Home

Searching for Events

Use the search tokens below to search for events when Container Runtime Security (CRS) is enabled for your subscription. Looking for help with writing your query? click here

customerUuid

Use a text value ##### to define a customer UUID of interest.

Example

Show events for this customer UUID

customerUuid: 6e0afd12-479c-db0d-822a-793a56bfe353

containerSha

Use a text value ##### to define a container SHA of interest.

Example

Show events for this container SHA

containerSha: 368ab5ebbccb9d17d45cf62f6fa289edade4af81ef5a94e04a4406a1904175d

eventType

Use a text value ##### to find events by the event type (STANDARD, BEHAVIOR).

Example

Show events with STANDARD type

eventType: STANDARD

uuid

Use a text value ##### to define a UUID of interest.

Example

Show events with this UUID

uuid: 70b0dd00-cde7-11ea-8000-a130bd09cb71

dateCreated

Use a date range or specific date to define when events were created.

Examples

Show events created within date range

dateCreated: [2020-06-15 ... 2020-06-30]

Show events created starting 2020-08-01, ending 1 month ago

dateCreated: [2020-08-01 ... now-1M]

Show events created starting 2 weeks ago, ending 1 second ago

dateCreated: [now-2w ... now-1s]

Show events created on specific date

dateCreated:'2020-08-15'

action

Use a text value ##### to find events by the action (ALLOW, DENY, MONITOR).

Example

Show events with ALLOW action

action: ALLOW

bindAddress

Use a text value ##### to find events with a certain bind IP address.

Example

Show events with this bind IP address

bindAddress: 10.44.92.127

bindPort

Use an integer value ##### to find events with a certain bind port.

Example

Show events with this bind port

bindPort: 8080

fileName

Use a text value ##### to find events for a particular file name.

Example

Show events for this file name

fileName: /etc/passwd

openMode

Use an integer value ##### to find events with a certain open mode value.

Example

Show events with this open mode

openMode: 577

processId

Use an integer value ##### to find events by the process ID.

Example

Show events with this process ID

processId: 42

processName

Use a text value ##### to find events by the process name.

Example

Show events with this process name

processName: /usr/bin/cat

seen

Use an integer value ##### to find events by the seen value.

Example

Show events with this seen value

seen: 1

system

Use a text value ##### to find events by the system.

Example

Show events for this system

system: amd64

systemCall

Use an integer value ##### to find events by the system call numeric value.

Example

Show events with this system call

systemCall: 2

systemCallName

Use an integer value ##### to find events by the system call name.

Example

Show events with this system call

systemCallName: sys_open