Threat Hunting Guide
Table of Contents
Introduction3Hunting threats with Symantec Endpoint Detection and Response (EDR) 3
Finding threats 6Finding threats6
Event Summary Type IDs10Event Summary Type IDs10
Quick Filter Description 12Quick filter descriptions 12Search Database Entities quick filters 15Search Endpoint quick filters16
Creating and using text-based filters 17Using text search 17Lucene expression examples 19Query and filter operators by data type22
Copyright statement 24
2
Introduction
Hunting threats with Symantec Endpoint Detection and Response(EDR)EDR is designed to help you quickly detect threats to your network Threat hunting proceeds in three main steps
bull EDR collects data from your endpointsbull You filter the endpoint data to find indicators of compromise (IOCs) IOCs are the events and actions that are signs of
attack system breaches and the propagation of malicious filesbull You take the necessary actions to remediate the threat(s)
Data collection
EDR collects data using endpoint activity recorders and with on-demand process and file dumps You configure datacollection policies that you apply to the endpoints during set up See the in-product help system for details about the datacollection setup and configuration
Filtering endpoint data
There are three ways to filter endpoint data
bull Using predefined quick filtersbull Creating a custom filterbull Manually constructing a filter using text that conforms to the Lucene query language
Quick Filters
Quick Filters are organized into categories based on specific areas of interest for instance file activity memory analysisand MITRE tactic
3
You can chain quick filters together to narrow the results using the AND and OR operators The filtered results update asyou add or remove filters To remove a quick filter hover over the filter and click the trash-can icon Click Clear to removeall filters
Custom filters
Custom filters use the syntax Field Operator Value The UI has a drop-down menu for Field selection Upon selecting afield the Operator drop-down menu provides the available operators you can select You then manually enter a value forthe selected field The filtered results are displayed as soon as you complete the query and click Apply
Text search
4
To construct a text-based filter click on the ltgt icon to the right of the Time Range label
You can type directly into the query editor or paste an existing filter In either case the filter is constructed using theLucene Query Parser Syntax Some limitations apply See the topics listed below for details
Using text search
Lucene expression example
Query and filter operators by data type
5
Finding threats
Finding threatsThe tables in this section provide filters for common threat activities and vulnerabilities
Table 1 Finding suspicious behaviors
Filter for Text-based filter
Command line arguments matching Regex Event_Type_Id8001 AND Process_Command_Line[REGEX]
Syntaxfieldltregex_patterngt
example 1 Queryemail_addresssome
example 2 Queryemail_addresssome(one|place)
example 3 Query-command_name
The minus sign preceding the value inverts the query from include toexclude This query thus returns all documents that do not match the regexcommand_name
Unusual user logins or lateral movement Event_Type_Id8000 AND Device_Name[hostname]
Table 2 Finding suspicious processes
Filter for Text-based filter
Any instances of discovery tools on an endpoint Event_Type_Id8001 AND Process_Name( atexe Hostnameexe
tasklistexe netstatexe pingexe quserexe whoamiexe
ipconfigexe netexe )
Any powershellexe downloads Actor_File_Namepowershellexe AND ( Event_Type_Id8007 OR
(
Event_Type_Id8003 AND Disposition1 ) )
Any encoded PowerShell commands Process_Namepowershellexe AND Disposition1 AND
Process_Command_Line( -enc encoded )
Any Window Background Intelligent Transfer Service(BITS) transfers
Process_Namebitsadminexe AND
(Process_Command_Linetransfer OR
Process_Command_LineAddfile)
The processes that run from unusual locations Process_Nameexe AND Process_Folder-windows AND
Process_Folder-program AND Disposition1
The processes that run from the Recycle bin Event_Type_Id8001 AND Disposition1 AND
Process_Pathrecyclebin
6
Filter for Text-based filter
The processes that run from User Profile file paths Event_Type_Id8001 AND
Disposition1 AND
Process_Normalized_Path
CSIDL_PROFILE
Any running service binaries that are not in the System32directory
( Event_Type_Id8001 AND
Disposition1 ) AND
Actor_File_Name
servicesexe AND
Process_Normalized_Path
CSIDL_SYSTEM
Any instances of Svchost where the parent process is notservicesexe
Event_Type_Id8001 AND Disposition1
Process_Namesvchostexe
Actor_File_Name-servicesexe
A specified service name Process_Name
ltSERVICE_NAMEgt
AND Event_Type_Id8001
AND Disposition1
Any CreateService events Rule_Name
( eModifyExistingService eNewService )
Any non-System32 binaries running as a hosted service ( Registry_Value_Path
HKEY_LOCAL_MACHINESYSTEM
CurrentControlSet
ServicesParameter
AND Registry_Value_NameServiceDll )
AND Registry_Value_Data-SYSTEM32
Attachments launched from Outlook that areassociated with one of the following document readerswinwordexe excelexe or POWERPNTexe
Event_Type_Id8001 AND Disposition1 AND
Actor_Command_Linecontentoutlook AND
Actor_File_Name(winwordexe powerpntexe excelexe)
Links opened from Outlook within a specific time frame Actor_File_Nameoutlookexe AND Process_Name( chromeexe
iexplorerexe firefoxexe )
Table 3 Finding suspicious network connections
Filter for Text-based filter
Remote Desktop Protocol (RDP) connections on a specifiedendpoint
Event_Type_Id8007 AND ( Source_Port3389 OR
Destination_Port3389 ) AND Device_NameltHOSTNAMEgt
For enriched eventsRule_NameeRemoteDesktopProtocol AND
Device_NameltHOSTNAMEgt
7
Table 4 Finding suspicious registry changes
Filter for Text-based filter
Display persistence (Run Key) AddsThreat_Category_NameLoad Point Modification AND Disposition1
ChangesThreat_Category_NameLoad Point Modification AND
Disposition2
DeletesThreat_Category_NameLoad Point Modification AND
Disposition3
Table 5 Finding attempts to discover vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 6 Finding compliance and configuration vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 7 Finding Java malware trojans and exploits
Filter for Text-based filter
JAR files written to AppData Event_Type_Id8003 AND Disposition1 AND File_Namejar AND
File_Folderappdataroaming
Javaexe process thats writing executablefiles
Event_Type_Id8003 AND Disposition1 AND File_Family3 AND
Actor_File_Namejavaexe
Find the child process of whoamispawning under the Javaexe process
Actor_File_Namejavaexe AND Process_Namewhoamiexe
Table 8 Finding attempts to deliver malicious code
Filter for Text-based filter
A Word document attachment containing aclicked link followed by a browser download
Actor_File_Namewinwordexe AND Process_Namechromeexe
8
Table 9 Finding threat campaign activity
Filter for Text-based filter
The last 30 days of network connections toknown Dofoil
Event_Type_Id8007 AND Destination_IP( 13959208246
1302557390 313135232 )
9
Event Summary Type IDs
Event Summary Type IDsEvent Summary data is organized by type_id description For example if you are analyzing Vantage events this isrepresented in as 4113 Vantage Detection To learn more about Event Summary field descriptions see the Search FieldsReference Guide
Table 10 Type_ids
Event type and ID number Description1 Application Activity Reports status information about an application activity an end
user performed For example an administrator runs a databasesearch or endpoint search Or the administrator runs a commandline interface command (eg expand_storage)
20 User Session Audit Reports user logon and logoff activity at a management console ora managed client
21 Entity Audit Reports activity by a managed client a micro service or a userat a management console The activity can be a create updateand delete operation on a managed entity For example the Policyservice records policy change events the SEP client reports localpolicy changes and the policy administrator updates policies atthe console
238 Device Control Reports a device control disabled device239 Device Control Reports a buffer overflow event240 Device Control Reports software protection has thrown an exception502 Application Control Reports agent behavior events1000 System Health Reports any change to a components health which impacts
overall health of the appliance software or hardware Forexample DB Connection failuresuccess Low Disk or HighCPU
8000 Session Event Reports when a user attempts a log on or log off successfully orotherwise
8001 Process Event Reports when a process launches terminates or opens anotherprocess successful or otherwise
8002 Module Event Reports when a process loads or unloads amodule8003 File Event Reports operations on file system objects8004 Directory Event Reports operations on directories8005 Registry Key Event Reports actions on Windows registry keys8006 Registry Value Event Reports actions on Windows registry values8007 Network Event Reports attempted network connections successful or otherwise8009 Kernel Event Reports when an actor process creates reads or deletes a kernel
object8080 Session Query Result Reports information on existing user sessions8081 Process Query Result Reports information on a running process
10
8082 Module Query Result Reports information on loaded modules8083 File Query Result Reports information on file system objects8084 Directory Query Result Reports directory information8085 Registry Key Query Result Reports information on Windows Registry keys8086 Registry Value Query Result Reports information on Windows Registry values8089 Kernel Object Query Result Reports information on kernel objects8090 Service Query Result Reports information service queries8099 Query Command Errors Reports information on EOC (Evidence of Compromise Query
command errors8103 File Remediation Reports information on file system objects8119 File Remediation Errors Reports information on errors that result from an EOC (Evidence
of Compromise) file remediation action
11
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Table of Contents
Introduction3Hunting threats with Symantec Endpoint Detection and Response (EDR) 3
Finding threats 6Finding threats6
Event Summary Type IDs10Event Summary Type IDs10
Quick Filter Description 12Quick filter descriptions 12Search Database Entities quick filters 15Search Endpoint quick filters16
Creating and using text-based filters 17Using text search 17Lucene expression examples 19Query and filter operators by data type22
Copyright statement 24
2
Introduction
Hunting threats with Symantec Endpoint Detection and Response(EDR)EDR is designed to help you quickly detect threats to your network Threat hunting proceeds in three main steps
bull EDR collects data from your endpointsbull You filter the endpoint data to find indicators of compromise (IOCs) IOCs are the events and actions that are signs of
attack system breaches and the propagation of malicious filesbull You take the necessary actions to remediate the threat(s)
Data collection
EDR collects data using endpoint activity recorders and with on-demand process and file dumps You configure datacollection policies that you apply to the endpoints during set up See the in-product help system for details about the datacollection setup and configuration
Filtering endpoint data
There are three ways to filter endpoint data
bull Using predefined quick filtersbull Creating a custom filterbull Manually constructing a filter using text that conforms to the Lucene query language
Quick Filters
Quick Filters are organized into categories based on specific areas of interest for instance file activity memory analysisand MITRE tactic
3
You can chain quick filters together to narrow the results using the AND and OR operators The filtered results update asyou add or remove filters To remove a quick filter hover over the filter and click the trash-can icon Click Clear to removeall filters
Custom filters
Custom filters use the syntax Field Operator Value The UI has a drop-down menu for Field selection Upon selecting afield the Operator drop-down menu provides the available operators you can select You then manually enter a value forthe selected field The filtered results are displayed as soon as you complete the query and click Apply
Text search
4
To construct a text-based filter click on the ltgt icon to the right of the Time Range label
You can type directly into the query editor or paste an existing filter In either case the filter is constructed using theLucene Query Parser Syntax Some limitations apply See the topics listed below for details
Using text search
Lucene expression example
Query and filter operators by data type
5
Finding threats
Finding threatsThe tables in this section provide filters for common threat activities and vulnerabilities
Table 1 Finding suspicious behaviors
Filter for Text-based filter
Command line arguments matching Regex Event_Type_Id8001 AND Process_Command_Line[REGEX]
Syntaxfieldltregex_patterngt
example 1 Queryemail_addresssome
example 2 Queryemail_addresssome(one|place)
example 3 Query-command_name
The minus sign preceding the value inverts the query from include toexclude This query thus returns all documents that do not match the regexcommand_name
Unusual user logins or lateral movement Event_Type_Id8000 AND Device_Name[hostname]
Table 2 Finding suspicious processes
Filter for Text-based filter
Any instances of discovery tools on an endpoint Event_Type_Id8001 AND Process_Name( atexe Hostnameexe
tasklistexe netstatexe pingexe quserexe whoamiexe
ipconfigexe netexe )
Any powershellexe downloads Actor_File_Namepowershellexe AND ( Event_Type_Id8007 OR
(
Event_Type_Id8003 AND Disposition1 ) )
Any encoded PowerShell commands Process_Namepowershellexe AND Disposition1 AND
Process_Command_Line( -enc encoded )
Any Window Background Intelligent Transfer Service(BITS) transfers
Process_Namebitsadminexe AND
(Process_Command_Linetransfer OR
Process_Command_LineAddfile)
The processes that run from unusual locations Process_Nameexe AND Process_Folder-windows AND
Process_Folder-program AND Disposition1
The processes that run from the Recycle bin Event_Type_Id8001 AND Disposition1 AND
Process_Pathrecyclebin
6
Filter for Text-based filter
The processes that run from User Profile file paths Event_Type_Id8001 AND
Disposition1 AND
Process_Normalized_Path
CSIDL_PROFILE
Any running service binaries that are not in the System32directory
( Event_Type_Id8001 AND
Disposition1 ) AND
Actor_File_Name
servicesexe AND
Process_Normalized_Path
CSIDL_SYSTEM
Any instances of Svchost where the parent process is notservicesexe
Event_Type_Id8001 AND Disposition1
Process_Namesvchostexe
Actor_File_Name-servicesexe
A specified service name Process_Name
ltSERVICE_NAMEgt
AND Event_Type_Id8001
AND Disposition1
Any CreateService events Rule_Name
( eModifyExistingService eNewService )
Any non-System32 binaries running as a hosted service ( Registry_Value_Path
HKEY_LOCAL_MACHINESYSTEM
CurrentControlSet
ServicesParameter
AND Registry_Value_NameServiceDll )
AND Registry_Value_Data-SYSTEM32
Attachments launched from Outlook that areassociated with one of the following document readerswinwordexe excelexe or POWERPNTexe
Event_Type_Id8001 AND Disposition1 AND
Actor_Command_Linecontentoutlook AND
Actor_File_Name(winwordexe powerpntexe excelexe)
Links opened from Outlook within a specific time frame Actor_File_Nameoutlookexe AND Process_Name( chromeexe
iexplorerexe firefoxexe )
Table 3 Finding suspicious network connections
Filter for Text-based filter
Remote Desktop Protocol (RDP) connections on a specifiedendpoint
Event_Type_Id8007 AND ( Source_Port3389 OR
Destination_Port3389 ) AND Device_NameltHOSTNAMEgt
For enriched eventsRule_NameeRemoteDesktopProtocol AND
Device_NameltHOSTNAMEgt
7
Table 4 Finding suspicious registry changes
Filter for Text-based filter
Display persistence (Run Key) AddsThreat_Category_NameLoad Point Modification AND Disposition1
ChangesThreat_Category_NameLoad Point Modification AND
Disposition2
DeletesThreat_Category_NameLoad Point Modification AND
Disposition3
Table 5 Finding attempts to discover vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 6 Finding compliance and configuration vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 7 Finding Java malware trojans and exploits
Filter for Text-based filter
JAR files written to AppData Event_Type_Id8003 AND Disposition1 AND File_Namejar AND
File_Folderappdataroaming
Javaexe process thats writing executablefiles
Event_Type_Id8003 AND Disposition1 AND File_Family3 AND
Actor_File_Namejavaexe
Find the child process of whoamispawning under the Javaexe process
Actor_File_Namejavaexe AND Process_Namewhoamiexe
Table 8 Finding attempts to deliver malicious code
Filter for Text-based filter
A Word document attachment containing aclicked link followed by a browser download
Actor_File_Namewinwordexe AND Process_Namechromeexe
8
Table 9 Finding threat campaign activity
Filter for Text-based filter
The last 30 days of network connections toknown Dofoil
Event_Type_Id8007 AND Destination_IP( 13959208246
1302557390 313135232 )
9
Event Summary Type IDs
Event Summary Type IDsEvent Summary data is organized by type_id description For example if you are analyzing Vantage events this isrepresented in as 4113 Vantage Detection To learn more about Event Summary field descriptions see the Search FieldsReference Guide
Table 10 Type_ids
Event type and ID number Description1 Application Activity Reports status information about an application activity an end
user performed For example an administrator runs a databasesearch or endpoint search Or the administrator runs a commandline interface command (eg expand_storage)
20 User Session Audit Reports user logon and logoff activity at a management console ora managed client
21 Entity Audit Reports activity by a managed client a micro service or a userat a management console The activity can be a create updateand delete operation on a managed entity For example the Policyservice records policy change events the SEP client reports localpolicy changes and the policy administrator updates policies atthe console
238 Device Control Reports a device control disabled device239 Device Control Reports a buffer overflow event240 Device Control Reports software protection has thrown an exception502 Application Control Reports agent behavior events1000 System Health Reports any change to a components health which impacts
overall health of the appliance software or hardware Forexample DB Connection failuresuccess Low Disk or HighCPU
8000 Session Event Reports when a user attempts a log on or log off successfully orotherwise
8001 Process Event Reports when a process launches terminates or opens anotherprocess successful or otherwise
8002 Module Event Reports when a process loads or unloads amodule8003 File Event Reports operations on file system objects8004 Directory Event Reports operations on directories8005 Registry Key Event Reports actions on Windows registry keys8006 Registry Value Event Reports actions on Windows registry values8007 Network Event Reports attempted network connections successful or otherwise8009 Kernel Event Reports when an actor process creates reads or deletes a kernel
object8080 Session Query Result Reports information on existing user sessions8081 Process Query Result Reports information on a running process
10
8082 Module Query Result Reports information on loaded modules8083 File Query Result Reports information on file system objects8084 Directory Query Result Reports directory information8085 Registry Key Query Result Reports information on Windows Registry keys8086 Registry Value Query Result Reports information on Windows Registry values8089 Kernel Object Query Result Reports information on kernel objects8090 Service Query Result Reports information service queries8099 Query Command Errors Reports information on EOC (Evidence of Compromise Query
command errors8103 File Remediation Reports information on file system objects8119 File Remediation Errors Reports information on errors that result from an EOC (Evidence
of Compromise) file remediation action
11
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Introduction
Hunting threats with Symantec Endpoint Detection and Response(EDR)EDR is designed to help you quickly detect threats to your network Threat hunting proceeds in three main steps
bull EDR collects data from your endpointsbull You filter the endpoint data to find indicators of compromise (IOCs) IOCs are the events and actions that are signs of
attack system breaches and the propagation of malicious filesbull You take the necessary actions to remediate the threat(s)
Data collection
EDR collects data using endpoint activity recorders and with on-demand process and file dumps You configure datacollection policies that you apply to the endpoints during set up See the in-product help system for details about the datacollection setup and configuration
Filtering endpoint data
There are three ways to filter endpoint data
bull Using predefined quick filtersbull Creating a custom filterbull Manually constructing a filter using text that conforms to the Lucene query language
Quick Filters
Quick Filters are organized into categories based on specific areas of interest for instance file activity memory analysisand MITRE tactic
3
You can chain quick filters together to narrow the results using the AND and OR operators The filtered results update asyou add or remove filters To remove a quick filter hover over the filter and click the trash-can icon Click Clear to removeall filters
Custom filters
Custom filters use the syntax Field Operator Value The UI has a drop-down menu for Field selection Upon selecting afield the Operator drop-down menu provides the available operators you can select You then manually enter a value forthe selected field The filtered results are displayed as soon as you complete the query and click Apply
Text search
4
To construct a text-based filter click on the ltgt icon to the right of the Time Range label
You can type directly into the query editor or paste an existing filter In either case the filter is constructed using theLucene Query Parser Syntax Some limitations apply See the topics listed below for details
Using text search
Lucene expression example
Query and filter operators by data type
5
Finding threats
Finding threatsThe tables in this section provide filters for common threat activities and vulnerabilities
Table 1 Finding suspicious behaviors
Filter for Text-based filter
