Example search for intel

In this example, we will create two queries to search for the following events:

• Event 1: [{confidence: high, severity: low}, {confidence: low, severity: high}]

• Event 2: [{confidence: high, severity: high}, {confidence: low, severity: low}]

Example 1:

In this example we will use a query to compare an array of records in Event 1 and Event 2.

Query string:

intel.confidence = high & intel.severity = high	

What the query will do:

1. The two records are flattened into arrays of values for each field, so the query logic is applied to all values all at once and not to records individually.
2. The query is compared to the array of records in Event 1 and Event 2.

Response:

This query will return Event 1 and 2 because at least one inner object contains confidence=high and at least one inner object contains severity=high.

• Event 1: confidence =[high,low] and severity = [high,low]

• Event 2: confidence =[high,high] and severity = [high,low]

Example 2:

In this example, we will create a query to match individual objects of a nested field (such as intel, path, files, etc.).

Query string:

intel {confidence=high & severity=high}	

Response:

This query will only return Event 2 because at least one of the objects in the event meets both criteria.

• Event 2: confidence =[high,high] and severity = [low,low]