Run a search to find log lines that match a specific search expression.

1. Arctic Wolf Unified Portal にサインインします。
2. ナビゲーションメニューで、［データ探索］ > ［生ログ検索］をクリックします。
3. Optional: Limit your search to log sources that have a specific tag:
   1. Click the Log Source field.
   2. Add one or more tags from the list. For example, select active directory and auth to only include log sources with the active directory tag and log sources with the auth tag.

      For more information, see Log source tags.

4. Optional: Set the desired time range.
   Note:

   • You can only retrieve up to 31 days of log data at a time. However, you can run concurrent searches in other browser tabs or windows.
   • The earliest log data that you can search is based on your data retention policy.
   • By default, data sent to Arctic Wolf prior to January 2019 is not searchable. If your data retention period begins before January 2019 and you would like to search your full history, contact your Concierge Security® Team (CST) at security@arcticwolf.com.
5. Optional: Select a frequently run search:
   1. In the Query Template list, select a frequently run search.
   2. If prompted, enter the value that completes the search expression. For example, in the Login Successes for User template, enter a user ID.
   3. Click Apply to add the search expression to the Search field.
6. Optional: In the Search field, enter or modify the search expression.
   For more information, see Raw Log Search query syntax.
7. Select or deselect the Case sensitive option.
8. Click Search.

   A timeline graph and a table of matching log sources load when the search is complete.