Hunting Tutorial

Our searching and filtering capabilities give you the ability to quickly find all about your assets all in one place.

You'll notice the Search box while viewing dynamic lists of events, incidents, and assets. This is where you'll enter your search query.

Search box for events on Hunting tab.

Start typing and we'll show you properties (fields) that you can search like asset.localIPv4, file.path, etc. and scroll down to see all the fields.

Asset properties listed for a sample asset search query on the Hunting tab.

Select the one you're interested in. Check out the Syntax help for the selected field to the right to help with creating your query.

Enter the value you want to match. For this field you select from a list of predefined values. Then hit Enter.

A property selected from the list for sample query in search box on the Hunting tab.

That's it! Your matches will appear in the list your viewing. Filters on the left help you drill down to objects of interest.

Tip - Use your queries to create dashboard widgets on the Dashboards tab.

Click here for sample queries

List of matches shown for the search query on the Hunting tab.

You can use the Group By option to view count of events based on the selected option.

Group By