Search syntax

The Requests page lists individual requests that have been tagged with signals and that fit into the all or sampled data storage category. You can use the search bar and filter menus to narrow this list.

Filter menus

You can select values from the filter menus to find requests that meet specific criteria. Selected values auto-populate in the search bar where you can further modify the query. Filter options include:

• Time: filters the requests list based on when the requests were sent. For example, when 2 hours is selected, only requests that were made in the last two hours appear on the page.
• Attack signals: filters the requests list based on the attack signals that requests are tagged with. For example, when Attack Tooling is selected, only requests tagged with the Attack Tooling signal appear on the page.
• Anomaly signals: filters the requests list based on the anomaly signals that requests are tagged with. For example, when Address Changed is selected, only requests tagged with the Address Changed signal appear on the page.
• Response codes: filters the requests list based on the response codes associated with requests. For example, when 404 is selected, only requests with a 404 response code appear on the page.

Search bar

You can enter free-text and explicit queries into the search bar to find requests that meet specific criteria. Explicit queries follow the <key><operator><value> syntax, where:

• the key is the field to search upon.
• the operator defines the relationship of the key to the value.
• the value is the specific value used to filter the requests list.

Example free-text and explicit queries are as follows:

Keys

The keys that you can search on are as follows:

Operators

When using operators, keep in mind the following:

• All values below can be quoted to allow for spaces.
• Adding - (minus) before any key negates the operation.
• Different key names function as an AND operator (from:-1h path:/foo).
• Multiple keys with the same name function as an OR operator (path:/foo path:/bar should return paths matching either /foo or /bar).

Supported operators include:

Time

Time ranges can be specified in a number of ways using the from and until keys.

Queries on the Requests page are limited to a maximum time range of 7 days. Queries greater than a 7 day period will not yield any results. For example, if you wanted to find results from 2 weeks ago, your query would need to use from:-21d until:-14d, which would be a 7 day window. A query of just from:-21d would not yield any results as that would be a 21 day window.

Relative time

Example:

• from:-5h (until now)
• from:-5h until:-4h (one hour range)

Absolute time

Absolute time is also allowed using

• Unix UTC Seconds Since Epoch
• Java/JavaScript UTC Milliseconds since Epoch
• ISO Date format YYYYMMDD

Example Absolute Time: Unix UTC Seconds

• from:141384000 (until now)
• from:141384000 until:1413844691

Example Absolute Time: Java/JavaScript Milliseconds UTC

• from:141384000000 (until now)
• from:141384000000 until:1413844691000

Example Absolute Date: YYYYMMDD

• from:20141031 (until now)
• from:20141031 until:20141225

You can also mix and match time formats:

• from:20141031 until:-1h