Overview
The Snare advanced events search capability allows you to build structured queries using the Snare Query Language (SnareQL) to search for events.
...
Note, SnareQL is not a database query language, even though it uses a subset and superset of SQL syntax.
SnareQL
SnareQL queries consist of query components, joined by logic operators.
...
In addition, some functions are available that can modify perform calculations based on field contents.
| Code Block |
|---|
USERNAME='AJSMITH' AND EVENTID LIKE '%login' AND MINUTE(TIME) < 15 AND DATE='today' |
This query will search for logins by AJSmith, in the first 15 minutes of each hour of the current day.
Precedence and Grouping in Queries
Snare query components prioritise ANDs over NOTs, and NOTs over ORs - however precedence can be explicitly specified using brackets.
...
To search for some IP addresses you will need to use the advanced search and escape the dot in the IP address as per this example. make sure you have a space at the end of the IP address to get an exact match or you may see other IP address addresses that start with the last octet.
| Code Block |
|---|
DATE='TODAY' AND ALLFIELDS REGEXI '(10\.1\.1\.1 |10\.1\.1\.2 ) ' |
Restricted words and characters
The range of characters you can use in your search values depends significantly on the operator you have chosen.
...
Content that includes space characters must be surrounded by EITHER single or double quotes.
EVENTID=loginEVENTID=”login failed”
If you wish to use single or double quotes as part of your search criteria, they must be escaped with the backslash character (\)
STRINGS CONTAINS “User: \”Fred\””
The INCLUDES operator uses commas to separate potential values. If you wish to use the comma as part of your search criteria, it is recommend that you use regular expressions instead.
...
The REGEX operators (REGEX, !REGEX, REGEXI, !REGEXI) have a range of reserved characters that represent particular features within a regular expression. These characters must be escaped with the backslash character (\) when used as a literal value, in most instances.
Special Case Values - DATE
Date recognition is flexible in SnareStore. The following date formats are recognised, using the associated operators text in italics is optional
Format | Valid Operators | Details |
|---|---|---|
YYYY-MM-DD | All | eg: DATE = 2017-06-23 |
TODAY | =,<,<=,>,>=,!= | The date on which the query was run |
NOW | =,<,<=,>,>=,!= | The date on which the query was run |
YESTERDAY | =,<,<=,>,>=,!= | The day prior |
TOMORROW | =,<,<=,>,>=,!= | The day after |
N | =,<,<=,>,>=,!= | Translates to "Current date/time minus N days" (for DATE) or "Current time minus N minutes" (for TIME). |
THIS TIME LAST WEEK | =,<,<=,>,>=,!= | The week prior |
THIS TIME NEXT WEEK | =,<,<=,>,>=,!= | The week after |
THIS TIME LAST YEAR | =,<,<=,>,>=,!= | The same date as the current date, one year prior |
THIS TIME NEXT YEAR | =,<,<=,>,>=,!= | The same date as the current date, one year after |
THE DAY AFTER TOMORROW | =,<,<=,>,>=,!= | Today + 2 days |
THE DAY BEFORE YESTERDAY | =,<,<=,>,>=,!= | Today - 2 days |
1ST OF THIS MONTH | =,<,<=,>,>=,!= | The first day of the month on which the query is run |
LAST OF THIS MONTH | =,<,<=,>,>=,!= | The last day of the month on which the query is run |
1ST OF LAST MONTH | =,<,<=,>,>=,!= | The first day of the previous month |
LAST OF LAST MONTH | =,<,<=,>,>=,!= | The last day of the previous month |
FIRST OF THE MONTH | =,!= | The first day of ANY month |
LAST MONDAY | =,<,<=,>,>=,!= | The date of the last supplied day |
NEXT MONDAY | =,<,<=,>,>=,!= | The date of the next supplied day |
MONDAY LAST WEEK | =,<,<=,>,>=,!= | The date associated with the supplied day. |
MONDAY NEXT WEEK | =,<,<=,>,>=,!= | The date associated with the supplied day. |
HH:MM:SS | =,<,<=,>,>=,!= | Take the number of hours, minutes and seconds supplied, add it to the local midnight (00:00:00) for the current date, and use the resulting date as a source. eg: 03:00:00, 17:00:00, and 23:59:59 would all result in the equivalent of NOW or TODAY eg: 25:00:00 would be the equivalent of TOMORROW eg: -01:00:00 would be the equivalent of YESTERDAY eg: 240:00:00 would be the equivalent of 10 days from now. |
THIS WEEK | <,<=,>,>=,=,!= | If the date is within the current week. Monday is assumed to be the first day of the week. |
LAST WEEK | <,<=,>,>=,=,!= | If the date is within last weeks range. Monday is assumed to be the first day of this week. |
NEXT WEEK | <,<=,>,>=,=,!= | If the date is within next weeks range. Monday is assumed to be the first day of next week. |
THIS YEAR | <,<=,>,>=,=,!= | If the date is within the current year. |
LAST YEAR | <,<=,>,>=,=,!= | If the date is in last years date range. |
NEXT YEAR | <,<=,>,>=,=,!= | If the date is within next years date range |
MONDAY | =,!= | If the date falls on the value supplied |
WEEKDAY | =,!= | If the date is a weekday |
WEEKEND | =,!= | If the date is a weekend |
FIRST OF THE YEAR | =,!= | If the date is the first day of any year (ie: January 1) |
JANUARY | =,!= | If the date is found within the specified month |
Reference
Component | Description | Reference |
|---|---|---|
Field | A field in SnareQL is a word that represents a field within a particular log type. | Events within each logtype log type are guaranteed by the Snare Central collection subsystem to include the following fields:
Depending on the source log type, events may also include fields such as:
The fields See Log Types for information on fields that are available for each type of log are detailed in a table belowlog type. Note that new log types are added on a regular basis. |
Operator | An operator in SnareQL is one or more symbols or words that compare the value of a field on its left with one or more values on its right. Some operators may use the negate symbol (!) to reverse the meaning - eg: !=, !REGEX |
|
Logical Element | A logical element in SnareQL is a word that joins two or more clauses together to forma form a complex SnareQL query |
|
Value | A string designed to represent the contents of a field in an event within the Snare Central datastore. The value may be a simple string, or a complex regular expression, depending on the operator selected. Quotations are optional for simple values comprising a single word. Single or double quotes are recommended for more complex values such as regular expressions, and are required for strings that contain whitespace. |
|
Function | A function in SnareQL appears as a word followed by parentheses, which may contain a field. A function performs a calculation on the contents of the field (the value) and returns the results. |
|
Field Reference
Each log type supported by the Snare Central collection subsystem has a range of fields available. Intelligent event recognition and segmentation software modules are capable of pulling useful content from a raw incoming event, into key/value pairs.
The Snare Central query language can use these fields and values to hunt for critical security data. See Log Types for information on fields that are available for each log type.
The following logtype/fields are not yet available in the Log Types area of the Snare Central user guide. Basic details are available below:
...
Log Type / Table
...
Fields
...
Tru64Audit
...
DATE
TIME
SYSTEM
TABLE
EVENTID
USERID
AUID
RUID
EUID
PID
PPID
RETURNCODE
STRINGS
TARGET
...
VMSLog
...
DATE
TIME
SYSTEM
TABLE
EVENTID
EVENTTYPE
USERNAME
SYSTEMID
PID
TERMINALNAME
PROCESSNAME
PROCESSOWNER
REMOTEUSERNAME
REMOTENODENAME
IMAGENAME
COMMANDLINE
OBJECTCLASSNAME
AUDITINGFLAGS
ALARMFLAGS
STATUS
DATA
...
VWActionsLog
...
DATE
TIME
SYSTEM
TABLE
SEQUENCE
CLIENTID
METHODCODE
OFFICERCODE
FOLDERCODE
CLIENTTYPE
...
WebLog
...
DATE
TIME
SYSTEM
TABLE
HOSTNAME
USERNAME
URL
RETURNCODE
BYTES
REFERRER
AGENT
PROTOCOL
LOGTYPE
CATEGORY
STRINGS
...
WinDHCP
...
DATE
...
TIME
...
SYSTEM
...
TABLE
...
EVENTID
...
DESCRIPTION
...
IPADDRESS
...
HOSTNAME
...