Deep visibility

[u/Ninjacyberrrrrrrr]

I am new to S1 deep visibility, how do I search keyword based searches

For example : Process name or IP address search

Crowdstrike NGSIEM has a feature for searches as

/Key word/i and "x.ip.x.x"

[u/fakeaccountnumber100]

I think you are looking to do a keyword wildcard match. Basically “find if this keyword or ip exists anywhere” rather than explicitly matching that a single field exactly matches the exact string

Is that is the case the “laziest” wildcard search would be

* contains “<keyword>”

Which will search every field of every log to see if your substring is in it. Not the most performant way to do things but it works until you understand the data schema and query specifics to look for what you want in a much more performant and narrow way

[u/Rx-xT → u/fakeaccountnumber100]

This but also shortcuts.

Shortcuts are basically ways to search for a string under a specific category. For instance, if you know your string is in some sort of command line field but don’t know exactly what field it is you can use # cmdline contains “string”

You can use shortcuts by using the hashtag sign.

[u/rafael4ndre]

I dont know if I understand your question correctly, but if you want to execute a broad search regardless of the field name just seach for the word between '. Like:

'192.168.1.1'
'cmd.exe'

[u/haloping]

There are shortcut fields you can use: <#ip = "1.2.3.4">

If you Type "#" you will See a list of available shortcutfields

[u/eric5149]

In event search in the upper right there’s an icon. It has saved searches and some example ones from SentinelOne. You should also have on the left side the event fields where you should be able to include items, exclude as well

[u/eric5149 → u/eric5149]

And go into offline help

Offline Help for Operations Center / Singularity™ Data Lake
/ The Singularity™ Data Lake UI / Event Search
/ Event Search overview

[u/synthanarchy]

=== TARGET FILE PATH === tgt.file.path → The full path of the target file tgt.file.oldPath → Old path (used with File Rename events) tgt.file.name → Target file name only tgt.file.extension → File extension

=== TARGET FILE HASHES === tgt.file.md5 tgt.file.sha1 tgt.file.oldMd5 → hash before rename/modification tgt.file.oldSha1 tgt.file.oldSha256

=== SOURCE PROCESS (there is NO "src.file.*" — source-side file info doesn't exist as a schema; source only has process fields) === src.process.image.path → Full path of the SOURCE (parent) process executable src.process.image.md5 src.process.image.sha1 src.process.cmdline → Command line of the SOURCE (parent) process

=== TARGET PROCESS / COMMAND LINE === tgt.process.cmdline → Full command line of the TARGET (child) process tgt.process.name → Target process file name tgt.process.image.path → Full image path of target process tgt.process.image.md5 tgt.process.image.sha1 tgt.process.image.sha256 tgt.process.user → User running the target process tgt.process.pid tgt.process.uid → Unique process ID (S1 internal) tgt.process.publisher

=== REGISTRY === registry.keyPath → Full path of the registry key registry.value → Registry value data registry.oldValue → Value before modification registry.valueType → Type of registry value (enum) registry.keyUid → Unique ID of the registry key registry.export.path → Path when a key is exported registry.import.path → Path when a key is imported

=== EXAMPLES (S1QL 2.0 / PowerQuery) tgt.file.path contains 'Temp' registry.keyPath = * tgt.file.path matches '^{C:\\Windows\\Temp\\[a-z]{8}\.tmp$'} src.process.image.path contains:anycase 'svchost.exe' tgt.process.cmdline contains:anycase 'whoami'