4.2.3.2 Search with Group Conditions
Multiple search conditions:
A search statement consists of the following elements: search object, field name, value, comparison operator, and logical operator, as shown in the following figure.
Example: Mining virus detection
Search Statement: (DNSEvents.domain = "xmr" AND DNSEvents.domain = "pool") OR (NetworkEvents.dst_port = "4444" OR NetworkEvents.dst_port = "5555" OR NetworkEvents.dst_port = "6666") OR (ProcessEvents.process_commandline = "stratum://" OR ProcessEvents.process_commandline = "cpu-priority")
Note:
The search query is not case-sensitive.
The query result is shown below.
Objects and fields
You can include the following objects in a set of conditions: Domain Name Access, Connection, Process Operation, File Operation, Loaded Module, and DeviceInformation. For details, see the following description: Domain name access fields:
Connection fields:
File operation fields:
Process operation fields:
Loaded Module fields:
Device information fields:
Values
The value of a field must be enclosed with a pair of quotation marks (" "). Wildcards are supported: You can use a wildcard to represent one or more characters in a value. You can use an asterisk (*) to substitute zero, one, or multiple characters. The wildcard * can only be used together with the comparison operators "=" (equal) and "!=" (not equal).
Example: You can use mon* to represent the word "mongodb" or "mondodb".
Comparison operators:
Logical operators:
The log lookup system supports three operators: AND, OR, and NOT .
-
AND : AND means that both fields must be matched.
-
OR : OR means that at least one field must be matched.
-
NOT : NOT excludes the records containing a single item or phrase following the NOT operator.
