Basic Search

Create, run, and refine Basic Search queries in the Vectra AI Platform (Respond UX deployments).

What is Basic Search?

Basic Search allows users to easily build queries into the metadata and logs the Vectra AI platform processes. Results can be organized as desired and columns can be added or removed. Results can also be exported as .csv. Search queires can easily be saved and run again in the future.

Basic search allows easy creation of search criteria by simply selecting the data source, data stream, time period, and filter criteria. The user does not need to know what fields are avialable in the data, they can simply pick them from the menu.

These queries can easily be converted to SQL queries for further modification.

Requirements

• A RUX deployment.

  • Basic Search is only available in Respond UX deployments.
  • If you are unsure of your deployment type, please see Analyst UX options (RUX vs QUX)
• In order to run a search, your Vectra entitlement must include metadata retention.

  • Please talk to your Vectra account team for if you would like to add metadata retention to your contract or expand the number of days of retention for your metadata.
• You must have data sources configured and collecting data.

  • This could be network data sources (Sensors) or Cloud data sources such as AWS, Azure, M365, Entra ID, etc.

How to create and run a query

1

Select the data source

• Log in to your Vectra tenant and navigate to Event Search and then click on Basic Search.
• Select the Data Source, Data Stream, and Connector you plan to investigate.

  • If your query is for Network metadata, you only need to select the Data Source and Data Stream.

2

Select the search period

Select the search period for your query.

3

Run the search

Click the Search button.

4

Review the results

The results view displays 10000 results, starting with the most recent events.

How to add or remove filters

1

Add a filter

Click the Add Filter button and select the field to use from the dropdown menu.

Filters can also be easily added by clicking the dropdown arrow by a data point.

2

Select an operator

Select the operator to use from the dropdown menu.

3

Enter a value

Enter the value, such as an IP address of interest, and click the check button to the right of the entered value field to add the filter.

4

Search

Click the Search button.

5

Remove a filter

To remove a filter, hover over the statement that contains the filter to be removed and click the X to the right of the filter.

Click the Search button again to run the search with the new parameters.

How to modify the query’s search period

The default search period for running queries is set to Last 6 hours.

Another critical timeframe to consider for metadata searches is the retention period. This period represents the maximum number of days that Vectra retains customer data. Please work with your Vectra account team to increase the retention period if required.

1

Select a search period

Click the time picker located to select the search period you want to use for the query.

You can choose from quick presets or a custom time range.

In the custom time range selector, you can see the days on the calendar that your current metadata retention allows. The greyed out days are not within your contracted retention period.

2

Search

Click the Search button. Only entries within the selected search period are displayed.

How to add, remove, and re-order columns in the results

1

Add columns

To add columns to the results, click Edit Columns and add or remove specific fields which will become columns in the search results.

The specific fields available will vary by data source and data stream.

2

Review added columns

The newly added column is added to the results.

3

Remove columns

To remove a column from the results view, click the X to the right of the column name, or use the Edit Columns option again.

4

Re-order columns

To re-order columns, drag and drop them into the desired order.

How to run a query from Instant Investigation

1

Investigate Further

In Instant Investigation of a host or account, you can click the Investigate further link to open a Basic Search that is centered on the entity in question

2

Continue the investigation

Once in Basic Search, the base search criteria will already be set for you to center on the entity in question. You can further refine the search from there. In the below example we drilled in from jump-station5, while already in the SMB-File activity Instant Investigation area.

Additional Features

Starting new queries, opening saved queries, and saving queries

• Use the area at the top right of the Basic Search screen

Downloading results

• Use the Download button above your search results.

Opening your query in SQL Search

• Click the Edit in SQL link next to the Search button.

Troubleshooting

There are cases in which a query cannot be completed for a variety of reasons. This section proposes actions to take that help avoid those situations.

“Search could not be completed” or “Search timed out”

In cases where the data sets to be retrieved are very large, the query may time out and you may see message like the above.

1

Reduce the search period

Reduce the search period for the query to one of the lower possible values.

2

Add a filter

Adding a filter can reduce the amount of results returned.

3

Repeat as needed

Depending on the size of your data set, you may need to repeat this sequence of steps—reduce the time frame and add filters—until you narrow the search down to the data you are looking for.

“Search could not be completed” (with error id)

In rare occasions, an error message is displayed indicating the search could not be completed, and an error ID is printed below the error message.

Please consider submitting a Support request indicating the error ID displayed for your query. Include a snapshot of the query as well.

“Something went wrong”

In rare occasions, an error message is displayed indicating something has gone wrong, and most likely the query cannot be triggered.

1

Check log flow

Check that metadata or logs are flowing successfully for the connector you are using.

To do that, click the Configuration → Data Sources and look at the data source in question to see the status of it.

2

Run the query again

Once logs are flowing, try to execute the query again.