Investigate search query examples

For increased efficiency, you can use following Investigate search queries.

To learn how to perform Investigate searches, see Performing Investigate searches.

Find any emails sent to non-corporate domains (where there is one corporate domain)

Enter the following query, adding your corporate domain and excluding the angle brackets (<>):

email:all_recipient_domains != <your corporate domain>

Find any emails sent to non-corporate domains (where there are multiple corporate domains)

Enter the following query, adding your corporate domains and excluding the angle brackets (<>):

email:all_recipient_domains !in [<corporate domain 1>,<corporate domain 2>]

Find any emails sent to gmail.com

email:all_recipient_domains = gmail.com

Find any emails sent to gmail.com or yahoo.com

email:all_recipient_domains in [gmail.com,yahoo.com]

Find uploaded and downloaded files

browser:file_name exists

Find uploads to sites other than drive.google.com

browser:tab_url_hostname != drive.google.com and event_type = upload

Find files that have a filename starting with 'Customer'

alias:file_name : Customer*

Find nodes on which the 'Kill process' action was executed

action:action = kill_process

Find nodes on which the 'Kill process' action failed

action:action = kill_process and result = failed

Find users who have completed an online form

browser:navigation_transition_type = form_submit

Find users who have the Slack application window open

application:application_window_title : Slack*

Find users executing 'netsh' commands

process_start:process_binary_name = netsh.exe

Find users accessing torrent files

file_access:file_extension = torrent

Find users associated with high and critical detections

detection:score >= 70

Find nodes that have RDP connections from external IP addresses

network_connection:dst_port = 3389 and src_ip != 10.0.0.0/8 And src_ip != 172.16.0.0/12 and src_ip != 192.168.0.0/16

Find nodes running CMD.exe

alias:binary_name = cmd.exe