Back to top
Secure60 Platform has a simple and flexible query language that is used in various parts of the platform. The query syntax allows selection of specific fields, matching of partial text, regex and vairous comparison operators. The syntax also allows grouping of conditions to achieve sophisticated matching rules.
Query sytax is used in the following key system components:
condition statement that is a query in the Secure60 query syntaxSecure60 supports flexible open search functionality that allows you to search for terms across multiple fields without specifying individual field names. This provides a quick and intuitive way to find relevant events.
Single Term Search:
error - Searches for “error” across all default fieldsMultiple Terms (AND logic):
error timeout - Searches for events containing both “error” AND “timeout” across all default fieldsExact Phrase Search:
"disk full" - Searches for the exact phrase “disk full” across all default fieldsCombining with Field Queries:
error AND user_name = 'admin' - Combines open search with specific field queries(login failed) OR ip_src_address = '192.168.1.100' - Uses grouping with open searchBy default, open search queries are executed across the following fields for optimal performance:
message_text - Log message contenthost_name - Source hostnameip_src_address - Source IP addressip_dst_address - Destination IP addressuser_name - Username associated with the eventOn-premise and custom deployments have additional configuration options available:
Contact your system administrator for information about available configuration options in your deployment.
Secure60 supports two main query types:
A basic traditional field query looks like: fieldname operator value
ip_src_address = '43.53.63.62'Multiple basic query elements can be joined together with a keyword
ip_src_address = '43.53.63.62' AND host_name = 'testserver4.example.com'Query component evaluation can be controlled by using grouping
(ip_src_address = '43.53.63.62' AND host_name = 'testserver4.example.com') OR (ip_src_address = '8.8.8.8')Query element using regex and searching in a case insensitive manner
ip_geo_city_name ~ '(?i)melbourne'fieldnameoperator= Exact match!= Not match: Contains - Partial text match
% indicates an arbitrary number of arbitrary characters (including zero characters)._ indicates a single arbitrary character.\ is for escaping literals %, _ and \!: Not Contains - Partial text not match< or <= Less than or Less than equal to> or >= Greater than or Greater than equal to~ Regex search (Not available in Streaming Rules)
value:) then can include % symbol to indicate wildcard for rest of text stringb(or start)~``) then can include re regex syntax`Instead of a fieldname we make a number of functions available to enhance query feature set
Usage of a function is to state the function, if data evaluates to true then results from this function will be included
Function List (Not available in Streaming Rules):
isField('fieldname') - Used to look for the presence of a specific field (with any value)
fieldname - Any valid Secure60 fieldname!isField('fieldname') - Used to exclude a specific field (with any value)isIPAddressInRange('fieldname', 'prefix')
fieldname - Any valid Secure60 fieldnameprefix - String IP address with subnet (Eg. 127.0.0.0/24)!isIPAddressInRange('fieldname', 'prefix') - Used to exclude an IP address from matchingisInList('list_id', 'fieldname') - Applies filtering logic to the query to only return results that have a match between the fieldname provided and a List Item in the list_id provided.
fieldname - Any valid Secure60 fieldnamelist_id - Any valid List ID!isInList('list_id', 'fieldname') - Applies filtering logic to the query to exclude results that have a match between the fieldname provided and a List Item in the list_id provided.
fieldname - Any valid Secure60 fieldnamelist_id - Any valid List IDisEntity('entity_name') - Returns all activity belonging to a registered entity, matched across every identifier recorded against it.
entity_name - The entity’s name, exactly as shown on the Entities page (e.g. Host 2)isEntityGroup('group_name') - Returns all activity belonging to any member of an entity group.
group_name - The group’s name, exactly as shown on the Entities pageNotes on isEntity:
The value is the entity’s name, not one of its identifiers. isEntity('Host 2') is correct; isEntity('192.1.2.44') will not match, even if that IP is one of its identifiers.
The point of the function is that you do not need to know how an entity happens to be recorded in each log. A host registered with a hostname and an IP is matched by both host_name='web-01' events and ip_src_address='10.1.2.3' events from a single isEntity('Web 01').
Matching is done against the identifiers you register on the entity, compared against these log fields:
| Entity type | Fields matched |
|---|---|
| Host | host_name, ip_src_address |
| User | user_name |
| Application | app_name |
An identifier only matches if its value appears in one of those fields. Registering a MAC address or an FQDN identifier, for example, will only match where that value is present in host_name.
Entity names are not required to be unique. If two entities share a name, activity for both is returned.
Newly created entities, and new identifiers added to an existing entity, take up to a minute to become searchable.
Notes:
isInList can also be applied via the parameters list_allow_field and list_allow_id for example. See:
Use Open Search when:
Use Traditional Field Queries when:
Open Search Examples:
failed login - Find any events mentioning failed logins"connection timeout" - Find exact phrase across all fieldsmalware AND ip_src_address = '10.0.0.1' - Combine approachesTraditional Field Query Examples:
user_name = 'admin' - Exact user matchevent_count > 100 - Numeric comparisonip_src_address : '192.168.%' - IP subnet search with wildcardsprocess_target_image ~ '\lsass.exe$'process_target_image ~ '\\\lsass.exe$'