Search Commands Quick Reference

All Commands at a Glance

Aggregation & Statistics

Filtering & Selection

Field Operations

Ordering & Formatting

Enrichment & Analysis

Pattern Detection

Subsearch Operations

Common Query Patterns

Detection Rules

# Brute force detection
action=login status=failure
| bin span=10m
| stats count() by time_bucket, src_ip
| where count > 5

# Data exfiltration
* | bin span=5m
  | stats sum(bytes_out) as outbound by time_bucket, src_ip
  | where outbound > 100000000

# Port scanning
* | bin span=1m
  | stats dc(dest_port) as unique_ports by time_bucket, src_ip
  | where unique_ports > 50

Investigation

# Asset investigation
src_host="workstation-42" | asset

# User activity timeline
user="john.doe"
| timechart span=1h count() by action

# Rare file execution
file_hash=*
| prevalence hash_prevalence < 5
| table timestamp, file_hash, process_name, src_host

# Anomalous behavior
* | anomaly field=bytes_out by user threshold=3
  | where is_anomaly=true

Threat Hunting

# Lateral movement
action=login
| transaction user maxspan=1h
| where eventcount > 5 AND dc(src_host) > 3

# Privilege escalation chain
* | sequence by user maxspan=30m
    [privilege="user"]
    [action="privilege_escalation"]
    [privilege="admin"]

# Process tree investigation
source_type=sysmon action=process_create src_host="SUSPICIOUS-HOST"
| tree process

# PowerShell execution chain with prevalence
source_type=sysmon action=process_create
| tree process root="/powershell|pwsh/"

# Web session flow analysis
source_type=squid_proxy user="suspicious_user"
| tree web

# Enrich with external threat feed
* | inputlookup url="https://api.threatfeed.io/{src_ip}" key=src_ip
  | where inputlookup_risk_score > 80

# Correlate with subsearch
* | join type=inner src_ip [search action=suspicious | table src_ip]

Aggregation Functions

Counting: count(), dc(field) Math: sum(field), avg(field), min(field), max(field) Stats: median(field), percentile(field, N), perc95(field), stdev(field), var(field) Lists: values(field), list(field), mode(field) Time: earliest(field), latest(field), first(field), last(field) Visualization: sparkline(field) Other: range(field)

Eval Functions

String: lower(), upper(), substr(), replace(), trim(), len(), split(), concat() Math: abs(), ceil(), floor(), round(), sqrt(), pow(), log(), exp() Type: tonumber(), tostring(), tobool() Conditional: if(), case(), coalesce(), nullif() Time: now(), strftime(), strptime(), time() Network: is_private_ip(), is_public_ip(), cidr_match() Crypto: md5(), sha1(), sha256() Encoding: base64_encode(), base64_decode(), hex_encode(), hex_decode(), url_encode(), url_decode() Security: entropy(), defang(), refang() Domain/URL: extract_domain(), extract_tld(), extract_path() Infix Operators: CONTAINS, LIKE (usable inside eval expressions, e.g. if(cmd CONTAINS "-enc", 1, 0))

Boolean Functions (in where)

isnull(field), isnotnull(field), like(field, pattern), match(field, regex), cidrmatch(cidr, field)

Operators

Comparison: =, !=, >, <, >=, <= Pattern: LIKE, NOT LIKE, CONTAINS, STARTSWITH, ENDSWITH Regex: =/pattern/, !=/pattern/ List: IN, NOT IN Logical: AND, OR, NOT

Time Durations

Seconds: 30s Minutes: 5m, 15m, 30m Hours: 1h, 6h, 12h Days: 1d, 7d, 30d Weeks: 1w, 4w

Performance Tips

1. Filter early - Use search expressions before pipes
2. Limit results - Use head/tail when exploring
3. Aggregate - stats is faster than returning raw events
4. Index fields - Use indexed fields in search expressions
5. Avoid wildcards - Specific filters are faster
6. Bin before stats - For time-windowed detection
7. Dedup wisely - Can be memory-intensive
8. Sample for testing - Use sample when developing queries