AQL Query Mode: This mode includes all the features of the Basic Mode, as well as covers advanced search functionality using AQL operators, filters, and aggregation functions.

You can start a search in two ways:

• Natural language: Type -- and then your natural language search. See Search with Anomali Copilot for more information.
  

• AQL: Start typing to build an AQL expression. The search bar displays auto-complete suggestions to help you build a valid search query.

See Understanding the Search Bar to learn more about creating valid queries.

Schema Selection: You can query data using eventlog or ocsf schemas. If you do not specify a table prefix, eventlog is used by default. To use the OCSF schema, prefix your query with the "ocsf" case-insensitive keyword.

For example:

eventlog:

| where src = "192.168.1.10"

OR

eventlog | where src = "192.168.1.10"

OCSF:

ocsf | where src_endpoint.ip = "192.168.1.10"

After

Time Range: Select a relative range, quick range, or specify an absolute time range. The time period filter uses event time, which corresponds to the timestamp in the event log.

Notes:

• In the results table, event time is stored in UTC and adjusted to the web browser time zone.

• The default time range specified in the My Profile settings does not apply to Search.

: Click Search to issue the search. Click the icon next to to stop the search.

Hover the mouse over the button to view your AVC usage. See Anomali Virtual Compute for more information on how the framework measures your infrastructure usage as per your search.

AQL Generator: Use natural language to generate an AQL query.

• Click AQL Generator then enter a natural language prompt. At this point, the Search button changes to Generate AQL.

• Once you type your prompt, press Enter to generate the corresponding AQL query.

• Click Search to run the query.

To generate OCSF queries using AQL Generator, include the case-insensitive keyword "ocsf" in your natural language prompt. For example:

"Show me OCSF network activity from 192.168.1.10"

Saved Search: Review a list of recent saved searches. Select a search to load the query in the search bar and issue the search. See Saved Searches for more information.

Search History: Review a list of recent searches; select one to load the query in the search bar and issue the search. See Using Search History for more information.

Focus Tabs: Toggle between the following tabs:

• Learn AQL: In the left panel, enter Copilot prompts to convert natural language queries into AQL expressions. See Using Search Modes for more information.

  Alternatively, in the right panel, you can hover over the example query text and click Run to run one of the example AQL expressions.

• Result: Results appear in a paged table. Review results and use the UI tools to add filters to further refine your search and set fields to be displayed in visualizations. See Exploring Search Results and Refining Queries for more information.

• Visualization: After refining a query, toggle to the Visualization tab to select a visualization and configure its properties, prior to add it to a dashboard. See Using Search Modes for more information.

Search Tabs: Use one or more search tabs to launch a search query.

Basic Mode: Click Basic to use the structured query builder. The builder lets you select query components in any order and generate the corresponding AQL query, eliminating the need to manually write the query.

• Multifunction Search: Launch searches on datasets, lookup tables, or views.

• Ease of use: Browse event log data or lookup data.

• Increased efficiency: Browse, filter, and aggregate data without requiring AQL syntax knowledge.

• Flexibility: Toggle the AQL Mode tab to manually construct more detailed queries for specific use cases.

Basic Mode supports only a limited subset of filtering, aggregation, and sorting options. For more advanced functionality, see Using Search Modes for more information.

Dataset: Select a dataset to start a structured search on event log data, a lookup table, or a view. All conditions and operations apply to the selected dataset.

eventlog

Select to query event data using the eventlog schema with standard field names.

OCSF

Select to query event data using the OCSF Version 1.2 schema with nested object notation.

When you select the OCSF dataset, the OCSF Category and OCSF Class filters allow you to filter events by OCSF event categories and classes. See OCSF Schema Overview for more information about supported OCSF classes.

Query builder: Optionally select different components of the AQL query. Filter conditions appear first, followed by aggr, sort, and limit.

• Conditional statements: Add up to ten conditions by combining the where operator with the following:

  • a field on which the conditional statement is applied.

  • an operator (=, !=, contains, contains_ci, not contains, startswith, not startswith, endswith, >=, <=, >, <, isnull, isnotnull), with logical operators AND and OR.

  • a value assigned to the field. A value is not required for the isnull and isnotnull operators.

• Aggregation: Apply the aggr operator to add up to three aggregation functions, including avg, count, count_distinct, distinct, first, last, max, min, sum, var. Aggregation aliases must not contain spaces.

• Group By: Add the Group By clause on one or more of the columns in the dataset, view, or lookup table. The Group By operator:

  • is disabled by default.

  • can be used only if aggr is also added.

  • is removed if aggr is removed.

• Sort: Use the sort operator to specify up to three sort fields and order them in ascending or descending order.

• Limit: Apply a limit to control the number of results returned, using the limit operator.

• Output Fields: Choose which fields to display in the results. Only selected fields appear in the final output

Additionally, click Clear if you would like to clear the built structured query.

Time Range: Select a relative range, quick range, or specify an absolute time range. The time period filter uses event time, which corresponds to the timestamp in the event log.

Notes:

• In the results table, event time is stored in UTC and adjusted to the web browser time zone.

• The default time range specified in the My Profile settings does not apply to Search.

: Click Search to issue the search. Click the icon next to to stop the search.

Hover the mouse over the button to view your AVC usage. See Anomali Virtual Compute for more information on how the framework measures your infrastructure usage as per your search.

AQL Generator: Use natural language to generate an AQL query.

• Click AQL Generator then enter a natural language prompt. At this point, the Search button changes to Generate AQL.

• Once you type your prompt, press Enter to generate the corresponding AQL query.

• Click Search to run the query.

To generate OCSF queries using AQL Generator, include the case-insensitive keyword "ocsf" in your natural language prompt. For example:

"Show me OCSF network activity from 192.168.1.10"

Saved Search: Review a list of recent saved searches. Select a search to load the query in the search bar and issue the search. See Saved Searches for more information.

Search History: Review a list of recent searches; select one to load the query in the search bar and issue the search. See Using Search History for more information.

Focus Tabs: Toggle between the following tabs:

• Learn AQL: In the left panel, enter Copilot prompts to convert natural language queries into AQL expressions. See Using Search Modes for more information.

  Alternatively, in the right panel, you can hover over the example query text and click Run to run one of the example AQL expressions.

• Result: Results appear in a paged table. Review results and use the UI tools to add filters to further refine your search and set fields to be displayed in visualizations. See Exploring Search Results and Refining Queries for more information.

• Visualization: After refining a query, toggle to the Visualization tab to select a visualization and configure its properties, prior to add it to a dashboard. See Using Search Modes for more information.

Search Tabs: Use one or more search tabs to launch a search query.

• Add up to a maximum of five search tabs.

• Switch between tabs at any time. The context of the tab is preserved even after you refresh the tab or switch between tabs.

• Double-click a tab name to rename it.

• Search using either the eventlog or ocsf schemas. See eventlog and OCSF Schema Overview for more information on eventlog and OCSF field naming and conventions, respectively.