turbosearch

Use the turbosearch operator for:

  • Forensic and retrospective searches on large datasets

  • Threat hunting

  • Needle in a haystack scenarios

When Schema RBAC is active for your organization, the schema filters in your assigned roles determine which data this feature returns. An eventlog filter limits your results to only the eventlog data your role permits, and an OCSF filter limits your results to only the OCSF data your role permits. If a query runs against a schema for which your role has no filter assigned, the query returns a forbidden error. For details, see Role-Based Access Control for Schemas.

Syntax

Note: retrosearch is an alias of turbosearch and has the same behavior.

keyword-based:

|turbosearch "<value>"

|turbosearch "<value>" [, "<value1>", "<value2>",...]

field-based:

|turbosearch <key>=<value>

|turbosearch <key>=<value> [, <key1>="<value1>", <key2>="<value2>",...]

lookup table-based:

|turbosearch [<your_lookup_table> | fields <your_field_name>]

Usage

You can use the purpose-built turbosearch operator to issue a retrospective search, that includes both keyword- and field-based search queries.

You can also combine this operator with all other search operators, including support for logical operators AND, OR, and IN. See Examples for more information.

Note: When you use the turbosearch operator with other operators, you must specify it as the first operator in the search query. All other operators must be chronologically placed after turbosearch.

"<value>"

Specify the value on which you would like to issue a retrospective search, enclosed either in single or double quotes. The argument is not case sensitive. Currently, you can search on the values for the following indicator types:

  • IP Addresses: [src_ip, dest_ip, src, dest]

  • Domains: [src, dest, query]

  • File hashes: [file_hash, file_hash2, file_hash3]

  • Email addresses: [sender, receiver]

  • URLs: [url, http_referrer]

turbosearch also supports searches on the following fields:

  • user

  • host

  • file_name

  • account_id

  • dvc_name

  • message_id

If the list of IOCs exceeds 20 indicators, turbosearch will automatically turn this search into a background job. See Job Tracking to understand how you can monitor the status of this background job.

Note: Out of the box, turbosearch supports the fields listed above. However, if you require additional fields from the eventlog schema, contact Anomali Support to enable those for your need.
[, "<value1>", "<value2>",...,"<valueN>"]

Optional. Specify one or more values on which to issue a search. Enclose the values in single or double quotes.
|turbosearch [<your_lookup_table> | fields <your_field_name>]

Provide a lookup table that has one or more IOCs. Turbosearch will automatically turn this search into a background job. See Job Tracking to understand how you can monitor the status of this background job.

Example: |turbosearch [example_lookup_table | fields example_lookup_table_field]

In the example query above, turbosearch searches the eventlog data against the example_lookup_table lookup table, that contains indicators, and the example_lookup_table_field field in this lookup table, and then triggers a background job that automatically saves the result into a new lookup table.

Examples

Basic examples

Example 1: Search for a keyword by IP address.

Copy 
|turbosearch "1.2.3.4"

Example 2: Search for a field-based indicator using IP address syntax.

Copy 
|turbosearch src_ip = '1.2.3.4'

Example 3: Search for an email address field value.

Copy 
|turbosearch sender='sender_example@example.com'

Example 4: Search for a keyword by URL value.

Copy 
|turbosearch "https://www.example-url.com/feed"

When combined with other operators

Example 5: Search by IP address and filter results by specified fields.

Copy 
|turbosearch "1.2.3.4" | fields action, src , dest | limit 100

Example 6: Search by IP address and hostname with multiple field criteria.

Copy 
|turbosearch src_ip = "1.1.1.1" and host = "MX56WAB671"| fields action, src , dest | limit 100

Example 7: Search by hostname or user with multiple values.

Copy 
|turbosearch host = "CD12WRT101" or user in ("<foo1@bar1.com>", "<foo2@bar2.com>”)

Example 8: Search by multiple indicators and aggregate by source type.

Copy 
|turbosearch "tech@threatstream.com", "examplefilehash" | aggr count (sourcetype) as srctype_count

Example 9: Search by URL and filter results by source type values.

Copy 
|turbosearch 'https://www.example-url.com' | where sourcetype contains ("aws", "cloud", "vpc")

Example 10: Search using a lookup table containing indicators.

Copy 
|from table threat_indicators | turbosearch indicator

Using turbosearch with OCSF

The turbosearch operator supports OCSF queries. Prefix your query with ocsf and use the same turbosearch syntax to perform retrospective searches on OCSF event data.

Syntax:

Copy 
ocsf | turbosearch "<value>"

Example: Search OCSF Network Activity events for a specific IP address.

Copy 
ocsf | where category_name = "Network Activity" | turbosearch "10.0.0.1"

When OCSF RBAC enforcement is enabled, turbosearch respects the OCSF filter defined in the user-assigned role. Results are automatically constrained to the OCSF categories the user has permission to access. If your account does not have an OCSF role assigned, OCSF queries return an ocsf is forbidden error. Contact your organization administrator to have an OCSF role assigned. See Role-Based Access Control for Schemas for more information.