Timeline filtering help

The timeline can be filtered thanks to simple queries. The query schema is : target_element:search_value AND target_element2:search_value2.
There is no OR condition and searching without target does not work.

The following target elements can be used to filter :

  • asset: Asset linked to the event
  • ioc: IOC linked to the event
  • tag: Tag within the event
  • title: Title of the event
  • description: Description of the event
  • raw : Raw event content
  • category: Category of the event
  • source: Source of the event
  • startDate: Start date to filter with
  • endDate: End date to filter with
The dates filters uses the same guessing as the date parser in events, so a lots of format are handled.
Example of filter : asset: DESKTOP-X5487 AND description: rdp connection to AND source: Windows Security