Guidelines for Search

Anomali recommends the following guidelines to optimize your Search experience.

Search Throttling

If the total number of bytes scanned across all your search queries exceeds 50 TB from the start of a given day (in UTC), your search time range for any additional queries will be limited to a 24-hour window until the end of that day (in UTC). This limit will reset the following day.

For example, if by Monday, 1:00 PM UTC, 12 of your search queries add up to 50 TB of scanned data, then your search time range will be limited to a 24-hour window till Tuesday 12:00 AM UTC, after which the limit resets.

Users, Roles, and Role-based Search

  • By default, every search can span data that is 90 days old.

  • Organization Administration can configure the Max search time range parameter to limit the search range, while creating or updating a role. See User and Role Management on the Anomali Platform for more information

  • If you are assigned more than one role, the highest search range will apply. For example, if you are assigned role A that is configured with a search range of 6 months and role B that has a two-year range, then you will be able to search up to two years back in time.

  • You will encounter an error if you select a search range higher than the range configured for your role. In such a case, you will either have to:

In the example above, if your org administrator has configured 10 days as the maximum search range for your role, you will encounter an error if you try to search event logs in the last 11 days.

Recommended actions

  • Select a search range that is lesser than or equal to the range assigned to your role by your organization administrator.

  • Contact your organization administrator to be assigned a different role that supports a higher search range.

  • Use Turbosearch if you necessarily need a search range higher than the range assigned to your role by your organization administrator and if you cannot be assigned a different role with higher search range.

See User and Role Management on the Anomali Platform for more information on how role-based access works on the Anomali platform.

In addition to the eventlog access controls described above, organization administrators can define OCSF-specific data filters in user roles to restrict access to particular OCSF categories. See Role-Based Access Control for Schemas for more information.