Run an analyzed log search

Data Explorer allows you to search through analyzed logs from all ingested log sources. You can:

Before you begin

  • You must have a valid Data Explorer license.

    For more information, see Data Explorer license options.

  • If you are an MSP, you must be assigned the Datenerkundung role in the MSP Portal.

    For more information, see User Management.

Run a predefined search

  1. Melden Sie sich bei Arctic Wolf Unified Portal an.
  2. Klicken Sie im Navigationsmenü auf Datenerkundung > Datenerkunder.
  3. Optional: In the Date Range boxes, click Calendar to select a time range.
  4. In the Load Query (Optional) list, select a preset or saved custom query.
    After selecting a query from the Load Query (Optional) list, predefined values are added to the Query Builder.
  5. Click Run Query .

  6. Optional: Complete any of these actions:

Create and run a query

  1. Melden Sie sich bei Arctic Wolf Unified Portal an.
  2. Klicken Sie im Navigationsmenü auf Datenerkundung > Datenerkunder.
  3. Optional: In the Log Sources section, select one or more log sources to scope your search to specific data.
  4. Optional: In the Date Range boxes, click Calendar to select a time range.
  5. In the Query Builder section, use operators to define a dataset.
    For more information, see:
    Tip: You can start by loading a predefined query into the Query Builder. In the Load Query (Optional) list, select a predefined query. Then, modify the query as desired.
  6. Optional: Add a regex template to your query:
    Note: Arctic Wolf® uses RE2 and Java regex engines. Support for Lucene regex expressions is not available.
    1. In the Data Explorer section, click Regex Templates.
    2. In the Search templates box, filter and search for a regex template, such as IP address, and then select the desired regex template.
    3. Click Use in Query.
      Tip: Click Copy Pattern to manually insert the regex pattern into a query.
    4. In the Select a Field dialog, select the field for the regex template, and then do one of these actions:
    1. Click Insert into current query to insert the regex template into your current query.
    2. Click Start new query to copy the regex template and start a new query.
      Note: This action removes any Data Explorer and operator fields you previously selected.
  7. Click Run Query .
    Search results appear in a table.

    If your search included a field set, one or more widgets might appear in the Available Data Visualizations section.

  8. Optional: Complete any of these actions: