Log Search User Guide

User Guide

Overview

This guide provides an overview of the Log Search feature on the Arctic Wolf® Arctic Wolf Portal.

Accessing Log Search on the Arctic Wolf Portal

Log Search is a paid service. Access to this service is based on your service definition:

To access Log Search:

  1. Sign in to the Arctic Wolf Portal.
  2. From the menu bar, select Logs.

Note: If you are paying for Log Search but cannot access the service, contact your Concierge Security Team® (CST).

Logs page

The Logs page has three tabs:

Search tab

This section describes the options available in the Search tab, and how to perform searches.

Search parameters

The Search tab includes these search parameters:

Parameter Description Notes
Log Sources A menu that you can use to select one or more log sources or tags to search through. The default is All.
  • You can select a tag, like firewall, to search through log sources that have that tag. Click + on a tag to expand the list and view all log sources with the tag.
  • You can select as many log sources and/or tags from this list as desired.
  • Click x on any selected source to remove it from the search.
  • Click X on the Log Sources list to reset the list to the default value of All.
Time Range (Local Timezone) A menu that you can use to select a date or time range for your search.
  • The text underneath this field outlines the configured retention period and the earliest possible date and time range that you can search based on that period.
  • Use the Custom Range option to set a custom range for both the date and time of your search using a modal.
Search textbox A textbox that you can use to enter a search query.
Examples A menu that you can use to view various preconfigured example searches.
  • Some example queries include text fields that you must specify a value for. For example, the Account Lockout for User example includes the user id field. You must enter a value into this field before you can apply the query.
  • See Using an example to search for more information about example queries.

To search:

  1. Set the parameters for your search as desired. See Search paramters for more information.

  2. (Optional) Enter a query into the Search text box. If you leave this field blank, the system searches for all log lines that match your configured search parameters.

    Note: Beginning on June 15, 2021, Google Apps logs are now called Google Workspace in Log Search. To search for both of these log types, we recommend including both Google Apps and Google Workspace in your search to ensure that logs older than June 15, 2021 appear in the results.

  3. Click Search.

Running multiple searches simultaneously

You can run multiple searches at the same time. To start a new search without canceling the existing search, click + New Search. This option appears after you click Search for your first search query.

To use an example to search:

  1. Click Examples and then select one of the options from the list, such as Admin Group Addition/Mod.
  2. In the dialog box, review the search query, and then click Apply. This search query is automatically entered into the Search text box.

    Note: Some example queries include text fields that you must specify a value for before you can click Apply.

  3. Click Search.

Search results graph

The search results graph indicates the number of matching log lines and the distribution of those log lines throughout the specified time range.

Before you perform a search, the graph is empty. While you are performing a search, a progress bar appears above the graph to indicate the number of log lines that were queried against your search query.

Tip: This progress bar is also available on the Search Activity tab.

Adjusting the time range on the graph

After the search completes, you can zoom into a specific time. To adjust the range, click on a section of the graph and drag your mouse to the right or left to highlight that part of the graph. The graph then reloads to zoom in to the newly-selected range.

Note: This action runs a new search with the adjusted time range. The graph takes longer to reload if the time range is quite large.

Search results table

Search results are organized into a table. If there are more than 500 results for your query, the results are divided into multiple pages of 500 results per page, and you can use the navigation arrows to move between the pages.

The search results table includes these columns:

Column Description
Timestamp The timestamp for when this log line was sent to Arctic Wolf.
Sensor The sensor that is sending this log line to Arctic Wolf.
Source The log source of this log line.
Event The log line that matched your query.
Expand A way to expand the log line results:
  • Clicking the expand arrow expands all rows in the results. Click it again to collapse all rows.
  • There is a smaller expand arrow in each row to expand only the log lines of a given result.

Exporting search results

To export search results:

  1. Click Export, and then select:
    • Single zipped file — To download all results into a single zipped file.
    • One zipped file per day — To download multiple zipped files, one for each day included in the time range.
  2. Wait for the results to compress. Export changes to Download Results once the compression is complete.
  3. Click Download Results.
  4. Follow the prompts to choose a folder to save the .zip folder(s) to.
  5. (Optional) Rename the zip folder(s). The name of the zip folder(s) follows a format similar to 7627c684-8aa7-428e-9a8e-7db9e56234f0.zip if unchanged.
  6. Open the .zip folder(s) to reveal a file called export.csv.
  7. Open the .csv file(s) using your preferred spreadsheet software.

Search Activity tab

The Search Activity tab includes a search activity list, which has these columns:

Column Description
Run by Who ran the search and when.
Search The search parameters that were used, including the log sources that were searched, the time range over which the search was performed, and the search query.
Status The number of matches that were returned and the total volume of data for those log lines.
Actions The actions that you can take on a search in the list:
  • Click the garbage can to delete a search from the list.
  • Click export to export the results to a .csv file. See Exporting search results for more information about this option.

Tip: Click on any entry in the list to open the Search tab and immediately see the search results in full, without having to run the search again.

Log Sources tab

This section describes the actions you can take from the Log Sources tab.

Filter

Use the Filter text box to filter the log sources list. The list updates in real time. You can enter any string into the Filter text box.

Log source tags

Tags are a convenient way to organize your log sources for future searches. You can apply tags to log sources to group them. For example, group log sources by:

There are also system-assigned tags for firewall and Active Directory log sources that you cannot duplicate or remove. These tags appear greyed-out with [system-assigned] beside them when you click on the Add Tag text box. System-assigned tags are automatically assigned to your log sources based on the parser configured in the Arctic Wolf system.

Note: If you have any firewall or Active Directory log sources in your list that do not have the corresponding tags, contact your CST.

Adding tags to log sources

To add custom tags to log sources:

  1. Select the desired sources.
  2. Enter a tag in the Enter tag name to add text box. For example, if you have log sources for database servers, enter a tag like DBServer.

    Tip: You can add multiple tags to a single log source. For example, tag four of the database server log sources as high availibility pairs with a HAPair tag.

  3. Click Add Tag. Log source tags appear in the Assigned Tags column.

Removing tags from log sources

To remove custom tags from log sources:

  1. Select the desired sources.
  2. Enter the tag that you want to remove in the Enter tag name to remove text box, or select it from the list that appears when you click the text box.
  3. Click Remove Tag. The Assigned Tags column is automatically updated.

Log Search FAQ

These are some frequently asked questions (FAQs) for Log Search.

Q: Why is my search taking so long?

A: Depending on the search criteria, some searches take tens of minutes or more to return. Searches that are use case insensitivity are usually slower.

Tip: Once you launch your search, you can close the window or tab where you are viewing the Arctic Wolf Portal and return later when the search is finished, but the search will appear in the Search Activity tab.

To perform faster searches:

Q: Why didn't my search return any results?

A: Searches may not return results for the following reasons:

Q: Why am I unable to search beyond a certain date in the past?

A: There is a limit to how far back you can search through log lines based on data retention policies. Any data sent to Arctic Wolf prior to January 2019 is not searchable by default.

If you have a data retention period that extends before January 2019, you are unable to search your full history. Contact your CST if you have a longer data retention period and would like to search your full history.

Q: How can I drill down into the data once I find something of interest?

A: There are two methods that allow you to further refine your search:

  1. Drill down in time — Change the date and/or time parameters to a narrower range, or follow the instructions in Adjusting the time range on the graph.
  2. Drill down using search terms — Specify additional search terms to narrow the results.

See also

Log Search Query Guide