Searches and Filters
Search in FortiSOAR is based upon an included Elasticsearch database.
FortiSOAR provides you search at the following levels:
Global Search: Searches for the keywords you have specified across all records in FortiSOAR.
List Search: Searches for the keywords you have specified in all records in a specific module.
Filters: You can filter records belonging to a module and also save filters for future use.
You cannot search or filter encrypted fields.
Global Search searches the titles, descriptions, or tags across all records in FortiSOAR. You can also search for the name of the file and any other details that are associated with the file attachment. The file names should be descriptive to ensure that the file can be found through keyword searches related to the file content.
From version 7.0.2 onwards, you can perform an 'Exact Text Search' so that the search does not split up text with spaces, @, etc and the search results contain the complete text.
The Search bar at the top of the FortiSOAR interface allows for fast access to the Global Search feature. Entering any keyword in the Search bar and hitting
Enter begins the search for the keyword.
Using Global Search, you can search for playbooks, templates, etc., based on tags, name, and description. You can add special characters and spaces in tags; however, the following special characters are not supported in tags:
/. For example, if you have added
sample as a tag to the playbook and you type
sample in Global Search, the search results will contain the playbook with the
sample tag. Also, note that records that are in the recycle bin will not be visible in the Global Search results. For more information on the recycle bin, see the Recycle Bin chapter in the "Administration Guide."
If you want to search for tags in custom modules based on Tags, then you must ensure that you assign a minimum of Read permission to the custom module in a role(s) that has permissions on the Appliances module. This is required since custom modules require to be given permission in the playbook appliance for the record to get indexed and be searchable.
The Global Search function accessible from the Search bar uses the full-text match query function within Elasticsearch. This passes the search string through the standard analyzer, stripping any extra characters to the root term. For instance, the term
login failure would be searched the same way as the term
"Login Failure!", for text fields such as description or name as shown in the following image:
In the case of tags, search results will be displayed only in case of an exact match, without case sensitivity, for example, if you have added
phishing as a tag and you search for
phish, there will be no search results. However, if you search for
Phishing, you will get a search result:
You can search for multiple terms using the search function by adding a term in the Add Search Term field. If multiple terms are entered, they are searched using the
AND operation. FortiSOAR displays the results only when the results contain all the terms that you have entered.
Global Search also works for stop words such as dots, @, etc. For example, if you are searching for the text google.com, then the results are displayed for both
Search results are returned as a listing with a summary of the record metadata that provides information such as, the record name, the record type (the model of the record, such as an Incident), the created date and the last modified date of the record, and a contextual preview of the search term or terms position within the resulting record text.
You can set the Match Type as 'Broad Search' or 'Exact Text Search'. An exact text search does not split up text with spaces, @, etc and the search results contain the complete text. For example, set the match type as Exact Text Search, if you want to search for records that contain 'firstname.lastname@example.org'.
However, if you want to search records of that contain any mention of 'user01', then you can set the match type as Broad Search.
You can sort the search result by Relevance, which is based on the number of instances of the keyword within the record body. You can also sort the results by when the record was modified, the Most Recently Modified record or the Least Recently Modified record. Clicking on a search result displays the record details.
Filter By Pane
Use the Filter By pane to perform additional filtering of the results returned after a Global Search has been performed. When using the Filter bar, the term being searched on is applied directly to the already returned search results. This does not repeat the full-text match query from the Global Search function. This feature enables you to filter out a larger batch of returned results without repeating the search of the entire database.
For example, as shown in the previous image we had searched for the keyword
phishing using Global Search, and the search result had returned 3 results. Now we can perform additional filtering on the search results by adding an additional keyword,
AND operator, and then the search result displays 2 search results as shown in the following image:
The contextual preview of the term context from the original Global Search function is not updated with applied filters. The preview remains the same, but the records returned in the table are filtered according to the
AND combination of terms as displayed above in the table.
You can perform additional filtering in the
Filter By pane on the search results based on the
Date of the records. All modules are filterable. The date search uses the
Created On date field to filter the records based on the period you have specified. You can either specify the From and To dates, or select relative dates, such as Last 90 Days, Last 7 days, Today, etc. These additional filters refine the returned search results to the applied scope.
Global Search respects authorization permissions based on the context of the user who is performing the search. This means that records not owned by the user's teams, any child or sibling teams, or not within the user's role permissions scope, are not displayed within the results.
Searching Record Contents
All records, such as Incidents, Alerts, and Assets, are included in the Elasticsearch database in addition to Attachments. The record contents do not store field labels, Picklist values, or model information. This is so that the search results do not contain results based on the field label values or terms in the model information, which would lead to meaningless results. For instance, if you perform a Global Search for the keyword Source, the Global Search will not return any result even though in an Alert record, the term
Source, represents a field label in the record. Similarly,
Brute Force Attempt might be set as a picklist value of the
Type field in an Alert record, but the Global Search will not return any matches for
Brute Force Attempt even if records existed with that picklist value. However, you could search for the same using tags, if you have added tags to the record. For example, if you have added a tag BruteForceAttempt or BFA in the record, then you can search for that record using
FortiSOAR essentially searches the record content, i.e., text saved into the field values, such as the Name, or Description and also searches for tag values.
List Search searches for data or keywords across a module in FortiSOAR. The search also includes file attachments if they are part of any record within that module.
For list search, use the Search bar at the top of the record list in a particular module in FortiSOAR. Type any keyword in the Search bar and hit
Enter to begin the search for the keyword.
Term Matching, Authorization, etc., in 'List Search' works the same way as in 'Global Search.'
Searches for keywords in the search criteria row underneath the column header in the list (grid) view of a module. You can either specify the keyword or select an option from the picklist or lookup fields.
For example, to search for alerts that have 'repeated' in their name and whose status is set as 'Open', enter
rep in the name search criteria row underneath the column header and select Open from the 'Status' picklist:
From release 7.2.1 onwards, a new option Not Set is added so that you can filter data (picklist or lookup fields) that has empty (not set) values in a grid. For example, to search for alerts whose 'Status' or 'Type' is not set.
Search results are returned in a tabular format as shown in the following image:
The above image displays the results of a search performed in the
Alerts module, with the keywords malware. The search results are displayed in a tabular form, and you can use the Menu button to specify the visible columns in the table by selecting or deselecting the columns from the Columns list. You can also choose to export the table results to a
.csv or a
FortiSOAR Search Errors
FortiSOAR might display an
Internal Server Error or any of the following errors when you are performing a search operation in FortiSOAR:
Search indexing is in progress. Partial results are returned.
Search indexing has stopped. You must manually rerun indexing (see product documentation for instructions) or raise support ticket for the same.
We are sorry, but the server encountered an error while handling your search request. Please contact your administrator for assistance.
For troubleshooting any errors with FortiSOAR Search, please contact your administrator.
You can filter records on the listing view by typing the filter term, tag, or selecting the option on which you want to filter records based on the column headers. You can also specify complex conditional filters on the records in the module listing page using the 'Advanced Filter'.
Users can quickly and easily switch between saved filters since filters are directly exposed on the grid, making it easy for you to select and apply available saved filters without having to open the filter editing mode. In the filter editing mode, you can easily view and modify the filter definitions of a saved filter, without having to save that particular filter (you can save the modified filter if you want). You can also easily clear all or a particular filter applied on the grid.
To filter records, you can use two types of filters:
- Simple Filters: Used for filtering of records using a combination of columns.
- Advanced Filters: Used for complex sorting and filtering of records.
You can use simple filters on the module records grid to filter records based on a combination of columns.
The following example explains how to filter alert records based on Severity, i.e., it only displays records whose Severity is set to Critical. In this example, you are setting a filter criterion from the UI, i.e., selecting a column (field) based on which you are filtering records.
Open the Incidents Response > Alerts. From the
Severity column select Critical and click Apply.
Once you click Critical as shown in the above image and click Apply, a filter is set on the
Severity column, and the value of the filter is set to Critical. Therefore, based on the set filter criterion, only records whose
Severity is Critical are displayed in the list of records as shown in the following image:
To clear all the filters applied on the grid, click Clear All.
