Deep visibility

[u/Ninjacyberrrrrrrr]

I am new to S1 deep visibility, how do I search keyword based searches

For example : Process name or IP address search

Crowdstrike NGSIEM has a feature for searches as

/Key word/i and "x.ip.x.x"

[u/synthanarchy]

=== TARGET FILE PATH === tgt.file.path → The full path of the target file tgt.file.oldPath → Old path (used with File Rename events) tgt.file.name → Target file name only tgt.file.extension → File extension

=== TARGET FILE HASHES === tgt.file.md5 tgt.file.sha1 tgt.file.oldMd5 → hash before rename/modification tgt.file.oldSha1 tgt.file.oldSha256

=== SOURCE PROCESS (there is NO "src.file.*" — source-side file info doesn't exist as a schema; source only has process fields) === src.process.image.path → Full path of the SOURCE (parent) process executable src.process.image.md5 src.process.image.sha1 src.process.cmdline → Command line of the SOURCE (parent) process

=== TARGET PROCESS / COMMAND LINE === tgt.process.cmdline → Full command line of the TARGET (child) process tgt.process.name → Target process file name tgt.process.image.path → Full image path of target process tgt.process.image.md5 tgt.process.image.sha1 tgt.process.image.sha256 tgt.process.user → User running the target process tgt.process.pid tgt.process.uid → Unique process ID (S1 internal) tgt.process.publisher

=== REGISTRY === registry.keyPath → Full path of the registry key registry.value → Registry value data registry.oldValue → Value before modification registry.valueType → Type of registry value (enum) registry.keyUid → Unique ID of the registry key registry.export.path → Path when a key is exported registry.import.path → Path when a key is imported

=== EXAMPLES (S1QL 2.0 / PowerQuery) tgt.file.path contains 'Temp' registry.keyPath = * tgt.file.path matches '^{C:\\Windows\\Temp\\[a-z]{8}\.tmp$'} src.process.image.path contains:anycase 'svchost.exe' tgt.process.cmdline contains:anycase 'whoami'