@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
md 114 lines 4.22 KB
Rendered Raw
1 ---
2 title: Event Search
3 description: Search and explore raw SIEM events across customers and event sources using Lucene queries.
4 ---
5
6 # Event Search
7
8 **Menu:** SIEM → Event Search
9
10 **Best for:** Operators + Analysts
11
12 Event Search lets you query **raw SIEM events** directly from the Wazuh Indexer across any configured [Event Source](/user/ui/siem-event-sources). Use it for investigation, threat hunting, and validating detection coverage.
13
14 ![Event Search page](../../assets/ui/siem-event-search.png)
15
16 ---
17
18 ## Prerequisites
19
20 Before using Event Search, a customer must have at least one **Event Source** configured. If no Event Sources exist for the selected customer, a warning banner will appear with instructions.
21
22 See: [Event Sources](/user/ui/siem-event-sources) for setup instructions.
23
24 ---
25
26 ## Step 1 — Select a customer and event source
27
28 Use the filter bar at the top to select:
29
30 1. **Customer** — the tenant whose data you want to query
31 2. **Event Source** — the specific data source (e.g. Wazuh EDR, Office 365 Logs)
32 3. **Time Range** — how far back to search (1 hour to 30 days)
33 4. **Page Size** — number of results per page (25–250)
34
35 ---
36
37 ## Step 2 — Write a Lucene query (optional)
38
39 The search bar supports full **Lucene query syntax**. If left empty, all events in the time range are returned.
40
41 **Example queries:**
42
43 | Query | What it finds |
44 |---|---|
45 | `agent_name:web-server-01` | Events from a specific agent |
46 | `rule_level:>=10` | High-severity alerts (level 10+) |
47 | `agent_name:dc01 AND rule_level:>=8` | Combined filters |
48 | `rule_description:"brute force"` | Phrase match in rule description |
49 | `NOT agent_name:test-*` | Exclude test agents |
50
51 ### Field name autocomplete
52
53 As you type a field name, an autocomplete dropdown appears showing matching field names from the selected index. Press **Tab** to accept a suggestion.
54
55 ---
56
57 ## Step 3 — Review results
58
59 Results appear in a sortable table with these columns:
60
61 | Column | Description |
62 |---|---|
63 | **Timestamp** | When the event occurred |
64 | **Source** | The agent or source that generated the event |
65 | **Rule** | The rule description or ID that triggered |
66 | **Level** | Severity level (color-coded: red ≥12, orange ≥8, blue ≥4) |
67 | **Summary** | The full log message or event data |
68
69 Click any row to open the **Event Detail** drawer.
70
71 ### Loading more results
72
73 If more events exist beyond the current page, a **Load More** button appears below the table. Click it to fetch the next batch of results.
74
75 ---
76
77 ## Step 4 — Inspect event details
78
79 Clicking a row opens a side drawer showing **every field** in the event, sorted alphabetically.
80
81 ![Event detail drawer](../../assets/ui/siem-event-search-detail.png)
82
83 ### Filter from the detail drawer
84
85 Hover over any field to reveal two action buttons:
86
87 - **Filter (+)** — adds `field:"value"` to your query and re-runs the search
88 - **Exclude (−)** — adds `NOT field:"value"` and re-runs the search
89
90 This lets you quickly drill down or exclude noise without manually typing queries.
91
92 ---
93
94 ## Deep-linking from Incident Management
95
96 When viewing an alert asset in **Incident Management → Alerts**, the `alert_linked` field includes a **"View in Event Search"** link. Clicking it opens Event Search in a new tab with the customer, default EDR source, and Lucene query pre-populated to find the specific alert.
97
98 ---
99
100 ## Tips
101
102 - **Broad first, then narrow:** Start with a wide time range and no query, then use the detail drawer's filter buttons to progressively refine.
103 - **Use wildcards sparingly:** Lucene supports `*` and `?` wildcards in values, but leading wildcards (e.g. `*server`) are expensive — avoid them on large indexes.
104 - **Check the time range:** If you're not finding expected events, try expanding the time range — the default is 24 hours.
105 - **Bookmark queries:** The URL contains query parameters (`customer_code`, `source_name`, `query`), so you can bookmark or share a specific search.
106
107 ---
108
109 ## Related pages
110
111 - [Event Sources](/user/ui/siem-event-sources) — configure which indexes to search per customer
112 - [SIEM Alerts](/user/ui/alerts-siem) — high-level alert summaries from Graylog
113 - [MITRE ATT&CK](/user/ui/alerts-mitre) — technique-centric alert view
114 - [Incident Alerts](/user/ui/incident-alerts) — the analyst investigation queue