To edit a filter, click the Filter icon to see the filter criteria. You can save the filter for future use by clicking the Save Filter button. When you click the Save Filter button, the
Save New Filter dialog is displayed. In this dialog, type the name of the filter in the Name field and click Save. For example, type the filter name as Critical Alerts and click Save. If you are an administrator, then you can also save a filter as a System Filter by clicking Save Filter > Save As System. System Filters are displayed to all users of the system:
In the filter editing mode, you can perform the following operations:
- Save a filter (user-specific or system).
- Edit the name of an existing filter by clicking the Edit Name icon
- Mark an existing filter as a default filter by clicking the Set Default Filter (star) icon.
- Delete an existing filter by clicking the Save Filter drop-down list and selecting the Delete option.
- To remove a particular filter criterion that has been applied to the grid, click the Clear Filter Criteria link.
Click the Filters icon to view a list of all existing filters that have been defined for the grid or record, as shown in the following image:
Using this filtering option, you can filter records using only the AND condition; for example, you can filter records whose Type is Phishing AND Status is Investigating. When you apply this filter, in our example, only one record is displayed, as shown in the following image:
You cannot use the OR condition to filter records using this method.
You can also filter records displayed in the module's grid while defining the grid (using the 'Grid' widget) in the listing view using the Nested Filters component. The Nested Filters component allows you to filter group conditions at varying levels and use AND and OR logical operators. See the Dashboards, Templates, and Widgets chapter for information on the Grid widget and the Nested Filters component.
The filter condition defined on the listing view will override the filter condition defined in the grid widget.
The filter operator for date fields includes many pre-defined options such as Last Year, Last 7 days, Next 24 hours, etc., making it easier for you to filter records for a relative time range of your choice. You can also now specify static custom date ranges for filters. For information on what defines a time range in a filter, see the Nested Filters section in the Dashboards, Templates, and Widgets chapter.
For example, if you want to filter alerts that were assigned in the last 24 hours and whose severity is High, do the following:
Click High in the Severity column and then in the Search box in the Assigned Date column and select Last 24 Hours:
Filtered alerts are displayed as shown in the following image:
Select the Custom option to filter records according to custom static date ranges. For example, select Custom, and in the
Define Custom Date Range dialog, from the From date field, select the date and time from the Calendar, from when you want to filter records, for example,
01/01/2022 02:00 PM, and in the To field, select the date and time till when you want to filter records, for example,
04/01/2022 09:00 AM:
You can use the 'Advanced Filter' to apply conditional filters to the grid columns on the module listing page. You can achieve complex sorting and filtering of records as well as setting a default view per user using the advanced filter.
To create an advanced filter, navigate to the module's listing page, for example, the 'Alerts' page. Click the Filter icon to display the 'Create Advanced Filter' button. Click Create Advanced Filter button to display the
Created Advanced Grid Filter dialog, in which you can define complex filter conditions. An example of complex conditions used to filter alert records on the grid view could be the filtering of 'High' or 'Critical' alert records whose type is either 'Other / Unknown' or 'Suspicious Email' and whose status is set to 'Investigating'. To create this filter in the
Created Advanced Grid Filter dialog, enter a name for the filter and the complex conditions as shown in the following image:
You can save this filter as a 'User' filter, i.e., this filter will be visible only to that particular user by clicking Save as User. Or, if you are an administrator, then you can also save this filter as a 'System' filter, i.e., this filter will be visible to all users of the system by clicking Save As System. For our example, we have saved the filter as a 'User' filter. Once the advanced filter is applied, the 'Alerts' page displays a filtered list of alerts in the grid. To clear all the filters applied on the grid, click Clear All.
If you have refreshed the browser and want to reapply a created filter on the grid, click the 'Filter' drop-down list and then select the filter that you want to apply, for example, the 'Filter 'Investigation' Alerts' filter. To edit this filter, click Filter 'Investigation' Alerts again to display the filter editing mode:
In the filter editing mode, you can perform the following operations:
- Edit the existing filter, including updating the name and/or conditions of the filter by clicking 'click here' to open the
Update Advanced Grid Filterdialog.
- Mark the existing filter as a default filter by clicking the Set Default Filter (star) icon.
- Delete the existing filter by clicking Delete Advanced Filter.
You can apply column filters on top of the selected advanced filters. For example, further filtering the records based on the 'Source column':
However, the column filters do not get appended to the advanced filter, i.e., the applied column filters are not reflected when you edit the advanced filter.