Searching Cases and logs

There are three fields for searching information within eyeAlert:

• The Search field, which is always accessible in at the top of the UI. This general search field searches for the information specified in the field across the entire platform.

• The Search Cases field on the Cases screen, which allows users to focus their search specifically on cases and enables case-sensitive string searches on the following detail fields:
  • id (exact match)
  • title (exact match)
  • description (partial & exact match)
  • entity_id (exact match)
  • customer_entity_id (partial & exact match)
  • comments (partial & exact match)

• Selecting Kibana or Xplorer under the Logs menu, which presents a dedicated search function that focuses only on delivering results from available ingested log data. Use one of these search methods to investigate the logs ingested by to verify security incidents and troubleshoot suspected problems.

The Logs screen provides a diverse set of tools for investigating and exploring the logs ingested by from various Data Sources. It presents two search query methods under the logs menu - Kibana and Xplorer.

Kibana

Kibana searches are ideal for returning full granular details (entire log records) for a specific a point of interest.

Xplorer

Xplorer searches are ideal for finding instances of data that occur in the logs many times over a long span of time, presented as an aggregated data report.