Learn more about the Cortex Query Language search stage that searches for free-text strings.
Syntax
search "<free_text1>"[,"<free_text2>", ...]
Description
The search stage searches for free text strings in the datasets that are stored in your Cortex XSIAM tenant. Consider the following information:
searchshould be the first stage in the query. Only theconfigstage can precedesearch.You can refine the search to specify datasets.
Only datasets are supported. You can't refine by preset or search the Cortex Data Model (XDM) schema.
Note
If you do not specify a dataset in the query, Cortex XSIAM searches all of the existing datasets on your tenant.
Free text search searches the relevant columns in each dataset. Relevant columns are subject to a change and can vary between datasets.
When more than one dataset is included in the search, a new column called
raw_datais displayed in the Query Results table. This column lists all the fields from the original datasets schema, which you can use to drilldown to specific data in your queries.Queries containing
searchdo not support thebin,comp,top, ordedupstages.Queries using the
searchstage are limited to the last 90 days of data. Specifying a time frame outside of this limitation will cause the query to fail.
Examples
Returns instances of "MacOs" in the endpoints dataset.
search "MacOs" dataset = endpoints
Returns instances of "MacOs" or "failed" in the endpoints and agent_auditing datasets.
search “MacOs”,“failed” dataset in (endpoints, agent_auditing)