Command line arguments matching Regex Event_Type_Id8001 AND Process_Command_Line[REGEX]
Syntaxfieldltregex_patterngt
example 1 Queryemail_addresssome
example 2 Queryemail_addresssome(one|place)
example 3 Query-command_name
The minus sign preceding the value inverts the query from include toexclude This query thus returns all documents that do not match the regexcommand_name
Unusual user logins or lateral movement Event_Type_Id8000 AND Device_Name[hostname]
Table 2 Finding suspicious processes
Filter for Text-based filter
Any instances of discovery tools on an endpoint Event_Type_Id8001 AND Process_Name( atexe Hostnameexe
tasklistexe netstatexe pingexe quserexe whoamiexe
ipconfigexe netexe )
Any powershellexe downloads Actor_File_Namepowershellexe AND ( Event_Type_Id8007 OR
(
Event_Type_Id8003 AND Disposition1 ) )
Any encoded PowerShell commands Process_Namepowershellexe AND Disposition1 AND
Process_Command_Line( -enc encoded )
Any Window Background Intelligent Transfer Service(BITS) transfers
Process_Namebitsadminexe AND
(Process_Command_Linetransfer OR
Process_Command_LineAddfile)
The processes that run from unusual locations Process_Nameexe AND Process_Folder-windows AND
Process_Folder-program AND Disposition1
The processes that run from the Recycle bin Event_Type_Id8001 AND Disposition1 AND
Process_Pathrecyclebin
6
Filter for Text-based filter
The processes that run from User Profile file paths Event_Type_Id8001 AND
Disposition1 AND
Process_Normalized_Path
CSIDL_PROFILE
Any running service binaries that are not in the System32directory
( Event_Type_Id8001 AND
Disposition1 ) AND
Actor_File_Name
servicesexe AND
Process_Normalized_Path
CSIDL_SYSTEM
Any instances of Svchost where the parent process is notservicesexe
Event_Type_Id8001 AND Disposition1
Process_Namesvchostexe
Actor_File_Name-servicesexe
A specified service name Process_Name
ltSERVICE_NAMEgt
AND Event_Type_Id8001
AND Disposition1
Any CreateService events Rule_Name
( eModifyExistingService eNewService )
Any non-System32 binaries running as a hosted service ( Registry_Value_Path
HKEY_LOCAL_MACHINESYSTEM
CurrentControlSet
ServicesParameter
AND Registry_Value_NameServiceDll )
AND Registry_Value_Data-SYSTEM32
Attachments launched from Outlook that areassociated with one of the following document readerswinwordexe excelexe or POWERPNTexe
Event_Type_Id8001 AND Disposition1 AND
Actor_Command_Linecontentoutlook AND
Actor_File_Name(winwordexe powerpntexe excelexe)
Links opened from Outlook within a specific time frame Actor_File_Nameoutlookexe AND Process_Name( chromeexe
iexplorerexe firefoxexe )
Table 3 Finding suspicious network connections
Filter for Text-based filter
Remote Desktop Protocol (RDP) connections on a specifiedendpoint
Event_Type_Id8007 AND ( Source_Port3389 OR
Destination_Port3389 ) AND Device_NameltHOSTNAMEgt
For enriched eventsRule_NameeRemoteDesktopProtocol AND
Device_NameltHOSTNAMEgt
7
Table 4 Finding suspicious registry changes
Filter for Text-based filter
Display persistence (Run Key) AddsThreat_Category_NameLoad Point Modification AND Disposition1
ChangesThreat_Category_NameLoad Point Modification AND
Disposition2
DeletesThreat_Category_NameLoad Point Modification AND
Disposition3
Table 5 Finding attempts to discover vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 6 Finding compliance and configuration vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 7 Finding Java malware trojans and exploits
Filter for Text-based filter
JAR files written to AppData Event_Type_Id8003 AND Disposition1 AND File_Namejar AND
File_Folderappdataroaming
Javaexe process thats writing executablefiles
Event_Type_Id8003 AND Disposition1 AND File_Family3 AND
Actor_File_Namejavaexe
Find the child process of whoamispawning under the Javaexe process
Actor_File_Namejavaexe AND Process_Namewhoamiexe
Table 8 Finding attempts to deliver malicious code
Filter for Text-based filter
A Word document attachment containing aclicked link followed by a browser download
Actor_File_Namewinwordexe AND Process_Namechromeexe
8
Table 9 Finding threat campaign activity
Filter for Text-based filter
The last 30 days of network connections toknown Dofoil
Event_Type_Id8007 AND Destination_IP( 13959208246
1302557390 313135232 )
9
Event Summary Type IDs
Event Summary Type IDsEvent Summary data is organized by type_id description For example if you are analyzing Vantage events this isrepresented in as 4113 Vantage Detection To learn more about Event Summary field descriptions see the Search FieldsReference Guide
Table 10 Type_ids
Event type and ID number Description1 Application Activity Reports status information about an application activity an end
user performed For example an administrator runs a databasesearch or endpoint search Or the administrator runs a commandline interface command (eg expand_storage)
20 User Session Audit Reports user logon and logoff activity at a management console ora managed client
21 Entity Audit Reports activity by a managed client a micro service or a userat a management console The activity can be a create updateand delete operation on a managed entity For example the Policyservice records policy change events the SEP client reports localpolicy changes and the policy administrator updates policies atthe console
238 Device Control Reports a device control disabled device239 Device Control Reports a buffer overflow event240 Device Control Reports software protection has thrown an exception502 Application Control Reports agent behavior events1000 System Health Reports any change to a components health which impacts
overall health of the appliance software or hardware Forexample DB Connection failuresuccess Low Disk or HighCPU
8000 Session Event Reports when a user attempts a log on or log off successfully orotherwise
8001 Process Event Reports when a process launches terminates or opens anotherprocess successful or otherwise
8002 Module Event Reports when a process loads or unloads amodule8003 File Event Reports operations on file system objects8004 Directory Event Reports operations on directories8005 Registry Key Event Reports actions on Windows registry keys8006 Registry Value Event Reports actions on Windows registry values8007 Network Event Reports attempted network connections successful or otherwise8009 Kernel Event Reports when an actor process creates reads or deletes a kernel
object8080 Session Query Result Reports information on existing user sessions8081 Process Query Result Reports information on a running process
10
8082 Module Query Result Reports information on loaded modules8083 File Query Result Reports information on file system objects8084 Directory Query Result Reports directory information8085 Registry Key Query Result Reports information on Windows Registry keys8086 Registry Value Query Result Reports information on Windows Registry values8089 Kernel Object Query Result Reports information on kernel objects8090 Service Query Result Reports information service queries8099 Query Command Errors Reports information on EOC (Evidence of Compromise Query
command errors8103 File Remediation Reports information on file system objects8119 File Remediation Errors Reports information on errors that result from an EOC (Evidence
of Compromise) file remediation action
11
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
You can chain quick filters together to narrow the results using the AND and OR operators The filtered results update asyou add or remove filters To remove a quick filter hover over the filter and click the trash-can icon Click Clear to removeall filters
Custom filters
Custom filters use the syntax Field Operator Value The UI has a drop-down menu for Field selection Upon selecting afield the Operator drop-down menu provides the available operators you can select You then manually enter a value forthe selected field The filtered results are displayed as soon as you complete the query and click Apply
Text search
4
To construct a text-based filter click on the ltgt icon to the right of the Time Range label
You can type directly into the query editor or paste an existing filter In either case the filter is constructed using theLucene Query Parser Syntax Some limitations apply See the topics listed below for details
Using text search
Lucene expression example
Query and filter operators by data type
5
Finding threats
Finding threatsThe tables in this section provide filters for common threat activities and vulnerabilities
Table 1 Finding suspicious behaviors
Filter for Text-based filter
Command line arguments matching Regex Event_Type_Id8001 AND Process_Command_Line[REGEX]
Syntaxfieldltregex_patterngt
example 1 Queryemail_addresssome
example 2 Queryemail_addresssome(one|place)
example 3 Query-command_name
The minus sign preceding the value inverts the query from include toexclude This query thus returns all documents that do not match the regexcommand_name
Unusual user logins or lateral movement Event_Type_Id8000 AND Device_Name[hostname]
Table 2 Finding suspicious processes
Filter for Text-based filter
Any instances of discovery tools on an endpoint Event_Type_Id8001 AND Process_Name( atexe Hostnameexe
tasklistexe netstatexe pingexe quserexe whoamiexe
ipconfigexe netexe )
Any powershellexe downloads Actor_File_Namepowershellexe AND ( Event_Type_Id8007 OR
(
Event_Type_Id8003 AND Disposition1 ) )
Any encoded PowerShell commands Process_Namepowershellexe AND Disposition1 AND
Process_Command_Line( -enc encoded )
Any Window Background Intelligent Transfer Service(BITS) transfers
Process_Namebitsadminexe AND
(Process_Command_Linetransfer OR
Process_Command_LineAddfile)
The processes that run from unusual locations Process_Nameexe AND Process_Folder-windows AND
Process_Folder-program AND Disposition1
The processes that run from the Recycle bin Event_Type_Id8001 AND Disposition1 AND
Process_Pathrecyclebin
6
Filter for Text-based filter
The processes that run from User Profile file paths Event_Type_Id8001 AND
Disposition1 AND
Process_Normalized_Path
CSIDL_PROFILE
Any running service binaries that are not in the System32directory
( Event_Type_Id8001 AND
Disposition1 ) AND
Actor_File_Name
servicesexe AND
Process_Normalized_Path
CSIDL_SYSTEM
Any instances of Svchost where the parent process is notservicesexe
Event_Type_Id8001 AND Disposition1
Process_Namesvchostexe
Actor_File_Name-servicesexe
A specified service name Process_Name
ltSERVICE_NAMEgt
AND Event_Type_Id8001
AND Disposition1
Any CreateService events Rule_Name
( eModifyExistingService eNewService )
Any non-System32 binaries running as a hosted service ( Registry_Value_Path
HKEY_LOCAL_MACHINESYSTEM
CurrentControlSet
ServicesParameter
AND Registry_Value_NameServiceDll )
AND Registry_Value_Data-SYSTEM32
Attachments launched from Outlook that areassociated with one of the following document readerswinwordexe excelexe or POWERPNTexe
Event_Type_Id8001 AND Disposition1 AND
Actor_Command_Linecontentoutlook AND
Actor_File_Name(winwordexe powerpntexe excelexe)
Links opened from Outlook within a specific time frame Actor_File_Nameoutlookexe AND Process_Name( chromeexe
iexplorerexe firefoxexe )
Table 3 Finding suspicious network connections
Filter for Text-based filter
Remote Desktop Protocol (RDP) connections on a specifiedendpoint
Event_Type_Id8007 AND ( Source_Port3389 OR
Destination_Port3389 ) AND Device_NameltHOSTNAMEgt
For enriched eventsRule_NameeRemoteDesktopProtocol AND
Device_NameltHOSTNAMEgt
7
Table 4 Finding suspicious registry changes
Filter for Text-based filter
Display persistence (Run Key) AddsThreat_Category_NameLoad Point Modification AND Disposition1
ChangesThreat_Category_NameLoad Point Modification AND
Disposition2
DeletesThreat_Category_NameLoad Point Modification AND
Disposition3
Table 5 Finding attempts to discover vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 6 Finding compliance and configuration vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 7 Finding Java malware trojans and exploits
Filter for Text-based filter
JAR files written to AppData Event_Type_Id8003 AND Disposition1 AND File_Namejar AND
File_Folderappdataroaming
Javaexe process thats writing executablefiles
Event_Type_Id8003 AND Disposition1 AND File_Family3 AND
Actor_File_Namejavaexe
Find the child process of whoamispawning under the Javaexe process
Actor_File_Namejavaexe AND Process_Namewhoamiexe
Table 8 Finding attempts to deliver malicious code
Filter for Text-based filter
A Word document attachment containing aclicked link followed by a browser download
Actor_File_Namewinwordexe AND Process_Namechromeexe
8
Table 9 Finding threat campaign activity
Filter for Text-based filter
The last 30 days of network connections toknown Dofoil
Event_Type_Id8007 AND Destination_IP( 13959208246
1302557390 313135232 )
9
Event Summary Type IDs
Event Summary Type IDsEvent Summary data is organized by type_id description For example if you are analyzing Vantage events this isrepresented in as 4113 Vantage Detection To learn more about Event Summary field descriptions see the Search FieldsReference Guide
Table 10 Type_ids
Event type and ID number Description1 Application Activity Reports status information about an application activity an end
user performed For example an administrator runs a databasesearch or endpoint search Or the administrator runs a commandline interface command (eg expand_storage)
20 User Session Audit Reports user logon and logoff activity at a management console ora managed client
21 Entity Audit Reports activity by a managed client a micro service or a userat a management console The activity can be a create updateand delete operation on a managed entity For example the Policyservice records policy change events the SEP client reports localpolicy changes and the policy administrator updates policies atthe console
238 Device Control Reports a device control disabled device239 Device Control Reports a buffer overflow event240 Device Control Reports software protection has thrown an exception502 Application Control Reports agent behavior events1000 System Health Reports any change to a components health which impacts
overall health of the appliance software or hardware Forexample DB Connection failuresuccess Low Disk or HighCPU
8000 Session Event Reports when a user attempts a log on or log off successfully orotherwise
8001 Process Event Reports when a process launches terminates or opens anotherprocess successful or otherwise
8002 Module Event Reports when a process loads or unloads amodule8003 File Event Reports operations on file system objects8004 Directory Event Reports operations on directories8005 Registry Key Event Reports actions on Windows registry keys8006 Registry Value Event Reports actions on Windows registry values8007 Network Event Reports attempted network connections successful or otherwise8009 Kernel Event Reports when an actor process creates reads or deletes a kernel
object8080 Session Query Result Reports information on existing user sessions8081 Process Query Result Reports information on a running process
10
8082 Module Query Result Reports information on loaded modules8083 File Query Result Reports information on file system objects8084 Directory Query Result Reports directory information8085 Registry Key Query Result Reports information on Windows Registry keys8086 Registry Value Query Result Reports information on Windows Registry values8089 Kernel Object Query Result Reports information on kernel objects8090 Service Query Result Reports information service queries8099 Query Command Errors Reports information on EOC (Evidence of Compromise Query
command errors8103 File Remediation Reports information on file system objects8119 File Remediation Errors Reports information on errors that result from an EOC (Evidence
of Compromise) file remediation action
11
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
To construct a text-based filter click on the ltgt icon to the right of the Time Range label
You can type directly into the query editor or paste an existing filter In either case the filter is constructed using theLucene Query Parser Syntax Some limitations apply See the topics listed below for details
Using text search
Lucene expression example
Query and filter operators by data type
5
Finding threats
Finding threatsThe tables in this section provide filters for common threat activities and vulnerabilities
Table 1 Finding suspicious behaviors
Filter for Text-based filter
Command line arguments matching Regex Event_Type_Id8001 AND Process_Command_Line[REGEX]
Syntaxfieldltregex_patterngt
example 1 Queryemail_addresssome
example 2 Queryemail_addresssome(one|place)
example 3 Query-command_name
The minus sign preceding the value inverts the query from include toexclude This query thus returns all documents that do not match the regexcommand_name
Unusual user logins or lateral movement Event_Type_Id8000 AND Device_Name[hostname]
Table 2 Finding suspicious processes
Filter for Text-based filter
Any instances of discovery tools on an endpoint Event_Type_Id8001 AND Process_Name( atexe Hostnameexe
tasklistexe netstatexe pingexe quserexe whoamiexe
ipconfigexe netexe )
Any powershellexe downloads Actor_File_Namepowershellexe AND ( Event_Type_Id8007 OR
(
Event_Type_Id8003 AND Disposition1 ) )
Any encoded PowerShell commands Process_Namepowershellexe AND Disposition1 AND
Process_Command_Line( -enc encoded )
Any Window Background Intelligent Transfer Service(BITS) transfers
Process_Namebitsadminexe AND
(Process_Command_Linetransfer OR
Process_Command_LineAddfile)
The processes that run from unusual locations Process_Nameexe AND Process_Folder-windows AND
Process_Folder-program AND Disposition1
The processes that run from the Recycle bin Event_Type_Id8001 AND Disposition1 AND
Process_Pathrecyclebin
6
Filter for Text-based filter
The processes that run from User Profile file paths Event_Type_Id8001 AND
Disposition1 AND
Process_Normalized_Path
CSIDL_PROFILE
Any running service binaries that are not in the System32directory
( Event_Type_Id8001 AND
Disposition1 ) AND
Actor_File_Name
servicesexe AND
Process_Normalized_Path
CSIDL_SYSTEM
Any instances of Svchost where the parent process is notservicesexe
Event_Type_Id8001 AND Disposition1
Process_Namesvchostexe
Actor_File_Name-servicesexe
A specified service name Process_Name
ltSERVICE_NAMEgt
AND Event_Type_Id8001
AND Disposition1
Any CreateService events Rule_Name
( eModifyExistingService eNewService )
Any non-System32 binaries running as a hosted service ( Registry_Value_Path
HKEY_LOCAL_MACHINESYSTEM
CurrentControlSet
ServicesParameter
AND Registry_Value_NameServiceDll )
AND Registry_Value_Data-SYSTEM32
Attachments launched from Outlook that areassociated with one of the following document readerswinwordexe excelexe or POWERPNTexe
Event_Type_Id8001 AND Disposition1 AND
Actor_Command_Linecontentoutlook AND
Actor_File_Name(winwordexe powerpntexe excelexe)
Links opened from Outlook within a specific time frame Actor_File_Nameoutlookexe AND Process_Name( chromeexe
iexplorerexe firefoxexe )
Table 3 Finding suspicious network connections
Filter for Text-based filter
Remote Desktop Protocol (RDP) connections on a specifiedendpoint
Event_Type_Id8007 AND ( Source_Port3389 OR
Destination_Port3389 ) AND Device_NameltHOSTNAMEgt
For enriched eventsRule_NameeRemoteDesktopProtocol AND
Device_NameltHOSTNAMEgt
7
Table 4 Finding suspicious registry changes
Filter for Text-based filter
Display persistence (Run Key) AddsThreat_Category_NameLoad Point Modification AND Disposition1
ChangesThreat_Category_NameLoad Point Modification AND
Disposition2
DeletesThreat_Category_NameLoad Point Modification AND
Disposition3
Table 5 Finding attempts to discover vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 6 Finding compliance and configuration vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 7 Finding Java malware trojans and exploits
Filter for Text-based filter
JAR files written to AppData Event_Type_Id8003 AND Disposition1 AND File_Namejar AND
File_Folderappdataroaming
Javaexe process thats writing executablefiles
Event_Type_Id8003 AND Disposition1 AND File_Family3 AND
Actor_File_Namejavaexe
Find the child process of whoamispawning under the Javaexe process
Actor_File_Namejavaexe AND Process_Namewhoamiexe
Table 8 Finding attempts to deliver malicious code
Filter for Text-based filter
A Word document attachment containing aclicked link followed by a browser download
Actor_File_Namewinwordexe AND Process_Namechromeexe
8
Table 9 Finding threat campaign activity
Filter for Text-based filter
The last 30 days of network connections toknown Dofoil
Event_Type_Id8007 AND Destination_IP( 13959208246
1302557390 313135232 )
9
Event Summary Type IDs
Event Summary Type IDsEvent Summary data is organized by type_id description For example if you are analyzing Vantage events this isrepresented in as 4113 Vantage Detection To learn more about Event Summary field descriptions see the Search FieldsReference Guide
Table 10 Type_ids
Event type and ID number Description1 Application Activity Reports status information about an application activity an end
user performed For example an administrator runs a databasesearch or endpoint search Or the administrator runs a commandline interface command (eg expand_storage)
20 User Session Audit Reports user logon and logoff activity at a management console ora managed client
21 Entity Audit Reports activity by a managed client a micro service or a userat a management console The activity can be a create updateand delete operation on a managed entity For example the Policyservice records policy change events the SEP client reports localpolicy changes and the policy administrator updates policies atthe console
238 Device Control Reports a device control disabled device239 Device Control Reports a buffer overflow event240 Device Control Reports software protection has thrown an exception502 Application Control Reports agent behavior events1000 System Health Reports any change to a components health which impacts
overall health of the appliance software or hardware Forexample DB Connection failuresuccess Low Disk or HighCPU
8000 Session Event Reports when a user attempts a log on or log off successfully orotherwise
8001 Process Event Reports when a process launches terminates or opens anotherprocess successful or otherwise
8002 Module Event Reports when a process loads or unloads amodule8003 File Event Reports operations on file system objects8004 Directory Event Reports operations on directories8005 Registry Key Event Reports actions on Windows registry keys8006 Registry Value Event Reports actions on Windows registry values8007 Network Event Reports attempted network connections successful or otherwise8009 Kernel Event Reports when an actor process creates reads or deletes a kernel
object8080 Session Query Result Reports information on existing user sessions8081 Process Query Result Reports information on a running process
10
8082 Module Query Result Reports information on loaded modules8083 File Query Result Reports information on file system objects8084 Directory Query Result Reports directory information8085 Registry Key Query Result Reports information on Windows Registry keys8086 Registry Value Query Result Reports information on Windows Registry values8089 Kernel Object Query Result Reports information on kernel objects8090 Service Query Result Reports information service queries8099 Query Command Errors Reports information on EOC (Evidence of Compromise Query
command errors8103 File Remediation Reports information on file system objects8119 File Remediation Errors Reports information on errors that result from an EOC (Evidence
of Compromise) file remediation action
11
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Finding threats
Finding threatsThe tables in this section provide filters for common threat activities and vulnerabilities
Table 1 Finding suspicious behaviors
Filter for Text-based filter
Command line arguments matching Regex Event_Type_Id8001 AND Process_Command_Line[REGEX]
Syntaxfieldltregex_patterngt
example 1 Queryemail_addresssome
example 2 Queryemail_addresssome(one|place)
example 3 Query-command_name
The minus sign preceding the value inverts the query from include toexclude This query thus returns all documents that do not match the regexcommand_name
Unusual user logins or lateral movement Event_Type_Id8000 AND Device_Name[hostname]
Table 2 Finding suspicious processes
Filter for Text-based filter
Any instances of discovery tools on an endpoint Event_Type_Id8001 AND Process_Name( atexe Hostnameexe
tasklistexe netstatexe pingexe quserexe whoamiexe
ipconfigexe netexe )
Any powershellexe downloads Actor_File_Namepowershellexe AND ( Event_Type_Id8007 OR
(
Event_Type_Id8003 AND Disposition1 ) )
Any encoded PowerShell commands Process_Namepowershellexe AND Disposition1 AND
Process_Command_Line( -enc encoded )
Any Window Background Intelligent Transfer Service(BITS) transfers
Process_Namebitsadminexe AND
(Process_Command_Linetransfer OR
Process_Command_LineAddfile)
The processes that run from unusual locations Process_Nameexe AND Process_Folder-windows AND
Process_Folder-program AND Disposition1
The processes that run from the Recycle bin Event_Type_Id8001 AND Disposition1 AND
Process_Pathrecyclebin
6
Filter for Text-based filter
The processes that run from User Profile file paths Event_Type_Id8001 AND
Disposition1 AND
Process_Normalized_Path
CSIDL_PROFILE
Any running service binaries that are not in the System32directory
( Event_Type_Id8001 AND
Disposition1 ) AND
Actor_File_Name
servicesexe AND
Process_Normalized_Path
CSIDL_SYSTEM
Any instances of Svchost where the parent process is notservicesexe
Event_Type_Id8001 AND Disposition1
Process_Namesvchostexe
Actor_File_Name-servicesexe
A specified service name Process_Name
ltSERVICE_NAMEgt
AND Event_Type_Id8001
AND Disposition1
Any CreateService events Rule_Name
( eModifyExistingService eNewService )
Any non-System32 binaries running as a hosted service ( Registry_Value_Path
HKEY_LOCAL_MACHINESYSTEM
CurrentControlSet
ServicesParameter
AND Registry_Value_NameServiceDll )
AND Registry_Value_Data-SYSTEM32
Attachments launched from Outlook that areassociated with one of the following document readerswinwordexe excelexe or POWERPNTexe
Event_Type_Id8001 AND Disposition1 AND
Actor_Command_Linecontentoutlook AND
Actor_File_Name(winwordexe powerpntexe excelexe)
Links opened from Outlook within a specific time frame Actor_File_Nameoutlookexe AND Process_Name( chromeexe
iexplorerexe firefoxexe )
Table 3 Finding suspicious network connections
Filter for Text-based filter
Remote Desktop Protocol (RDP) connections on a specifiedendpoint
Event_Type_Id8007 AND ( Source_Port3389 OR
Destination_Port3389 ) AND Device_NameltHOSTNAMEgt
For enriched eventsRule_NameeRemoteDesktopProtocol AND
Device_NameltHOSTNAMEgt
7
Table 4 Finding suspicious registry changes
Filter for Text-based filter
Display persistence (Run Key) AddsThreat_Category_NameLoad Point Modification AND Disposition1
ChangesThreat_Category_NameLoad Point Modification AND
Disposition2
DeletesThreat_Category_NameLoad Point Modification AND
Disposition3
Table 5 Finding attempts to discover vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 6 Finding compliance and configuration vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 7 Finding Java malware trojans and exploits
Filter for Text-based filter
JAR files written to AppData Event_Type_Id8003 AND Disposition1 AND File_Namejar AND
File_Folderappdataroaming
Javaexe process thats writing executablefiles
Event_Type_Id8003 AND Disposition1 AND File_Family3 AND
Actor_File_Namejavaexe
Find the child process of whoamispawning under the Javaexe process
Actor_File_Namejavaexe AND Process_Namewhoamiexe
Table 8 Finding attempts to deliver malicious code
Filter for Text-based filter
A Word document attachment containing aclicked link followed by a browser download
Actor_File_Namewinwordexe AND Process_Namechromeexe
8
Table 9 Finding threat campaign activity
Filter for Text-based filter
The last 30 days of network connections toknown Dofoil
Event_Type_Id8007 AND Destination_IP( 13959208246
1302557390 313135232 )
9
Event Summary Type IDs
Event Summary Type IDsEvent Summary data is organized by type_id description For example if you are analyzing Vantage events this isrepresented in as 4113 Vantage Detection To learn more about Event Summary field descriptions see the Search FieldsReference Guide
Table 10 Type_ids
Event type and ID number Description1 Application Activity Reports status information about an application activity an end
user performed For example an administrator runs a databasesearch or endpoint search Or the administrator runs a commandline interface command (eg expand_storage)
20 User Session Audit Reports user logon and logoff activity at a management console ora managed client
21 Entity Audit Reports activity by a managed client a micro service or a userat a management console The activity can be a create updateand delete operation on a managed entity For example the Policyservice records policy change events the SEP client reports localpolicy changes and the policy administrator updates policies atthe console
238 Device Control Reports a device control disabled device239 Device Control Reports a buffer overflow event240 Device Control Reports software protection has thrown an exception502 Application Control Reports agent behavior events1000 System Health Reports any change to a components health which impacts
overall health of the appliance software or hardware Forexample DB Connection failuresuccess Low Disk or HighCPU
8000 Session Event Reports when a user attempts a log on or log off successfully orotherwise
8001 Process Event Reports when a process launches terminates or opens anotherprocess successful or otherwise
8002 Module Event Reports when a process loads or unloads amodule8003 File Event Reports operations on file system objects8004 Directory Event Reports operations on directories8005 Registry Key Event Reports actions on Windows registry keys8006 Registry Value Event Reports actions on Windows registry values8007 Network Event Reports attempted network connections successful or otherwise8009 Kernel Event Reports when an actor process creates reads or deletes a kernel
object8080 Session Query Result Reports information on existing user sessions8081 Process Query Result Reports information on a running process
10
8082 Module Query Result Reports information on loaded modules8083 File Query Result Reports information on file system objects8084 Directory Query Result Reports directory information8085 Registry Key Query Result Reports information on Windows Registry keys8086 Registry Value Query Result Reports information on Windows Registry values8089 Kernel Object Query Result Reports information on kernel objects8090 Service Query Result Reports information service queries8099 Query Command Errors Reports information on EOC (Evidence of Compromise Query
command errors8103 File Remediation Reports information on file system objects8119 File Remediation Errors Reports information on errors that result from an EOC (Evidence
of Compromise) file remediation action
11
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Filter for Text-based filter
The processes that run from User Profile file paths Event_Type_Id8001 AND
Disposition1 AND
Process_Normalized_Path
CSIDL_PROFILE
Any running service binaries that are not in the System32directory
( Event_Type_Id8001 AND
Disposition1 ) AND
Actor_File_Name
servicesexe AND
Process_Normalized_Path
CSIDL_SYSTEM
Any instances of Svchost where the parent process is notservicesexe
Event_Type_Id8001 AND Disposition1
Process_Namesvchostexe
Actor_File_Name-servicesexe
A specified service name Process_Name
ltSERVICE_NAMEgt
AND Event_Type_Id8001
AND Disposition1
Any CreateService events Rule_Name
( eModifyExistingService eNewService )
Any non-System32 binaries running as a hosted service ( Registry_Value_Path
HKEY_LOCAL_MACHINESYSTEM
CurrentControlSet
ServicesParameter
AND Registry_Value_NameServiceDll )
AND Registry_Value_Data-SYSTEM32
Attachments launched from Outlook that areassociated with one of the following document readerswinwordexe excelexe or POWERPNTexe
Event_Type_Id8001 AND Disposition1 AND
Actor_Command_Linecontentoutlook AND
Actor_File_Name(winwordexe powerpntexe excelexe)
Links opened from Outlook within a specific time frame Actor_File_Nameoutlookexe AND Process_Name( chromeexe
iexplorerexe firefoxexe )
Table 3 Finding suspicious network connections
Filter for Text-based filter
Remote Desktop Protocol (RDP) connections on a specifiedendpoint
Event_Type_Id8007 AND ( Source_Port3389 OR
Destination_Port3389 ) AND Device_NameltHOSTNAMEgt
For enriched eventsRule_NameeRemoteDesktopProtocol AND
Device_NameltHOSTNAMEgt
7
Table 4 Finding suspicious registry changes
Filter for Text-based filter
Display persistence (Run Key) AddsThreat_Category_NameLoad Point Modification AND Disposition1
ChangesThreat_Category_NameLoad Point Modification AND
Disposition2
DeletesThreat_Category_NameLoad Point Modification AND
Disposition3
Table 5 Finding attempts to discover vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 6 Finding compliance and configuration vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 7 Finding Java malware trojans and exploits
Filter for Text-based filter
JAR files written to AppData Event_Type_Id8003 AND Disposition1 AND File_Namejar AND
File_Folderappdataroaming
Javaexe process thats writing executablefiles
Event_Type_Id8003 AND Disposition1 AND File_Family3 AND
Actor_File_Namejavaexe
Find the child process of whoamispawning under the Javaexe process
Actor_File_Namejavaexe AND Process_Namewhoamiexe
Table 8 Finding attempts to deliver malicious code
Filter for Text-based filter
A Word document attachment containing aclicked link followed by a browser download
Actor_File_Namewinwordexe AND Process_Namechromeexe
8
Table 9 Finding threat campaign activity
Filter for Text-based filter
The last 30 days of network connections toknown Dofoil
Event_Type_Id8007 AND Destination_IP( 13959208246
1302557390 313135232 )
9
Event Summary Type IDs
Event Summary Type IDsEvent Summary data is organized by type_id description For example if you are analyzing Vantage events this isrepresented in as 4113 Vantage Detection To learn more about Event Summary field descriptions see the Search FieldsReference Guide
Table 10 Type_ids
Event type and ID number Description1 Application Activity Reports status information about an application activity an end
user performed For example an administrator runs a databasesearch or endpoint search Or the administrator runs a commandline interface command (eg expand_storage)
20 User Session Audit Reports user logon and logoff activity at a management console ora managed client
21 Entity Audit Reports activity by a managed client a micro service or a userat a management console The activity can be a create updateand delete operation on a managed entity For example the Policyservice records policy change events the SEP client reports localpolicy changes and the policy administrator updates policies atthe console
238 Device Control Reports a device control disabled device239 Device Control Reports a buffer overflow event240 Device Control Reports software protection has thrown an exception502 Application Control Reports agent behavior events1000 System Health Reports any change to a components health which impacts
overall health of the appliance software or hardware Forexample DB Connection failuresuccess Low Disk or HighCPU
8000 Session Event Reports when a user attempts a log on or log off successfully orotherwise
8001 Process Event Reports when a process launches terminates or opens anotherprocess successful or otherwise
8002 Module Event Reports when a process loads or unloads amodule8003 File Event Reports operations on file system objects8004 Directory Event Reports operations on directories8005 Registry Key Event Reports actions on Windows registry keys8006 Registry Value Event Reports actions on Windows registry values8007 Network Event Reports attempted network connections successful or otherwise8009 Kernel Event Reports when an actor process creates reads or deletes a kernel
object8080 Session Query Result Reports information on existing user sessions8081 Process Query Result Reports information on a running process
10
8082 Module Query Result Reports information on loaded modules8083 File Query Result Reports information on file system objects8084 Directory Query Result Reports directory information8085 Registry Key Query Result Reports information on Windows Registry keys8086 Registry Value Query Result Reports information on Windows Registry values8089 Kernel Object Query Result Reports information on kernel objects8090 Service Query Result Reports information service queries8099 Query Command Errors Reports information on EOC (Evidence of Compromise Query
command errors8103 File Remediation Reports information on file system objects8119 File Remediation Errors Reports information on errors that result from an EOC (Evidence
of Compromise) file remediation action
11
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Table 4 Finding suspicious registry changes
Filter for Text-based filter
Display persistence (Run Key) AddsThreat_Category_NameLoad Point Modification AND Disposition1
ChangesThreat_Category_NameLoad Point Modification AND
Disposition2
DeletesThreat_Category_NameLoad Point Modification AND
Disposition3
Table 5 Finding attempts to discover vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 6 Finding compliance and configuration vulnerabilities
Filter for Text-based filter
Attempts to list users or groups usingnetexe commandsDisplay persistence (RunKey)
(Event_Type_Id8001 AND Disposition1 ) AND
Process_Namenetexe AND (Process_Command_Lineuser OR
Process_Command_Linegroup) AND
Process_Command_Line-user
Table 7 Finding Java malware trojans and exploits
Filter for Text-based filter
JAR files written to AppData Event_Type_Id8003 AND Disposition1 AND File_Namejar AND
File_Folderappdataroaming
Javaexe process thats writing executablefiles
Event_Type_Id8003 AND Disposition1 AND File_Family3 AND
Actor_File_Namejavaexe
Find the child process of whoamispawning under the Javaexe process
Actor_File_Namejavaexe AND Process_Namewhoamiexe
Table 8 Finding attempts to deliver malicious code
Filter for Text-based filter
A Word document attachment containing aclicked link followed by a browser download
Actor_File_Namewinwordexe AND Process_Namechromeexe
8
Table 9 Finding threat campaign activity
Filter for Text-based filter
The last 30 days of network connections toknown Dofoil
Event_Type_Id8007 AND Destination_IP( 13959208246
1302557390 313135232 )
9
Event Summary Type IDs
Event Summary Type IDsEvent Summary data is organized by type_id description For example if you are analyzing Vantage events this isrepresented in as 4113 Vantage Detection To learn more about Event Summary field descriptions see the Search FieldsReference Guide
Table 10 Type_ids
Event type and ID number Description1 Application Activity Reports status information about an application activity an end
user performed For example an administrator runs a databasesearch or endpoint search Or the administrator runs a commandline interface command (eg expand_storage)
20 User Session Audit Reports user logon and logoff activity at a management console ora managed client
21 Entity Audit Reports activity by a managed client a micro service or a userat a management console The activity can be a create updateand delete operation on a managed entity For example the Policyservice records policy change events the SEP client reports localpolicy changes and the policy administrator updates policies atthe console
238 Device Control Reports a device control disabled device239 Device Control Reports a buffer overflow event240 Device Control Reports software protection has thrown an exception502 Application Control Reports agent behavior events1000 System Health Reports any change to a components health which impacts
overall health of the appliance software or hardware Forexample DB Connection failuresuccess Low Disk or HighCPU
8000 Session Event Reports when a user attempts a log on or log off successfully orotherwise
8001 Process Event Reports when a process launches terminates or opens anotherprocess successful or otherwise
8002 Module Event Reports when a process loads or unloads amodule8003 File Event Reports operations on file system objects8004 Directory Event Reports operations on directories8005 Registry Key Event Reports actions on Windows registry keys8006 Registry Value Event Reports actions on Windows registry values8007 Network Event Reports attempted network connections successful or otherwise8009 Kernel Event Reports when an actor process creates reads or deletes a kernel
object8080 Session Query Result Reports information on existing user sessions8081 Process Query Result Reports information on a running process
10
8082 Module Query Result Reports information on loaded modules8083 File Query Result Reports information on file system objects8084 Directory Query Result Reports directory information8085 Registry Key Query Result Reports information on Windows Registry keys8086 Registry Value Query Result Reports information on Windows Registry values8089 Kernel Object Query Result Reports information on kernel objects8090 Service Query Result Reports information service queries8099 Query Command Errors Reports information on EOC (Evidence of Compromise Query
command errors8103 File Remediation Reports information on file system objects8119 File Remediation Errors Reports information on errors that result from an EOC (Evidence
of Compromise) file remediation action
11
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Table 9 Finding threat campaign activity
Filter for Text-based filter
The last 30 days of network connections toknown Dofoil
Event_Type_Id8007 AND Destination_IP( 13959208246
1302557390 313135232 )
9
Event Summary Type IDs
Event Summary Type IDsEvent Summary data is organized by type_id description For example if you are analyzing Vantage events this isrepresented in as 4113 Vantage Detection To learn more about Event Summary field descriptions see the Search FieldsReference Guide
Table 10 Type_ids
Event type and ID number Description1 Application Activity Reports status information about an application activity an end
user performed For example an administrator runs a databasesearch or endpoint search Or the administrator runs a commandline interface command (eg expand_storage)
20 User Session Audit Reports user logon and logoff activity at a management console ora managed client
21 Entity Audit Reports activity by a managed client a micro service or a userat a management console The activity can be a create updateand delete operation on a managed entity For example the Policyservice records policy change events the SEP client reports localpolicy changes and the policy administrator updates policies atthe console
238 Device Control Reports a device control disabled device239 Device Control Reports a buffer overflow event240 Device Control Reports software protection has thrown an exception502 Application Control Reports agent behavior events1000 System Health Reports any change to a components health which impacts
overall health of the appliance software or hardware Forexample DB Connection failuresuccess Low Disk or HighCPU
8000 Session Event Reports when a user attempts a log on or log off successfully orotherwise
8001 Process Event Reports when a process launches terminates or opens anotherprocess successful or otherwise
8002 Module Event Reports when a process loads or unloads amodule8003 File Event Reports operations on file system objects8004 Directory Event Reports operations on directories8005 Registry Key Event Reports actions on Windows registry keys8006 Registry Value Event Reports actions on Windows registry values8007 Network Event Reports attempted network connections successful or otherwise8009 Kernel Event Reports when an actor process creates reads or deletes a kernel
object8080 Session Query Result Reports information on existing user sessions8081 Process Query Result Reports information on a running process
10
8082 Module Query Result Reports information on loaded modules8083 File Query Result Reports information on file system objects8084 Directory Query Result Reports directory information8085 Registry Key Query Result Reports information on Windows Registry keys8086 Registry Value Query Result Reports information on Windows Registry values8089 Kernel Object Query Result Reports information on kernel objects8090 Service Query Result Reports information service queries8099 Query Command Errors Reports information on EOC (Evidence of Compromise Query
command errors8103 File Remediation Reports information on file system objects8119 File Remediation Errors Reports information on errors that result from an EOC (Evidence
of Compromise) file remediation action
11
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Event Summary Type IDs
Event Summary Type IDsEvent Summary data is organized by type_id description For example if you are analyzing Vantage events this isrepresented in as 4113 Vantage Detection To learn more about Event Summary field descriptions see the Search FieldsReference Guide
Table 10 Type_ids
Event type and ID number Description1 Application Activity Reports status information about an application activity an end
user performed For example an administrator runs a databasesearch or endpoint search Or the administrator runs a commandline interface command (eg expand_storage)
20 User Session Audit Reports user logon and logoff activity at a management console ora managed client
21 Entity Audit Reports activity by a managed client a micro service or a userat a management console The activity can be a create updateand delete operation on a managed entity For example the Policyservice records policy change events the SEP client reports localpolicy changes and the policy administrator updates policies atthe console
238 Device Control Reports a device control disabled device239 Device Control Reports a buffer overflow event240 Device Control Reports software protection has thrown an exception502 Application Control Reports agent behavior events1000 System Health Reports any change to a components health which impacts
overall health of the appliance software or hardware Forexample DB Connection failuresuccess Low Disk or HighCPU
8000 Session Event Reports when a user attempts a log on or log off successfully orotherwise
8001 Process Event Reports when a process launches terminates or opens anotherprocess successful or otherwise
8002 Module Event Reports when a process loads or unloads amodule8003 File Event Reports operations on file system objects8004 Directory Event Reports operations on directories8005 Registry Key Event Reports actions on Windows registry keys8006 Registry Value Event Reports actions on Windows registry values8007 Network Event Reports attempted network connections successful or otherwise8009 Kernel Event Reports when an actor process creates reads or deletes a kernel
object8080 Session Query Result Reports information on existing user sessions8081 Process Query Result Reports information on a running process
10
8082 Module Query Result Reports information on loaded modules8083 File Query Result Reports information on file system objects8084 Directory Query Result Reports directory information8085 Registry Key Query Result Reports information on Windows Registry keys8086 Registry Value Query Result Reports information on Windows Registry values8089 Kernel Object Query Result Reports information on kernel objects8090 Service Query Result Reports information service queries8099 Query Command Errors Reports information on EOC (Evidence of Compromise Query
command errors8103 File Remediation Reports information on file system objects8119 File Remediation Errors Reports information on errors that result from an EOC (Evidence
of Compromise) file remediation action
11
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
8082 Module Query Result Reports information on loaded modules8083 File Query Result Reports information on file system objects8084 Directory Query Result Reports directory information8085 Registry Key Query Result Reports information on Windows Registry keys8086 Registry Value Query Result Reports information on Windows Registry values8089 Kernel Object Query Result Reports information on kernel objects8090 Service Query Result Reports information service queries8099 Query Command Errors Reports information on EOC (Evidence of Compromise Query
command errors8103 File Remediation Reports information on file system objects8119 File Remediation Errors Reports information on errors that result from an EOC (Evidence
of Compromise) file remediation action
11
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Quick Filter Description
Quick filter descriptionsQuick filters let you rapidly select and apply commonly used filters to search results Database Events quick filter groupsare the event types such as Security Technology Detections Malicious Activity and File Activity
Search Database Events quick filters
The following table lists the quick filters that are available in the Add Filter pop-up dialog on the Database Events searchpage
Table 11 Database Events quick filters
Quick filter DescriptionSecurity Technology Detections The filters in this group display the events the chosen detection
technology detectsSONAR detection Lists the events that SONAR (Symantec Online Network for
Advanced Response) detects SONAR is a real-time protectionthat detects potentially malicious applications when they run onyour computers SONAR provides zero-day protection becauseit detects threats before traditional virus and spyware detectiondefinitions have been created to address the threats
Sandbox Detection Lists the events that sandboxing-detection technology such asCynic and Malware Analysis detects Sandboxing refers to runningpotentially dangerous files and in a functionally isolated computingenvironment to analyze them for malicious behavior
Insight Detection Lists the events that Insight detects Insight is the Symantecreputation database with reputation intelligence on over 8 billionfiles This service gathers information about Windows executablefiles
Vantage Detection Lists the events that Vantage detects Vantage is the Symantecdetection engine that finds threats in the network stream Vantagedetects malicious activity on an endpoint or Vantage signature-based threats that are found in the network environment
Antivirus Detection Lists the events that antivirus software detectsEmail - Not Blocked Lists the malicious emails that are delivered to a users InboxMalicious Event Lists the events exhibiting malicious behaviorCommercial Blacklist The filters in this group display the blacklisted items from a user-
generated or commercial blacklistBlacklist Detection Lists the items that your own blacklist (user blacklist) blocksDeepSight Enriched Events Lists the events that are blocked based on DeepSight Enriched
Events DeepSight is a Symantec technology that uses a globalwarning threat detection system to aggregate threat informationinto a central database Enriched Events refers to events forwhich DeepSight provides additional forensic information
DAI Detections Lists the events that Dynamic Adversary Intelligence (DAI)detects DAI is a Symantec feed that provides detailed informationabout the attackers that conduct targeted attacks
12
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Machine Learning The filters in this group display files that the selected machine-learning technology identifies
Criterion Lists the items that the Criterion machine-learning engine detectsCriterion detects files in the gray region between known good andknown bad In this range Criterion detects the files that are morelikely to be malicious
Sapient Lists the items that the Sapient machine-learning engine detectsSapient (Advanced Machine Learning) can detect malwarebased on static attributes This technology enables SymantecEndpoint Protection to detect malware in the pre-execution phasethereby stopping large classes of malware both known andunknown
File Activity Quick filters in this group display the files that are associated withthe selected file activity
Signed File Lists the signed and trusted files within the environmentFile Create Lists the file creation events within the environmentFile Delete Lists the file deletion events within the environmentSuspicious Activity Quick filters in this group display suspicious activity by the chosen
activity typeUnsigned File Lists the files that are unsigned or signed but not trustedSONAR Behaviors Lists the SONAR-based information regarding changes or
behaviors on the endpoints in your environment that you shouldmonitor
PE launched from CLI Lists Portable Executable (PE) files that are launched from acommand line interface
Endpoint Recording Behaviors Lists the instances where endpoint recording has taken place onone or more endpoints
Process Injection Lists the instances of process injection Process injection is acollection of techniques that runs code within the address space ofanother process and are generally considered malicious detectsthree types of file injectionbull Remote Shell code executionbull Reflective DLL injectionbull Interception of Windows messages
Estate Statistics Quick Filters in this group display files that typically should not bein the C Windows directories
Unsigned PE in system Lists unsigned or signed but untrusted Portable Executable (PE)files in Windows system folders
PE in temp Lists Portable Executable (PE) processes run from the WindowsTemp folders
Non-system files in system Lists the non-system files in Windows system foldersPersistence Quick filters in this group display persistent load point activity on
computers in the environmentLoad Point Lists the persistent behavior at computer load points For instance
fileless persistence techniques using JScript or VBS in theWindows Registry
13
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Dual-use Tools Detections Dual-use tools refer to tools that can be used legitimately but areoften used maliciously These include the followingbull Microsoft PowerShellbull Mimikatzbull PsExec
PowerShell Launch Lists the instances of PowerShell launched on one or morecomputers in the environment
Suspicious Process Launch Lists the instances of suspicious processes that are launched onone or more computers in the environment
Memory Analysis Filters in this group display the results from the technologies thatdetect malicious use of computer memory to exploit vulnerabilities
Proactive Exploit Prevention Lists the instances where Proactive Exploit Prevention preventsexploits from several malicious behaviors that are commontrademarks of zero-day attacks For instancebull Blocking any attempt to disable the Java Security Managerbull Heap spray preventionbull Protection against overwriting of the Structured Exception
Handler
Office Applications Filters in this group display the events that are often associatedwith the attacks that leverage Microsoft Office applications
Process Launch Lists the instances of processes that are launched on one or morecomputers in the environment
PE Creation Lists the instances where a Portable Executable (PE) is createdPE Injection Lists the instances where a PE is injected into the address space
of another processMITRE Tactic Filters in this group display the events that are often associated
with the attack methods defined in the MITRE ATTampCK Matrix Formore information see httpsattackmitreorg
Initial Access Initial Access techniques include targeted spearphishing andexploiting weaknesses on public-facing web servers For moreinformation see httpsattackmitreorgtacticsTA0001
Execution Execution techniques result in malicious code running on alocal or remote system For more information see httpsattackmitreorgtacticsTA0002
Persistence Persistence techniques allow an attacker to keep access tosystems after an interruption such as a reboot or accountchanges For more information seehttpsattackmitreorgtacticsTA0003
Privilege Escalation Privilege Escalation techniques are used to gain high-levelpermissions on a system or network For more information seehttpsattackmitreorgtacticsTA0004
Defense Evasion Defense Evasion techniques are used to avoid detection during anattack For more information see httpsattackmitreorgtacticsTA0005
Credential Access Credential Access techniques are used to steal accountcredentials For more information see httpsattackmitreorgtacticsTA0006
Discovery Discovery techniques are used to obtain information about thesystem and internal network For more information see httpsattackmitreorgtacticsTA0007
14
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Lateral Movement Lateral Movement techniques are used to enter and controlremote systems on a network An attacker uses these techniquesto explore the network For more information see httpsattackmitreorgtacticsTA0008
Collection Collection techniques gather information relevant to completingthe attackers goals For more information see httpsattackmitreorgtacticsTA0009
Exfiltration Exfiltration techniques are used to steal data from your networkFor more information see httpsattackmitreorgtacticsTA0010
Command and Control Command and Control techniques are used to communicate withsystems under an attackers controlFor more information seehttpsattackmitreorgtacticsTA0011
Search Database Entities quick filtersQuick filters let you rapidly select and apply commonly used filters to search results Database Entities quick filters groupsare the entity status types such as Disposition Entity and Endpoint State The following table lists the Quick filters thatare available on the Database Entities search page
Table 12 Database Entities quick filters
Quick filter escriptionDisposition This group of filters displays results based on the chosen file
dispositionGood Lists the files that are flagged with disposition = GoodBad Lists the files that are flagged with disposition = BadSuspicious Lists the files that are flagged with disposition = SuspiciousUnknown Lists the files that are flagged with disposition = UnknownEntity This group of filters displays results based on the chosen entity
typeEndpoint Lists the endpoint entitiesFile Lists the file entitiesDomain Lists the domain entitiesEnrollment This group of filters displays results based on EDR statusEnrolled The client is enrolled with EDR 20In Progress s in the process of provisioning the device for enrollmentAuthentication Pending inished provisioning the client for enrollment and sent the logon
credentials to waits for the client authentication process tocomplete so the enrollment process can finish
Unenrolled The client had been enrolled with EDR but it has subsequentlybeen unenrolled
Unsupported This status can appear in any one of the following situationsbull The client is running an older version of which does not meet
the minimum version requirement For EDR enrollment theminimum supported version is SEP140 RU1
bull This status can also mean that the endpoint entity is createdfrom EDRN traffic So it doesnt have associated endpointdetails
bull The client operating system is not Windows (eg Mac)
15
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Endpoint State This group of filters displays results based on the activity state ofthe Symantec Endpoint Protection client
Not isolated Lists the endpoint clients that are activeIsolated Lists the endpoint clients that are not active
Search Endpoint quick filtersQuick filters allow you to rapidly select and apply commonly used filters to the search results Endpoint quick filters aregrouped by Status and Type The following table lists lists the quick Filters that are available on the Endpoint searchpage
Table 13 Endpoint quick filters
Quick filter DescriptionStatus This group displays search results based on search statusIn Progress Lists the live and recorder searches that are in progressCompleted Lists the live and recorder searches that are completedError Lists the live and recorder searches that returned one or more
errorsType This group displays items based on search typeEndpoint Search Lists the endpoint searchesFull Dump Lists full dump searchesProcess Dump Lists process dump searches
16
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Creating and using text-based filters
Using text searchYou can manually create a search query using the industry-standard httpsluceneapacheorgcore2_9_4queryparsersyntaxhtml Some limits apply
Lucene expression examples
To open the query editor click on the ltgt icon to the right of the Time Range label
To help you save time when you start typing a field name into the query builder the search engine looks ahead and startslisting fields according to the characters you enter
List of search fields
NOTE
Each search field has a specific data type such as boolean text integer etc The operators you can use varyby the field data type
Query and filter operators by data type
For text type search fields you can use tokens
In the query builder if you enter the text type field followed by a then the option token is listed
17
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Select the token and enter the token value to complete the search
Syntax Fieldtokenvalue
For example Actor_App_Nametokentest_app
Here the token value used is test_app
For more information on search fields refer to the article httpssupportsymanteccomusenarticleDOC11605html
You can also search for events by just entering the values youre looking for (without event types field names etc) Forexample a search for chromeexe events from device abc-client is chromeexe AND abc-client
Be aware of the following
bull Term types There are two kinds of terms single terms and phrases Use double quotes () around phrases and wordsthat contain special characters
bull Wildcards The single character wildcard is used within a term to replace a single letter For instance tet returnstest and text The multiple character wildcard is used to replace 0 or more characters For instance test returns testtests and tester
NOTE
You cant use a or symbol as the first character in a query
NOTE
The following characters must be escaped [ ] ( ) ldquo ~
File name search examples
What to search for Text Filter
Files names File_PathCwindowssystem32cmdexeFile name search using wildcards File_PathCwindowssystem32File name with any drive letter File_Pathwindowssystem32File names containing space File_Pathcprogram filessymantec
18
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
What to search for Text Filter
File name search using regex Specify_regex_within_forward_slashes
Note You can specify the entire Windows file path within the regex query
Filtering events
Filtering incidents
Lucene expression examplesThe following examples are organized by operator gt field data type
Equals
Data type
bull Boolean- Boolean_Fieldtrue Boolean_Fieldfalsebull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- free_form_text_to_search
Not equals
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldint_valuebull IP- IP_Fieldipv4_or_ipv6bull Long- Long_Fieldlong_valbull String- text- String_Fieldstring_valuebull Enum- Enum_Fieldenum_valuebull MD5- MD5_Fieldmd5_valuebull SHA2- SHA2_Fieldsha2_valuebull SHA1- SHA1_Fieldsha1_valuebull Free-form search- Not supported
Is one of
Data type
19
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
bull Boolean- NAbull Date- NAbull Integer- Integer_Field(int_value_1 int_value_2 )bull IP- IP_Field(ipv4_or_ipv6_1 ipv4_or_ipv6_2 )bull Long- Long_Field(long_val_1 long_val_2 )bull String text- String_Field(string_value_1 string_value_2 )bull Enum- Enum_Field(enum_value_1 enum_value_2 )bull MD5- MD5_Field(md5_value_1 md5_value_2 )bull SHA2- SHA2_Field(sha2_value_1 sha2_value_2 )bull SHA1- SHA1_Field(sha1_value_1 sha1_value_2 )bull Free-form search- Not supported
Is between
Data type
bull Boolean- NAbull Date- Date_Field [epoc_millis_from TO epoc_millis_to]bull Integer- Integer_Field[int_value_from TO int_value_to]bull IP- IP_Field[ipv4_or_ipv6_from TO IP_Fieldipv4_or_ipv6_to]bull Long- Long_Field[long_val_from TO long_val_to]bull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than
Data type
bull Boolean- NAbull Date- Date_Fieldgtepoc_millisbull Integer- Integer_Fieldgtint_valuebull IP- NAbull Long- Long_Fieldgtlong_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than
Data type
20
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
bull Boolean- NAbull Date- Date_Fieldltepoc_millisbull Integer- Integer_Fieldltint_valuebull IP- NAbull Long- Long_Fieldltlong_valbull String text- NAbull Enum-NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Greater than or equal to
Data type
bull Boolean- NAbull Date- Date_Fieldgt=epoc_millisbull Integer- Integer_Fieldgt=int_valuebull IP- NAbull Long- Long_Fieldgt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not supported
Less than or equal to
Data type
bull Boolean- NAbull Date- NAbull Integer- Integer_Fieldlt=int_valuebull IP- NAbull Long- Long_Fieldlt=long_valbull String text- NAbull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search- Not Supported
Wildcard
Data type
21
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text
ndash String_Fieldprefix
ndash String_Fieldsuffix
ndash String_Fieldcontains_characters
ndash String_FieldOne_Characer
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search
ndash prefix
ndash suffix
ndash contains_characters
ndash One_Characer
Matches
Data type
bull Boolean- NAbull Date- NAbull Integer- NAbull IP- NAbull Long- NAbull String text- String_FieldRegex
NOTE
Regex is supported as per this httpswwwelasticcoguideenelasticsearchreference64query-dsl-regexp-queryhtml Regex that searches for word digit using w d etc is not supported The anchor characters ^ and$ are not supported
bull Enum- NAbull MD5- NAbull SHA2- NAbull SHA1- NAbull Free-form search-Not supported
Query and filter operators by data type
Using text search
List of search fields
Query and filter operators by data typeEach field that you can search or filter by has a specific data type such as boolean date text etc The operators youcan use when creating queries and filters vary by the data type The following table lists the data types and the availableoperators for each type
22
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
List of search fields
Table 14 Available operators by data type
Data Type EqualsNot
equals Is one ofIs
between Less thanGreater
thanLess thanor equals
Greaterthan orequals Wildcard Matches
Boolean YDate Y Y Y Y Y
Integer Y Y Y Y Y Y Y YIP Y Y Y Y
Long Y Y Y Y Y Y Y YString Y Y Y Y Y
Text Y Y Y Y YEnum Y Y Y
MD5 Y Y YSHA2 Y Y YSHA1 Y Y Y
NOTEIn the Text filter the Equals operator does not show results if you specify a value with double quotes You canuse the Regex or wildcard to search in the text filter view to narrow down the search results
Using text search
Filtering events
Filtering incidents
23
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24
Copyright statement
Broadcom the pulse logo Connecting everything and Symantec are among the trademarks of Broadcom
The term ldquoBroadcomrdquo refers to Broadcom Inc andor its subsidiaries For more information please visitwwwbroadcomcom
Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliabilityfunction or design Information furnished by Broadcom is believed to be accurate and reliable However Broadcom doesnot assume any liability arising out of the application or use of this information nor the application or use of any product orcircuit described herein neither does it convey any license under its patent rights nor the rights of others
24