

  7. Click the Search icon (run-query.png) to launch your query.