Run an analyzed log search

Data Explorer allows you to search through analyzed logs from your ingested log sources. You can filter by log source, build custom queries, and create visualizations of your results.

Before you begin

  • You must have a valid Data Explorer license.

    For more information, see Data Explorer license options.

  • If you are an MSP, you must be assigned the Data Exploration role in the MSP Portal.

    For more information, see User Management.

Run a predefined search

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Data Exploration > Data Explorer.
  3. Optional: In the Date Range boxes, click Calendar to select a time range.
  4. In the Load Query (Optional) list, select a preset or saved custom query.
    After selecting a query from the Load Query (Optional) list, predefined values are added to the Query Builder.
  5. Click Run Query .

  6. Optional: Complete any of these actions:

Create and run a query

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Data Exploration > Data Explorer.
  3. Optional: In the Log Sources section, select one or more log sources to scope your search to specific data.
  4. Optional: In the Date Range boxes, click Calendar to select a time range.
  5. In the Query Builder section, use operators to define a dataset.
    For more information, see:
    Tip: You can start by loading a predefined query into the Query Builder. In the Load Query (Optional) list, select a predefined query. Then, modify the query as desired.
  6. Optional: Add a regex template to your query:
    Note: Arctic Wolf® uses RE2 and Java regex engines. Support for Lucene regex expressions is not available.
    1. In the Data Explorer section, click Regex Templates.
    2. In the Search templates box, filter and search for a regex template, such as IP address, and then select the desired regex template.
    3. Click Use in Query.
      Tip: Click Copy Pattern to manually insert the regex pattern into a query.
    4. In the Select a Field dialog, select the field for the regex template, and then do one of these actions:
    1. Click Insert into current query to insert the regex template into your current query.
    2. Click Start new query to copy the regex template and start a new query.
      Note: This action removes any Data Explorer and operator fields you previously selected.
  7. Click Run Query .
    Search results appear in a table.

    If your search included a field set, one or more widgets might appear in the Available Data Visualizations section.

  8. Optional: Complete any of these actions: