Page Comparison

...

Additionally, you need to have alerts assigned with at least View access (see Assign resources to a role).

About time ranges and filters

...

...

1. Click Advanced filter at the top and a menu opens below.

2. Select a value in the field you want to use as filtering criteria.

   • Most of the fields admit several options. This will find alerts that match one or the other.

   • Several fields can be used at the same time. This will find alerts that match all of them.

   • All fields admit typing to narrow down the available values for selection.

   • Fields such as Name or Subcategory provide an option to select all values.

   • To remove a value, simply click the X next to it. To remove all values within a field, click the X located on the right side of the field.

3. Click Apply when you finish choosing the filtering criteria. All the filters applied appear below the button, and the alerts will be filtered accordingly.

   • To reset all filters, click Clear all.

   • To reset filters per field, click the X next to each of them.

   • To reset filters per value, you need to edit the filtering by reopening the menu, removing the desired values as explained above, and clicking Apply.

...

Filter by Extradata

You have two different options when using this filter, each of them designed for different contexts. The Simple option is best used for swift and extensive searches, whereas the Advanced provides more precision and control over the filtering criteria, allowing for more thorough searches.

Simple: this mode allows you to enter a value to verify if it’s present anywhere within any Extradata, retrieving alerts that contains such a value (case insensitive). It is a basic yet powerful filter, as it allows you to operate without a profound knowledge on the Extradata. However, it has the limitation that only one value can be used at a time. If you want to use several values, you can use the advanced mode.

...

Advanced: this mode allows you to enter several values (up to 10) and the keys where these values will be searched, as well as establish different operators for the value search or decide if they will be combined or considered individually.

...

{ "alertMitreTechniques": "Brute+Force",
  "alertType": { "id": "12", "type": "Detection"},
  "alertMitreTactics": "Credential+Access",
  "count": "12" }

• Add filter condition: click this button to open a menu where you can specify what, where, and how to look for.

  • Key: the field of the Extradata where you want to search for matches. Simply write the name of the desired field (in the example above, a valid field could be count).

  • Operator: how the specified value will be considered when searching for matches. Simply click the dropdown and select one of the options.

    • Contains (->>) → case insensitive: the chosen key will be examined to verify the presence of the specified value, retrieving the alert when it is. For example, using "count contains 1” would successfully retrieve the alert in the example above because 1 is present within 12.

    • Not contains (not(->>)) → case insensitive: the chosen key will be examined to verify the presence of the specified value, retrieving the alert when it isn’t. For example, using "count not contains 1” would not retrieve the alert in the example above because 1 is present within 12.

    • Equals (=) → case sensitive: the chosen key will be examined to verify if it coincides with the specified value, retrieving the alert when it does. For example, using "count equals 1” would not retrieve the alert in the example above because 1 is different from 12.

    • Not equals (!=) → case sensitive: the chosen key will be examined to verify if it coincides with the specified value, retrieving the alert when it doesn’t. For example, using "count not equals 1” would retrieve the alert in the example above because 1 is different from 12.

  • Value: the value you want to use to search for matches. Simply write the desired value.

• AND vs OR: when you specify several filter conditions, this dropdown is enabled, allowing you to decide how to combine them.

  • AND: choosing this option will combine the conditions, retrieving alerts only when both of the conditions are met. For example, using “count equals 12” AND “alertMitreTactics contains Initial“ would not retrieve the alert in the example above because only the count condition is met.

  • OR: choosing this option will consider the conditions individually, retrieving alerts when any of the conditions are met. For example, using “count equals 12” OR “alertMitreTactics contains Initial“ would retrieve the alert in the example above because the count condition is met.

Search triggered alerts by ID

...