Filter and Search Alerts

You can filter and search the Alerts page with built-in filters (Basic Mode or by querying with the Threat Command Query Language (Query Mode).

From each mode, you can easily switch to the other:

Filter the Alerts list in Basic Mode

You can filter the Alerts list to display alerts that match selected filter criteria.

To filter the Alerts list with Basic Mode:

1. From the main menu, select Threat Command > Alerts.

• If the Search bar displays a , you are in Basic Mode. Otherwise, click Switch to Basic.
• Note: If you are in Query Mode, you may need to click  in the Search bar before you can click Switch to Basic.

2. Filter the Alerts list, according to the options in the following table:

   To do this	Do this
   Filter alerts by severity.	Select a severity in the severity filter, on top of the Alerts list.
   Find an alert by its ID.	Type the alert ID in the Search bar.
   Show alerts in a specific status.	Click the Status filter and select statuses to show.
   Show alerts of a specific type.	Click the Type filter and select alert types to show.
   Show alerts from a specific source type.	Click the Source Type filter and select sources from which to show alerts.
   Show alerts that are flagged.	Click the Flagged filter and select whether to show only alerts that are flagged.
   Show alerts based on a specific asset.	Click the Asset filter and select assets to which alerts were matched.
   Show alerts whose source date is in a specific date range.	Click the Source Date filter and enter a date range.
   Show alerts assigned to a specific assignee or that are unassigned.	Click the Assignee filter and select which alerts to show.
   Show alerts with specific watchers.	Click the Watcher filter and select watchers.
   Show alerts with/without specific tags.	Click the Tags filter and select tags to match.
   Show alerts that were updated in a specific date range.	Click the Last Update filter and enter a date range.
   Show alerts in a specific remediation state.	Click the Remediation Status filter and select the statuses to match.
   Show alerts about which an analyst was contacted.	Click the Ask an Analyst filter and select Show only alerts with ask an analyst chat.
   Show alerts from the dark or clear web.	Click the Network Type filter and select the networks to match.
   Show alerts that were reported in a specific date range.	Click the Report Date filter and enter a date range.
   Show alerts that are associated with specific MITRE techniques.	Click the MITRE Technique filter and select techniques.
   Show all alerts	Click Clear all filters.

The selected alerts are displayed.

Filter the Alerts list in Query Mode

You can search and filter the Alerts page using complex search queries, similar to those used in other popular tools such as Splunk and Jira, combining various data fields and logical operators to obtain nearly any desired result.

The original filters are still available in Basic Mode or you can use Query Mode to achieve results that are not available with the current filters. For example, in Query Mode you can apply several filters with a logical OR relationship between them, while with the current filtering options, there is a built-in AND relationship between different filters. You can easily select between using the query language, “Query Mode” or the existing filters, “Basic Mode.”

The intuitive query interface supports automatic suggestions and completions, making it very easy to use without needing to remember exact field names or operators.

Queries can consist of the following elements:

• Field - A word that represents a field in the Threat Command Query Language. In most cases, fields correspond to alert filter names.
• Operator - A word or symbol that compares the value of the field with the value. Only results whose value matches are returned.
• Value - A value that is used to test if it matches.
• Keyword - A word or phrase that joins clauses or alters the logic of clauses or operators.

To filter the Alerts list using the Query Language in Query Mode:

1. From the main menu, select Threat Command > Alerts.

• If the Search bar displays a or an , you are in Query Mode. Otherwise, click Switch to Query.

2. Click anywhere in the Search bar.
   The list of available fields is displayed.
3. Create a query by selecting or typing a combination of fields, operators, values, and keywords.
   You can use the arrow and enter keys to easily select from the options in the dropdown.
   Query creation is not case sensitive.
4. Press Enter.

• The Alerts list is filtered according to your search query.
• To cancel a query, click  in the Search bar.

Example of a simple query:

Examples of more complex queries:

• "Source Type" = "Application Store" AND "Source URL" ~ "sameapk.com" AND Title ~ "Vulnerability"

  This query searches for mobile application alerts, found in an application store whose URL contains "sameapk.com", where the alert title includes the word "Vulnerability"

• "Remediation Status" = Failed AND Assignee IS EMPTY AND (Severity != Low OR Flagged = true)

  This query searches for alerts that have failed remediation, that are of some importance (high or medium severity, or flagged alerts), and are not assigned to anyone.

• (Title ~ Password OR Title ~ "Dark Web" OR Description ~ "Exposed publicly") AND Status IN (Open,"In Progress") AND "Source Date" >= 03-12-2020

  This query searches for alerts that contain certain keywords (such as "Dark Web" or "Exposed publicly") in their title or description, that are not closed, and were found after March 12th, 2020.

You can use the following operators:

The following table describes which operators are valid for each field: