{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The Snare advanced events search capability allows you to build structured queries using the Snare Query Language (SnareQL) to search for events.","type":"text"}]},{"type":"paragraph","content":[{"text":"With SnareQL, you can specify advanced criteria using tools such as:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Operators such as =, !=, >, LIKE, CONTAINS or regular expressions,","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Specific field comparisons, such as USERNAME=AJSmith","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Advanced date limitations such as DATE='last monday'","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Precedence using parentheses, such as EVENTID='login' AND (TIME < 08:00:00 OR TIME > 17:00:00)","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Advanced regular expressions using RE2 syntax: ","type":"text","marks":[{"type":"em"}]},{"text":"https://github.com/google/re2/wiki/Syntax","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://github.com/google/re2/wiki/Syntax"}}]}]}]}]},{"type":"paragraph","content":[{"text":"Note, SnareQL is not a database query language, even though it uses a subset and superset of SQL syntax.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"SnareQL","type":"text"}]},{"type":"paragraph","content":[{"text":"SnareQL queries consist of query components, joined by logic operators.","type":"text"}]},{"type":"paragraph","content":[{"text":"Each query component consists of a ","type":"text"},{"text":"field","type":"text","marks":[{"type":"em"}]},{"text":", an ","type":"text"},{"text":"operator","type":"text","marks":[{"type":"em"}]},{"text":", and a ","type":"text"},{"text":"value","type":"text","marks":[{"type":"em"}]},{"text":". For example:","type":"text"}]},{"type":"codeBlock","content":[{"text":"USERNAME='AJSMITH'","type":"text"}]},{"type":"paragraph","content":[{"text":"This query will search for events that have a ","type":"text"},{"text":"field","type":"text","marks":[{"type":"em"}]},{"text":" called “USERNAME” that contains (","type":"text"},{"text":"=","type":"text","marks":[{"type":"em"}]},{"text":") the ","type":"text"},{"text":"value","type":"text","marks":[{"type":"em"}]},{"text":" “AJSMITH”.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Snare Central is capable of storing massive amounts of forensic data. A simple search like this one, without date/time range limitations could potentially take a very long time to run, since it will attempt to search the entire Snare Central data store.","type":"text"}]},{"type":"paragraph","content":[{"text":"The Snare Central advanced query tool will impose a query timeout on queries by default, to help you narrow down your search criteria in a reasonable timeframe.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"A more complex query may look like this:","type":"text"}]},{"type":"codeBlock","content":[{"text":"USERNAME='AJSMITH' AND EVENTID LIKE '%login' AND SYSTEM REGEX '^(AU|US|UK)-' AND ((DATE='WEEKDAY' AND (TIME < '08:00:00' OR TIME > '17:00:00')) OR DATE='WEEKEND')","type":"text"}]},{"type":"paragraph","content":[{"text":"This query will search for 'out of hours' logins by AJSmith, from systems with a hostname that identifies them as Australia, US or UK.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Different log types will often contain different fields, and event fields with the same names may be formatted slightly differently. Windows uses numeric identifiers for the field EVENTID (eg: 512, 4593), whereas Solaris and Linux will use more descriptive terms such as “login - ftp”.","type":"text"}]},{"type":"paragraph","content":[{"text":"DATE and TIME fields, though stored in the format ","type":"text"},{"text":"YYYY-MM-DD","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"HH:MM:SS","type":"text","marks":[{"type":"strong"}]},{"text":" respectively within the Snare Central data store, can support indirect values such as “","type":"text"},{"text":"this time last week","type":"text","marks":[{"type":"em"}]},{"text":"” or “","type":"text"},{"text":"the first day of this month","type":"text","marks":[{"type":"em"}]},{"text":"”, or “","type":"text"},{"text":"last saturday","type":"text","marks":[{"type":"em"}]},{"text":"”, or “","type":"text"},{"text":"5","type":"text","marks":[{"type":"em"}]},{"text":"” (which translates to ‘","type":"text"},{"text":"now minus 5 days","type":"text","marks":[{"type":"em"}]},{"text":"’, in the case of DATE, or ‘","type":"text"},{"text":"now minus 5 minutes","type":"text","marks":[{"type":"em"}]},{"text":"’ in the case of TIME) .","type":"text"}]}]},{"type":"paragraph","content":[{"text":"In addition, some functions are available that can perform calculations based on field contents.","type":"text"}]},{"type":"codeBlock","content":[{"text":"USERNAME='AJSMITH' AND EVENTID LIKE '%login' AND MINUTE(TIME) < 15 AND DATE='today'","type":"text"}]},{"type":"paragraph","content":[{"text":"This query will search for logins by AJSmith, in the first 15 minutes of each hour of the current day.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Precedence and Grouping in Queries","type":"text"}]},{"type":"paragraph","content":[{"text":"Snare query components prioritise ANDs over NOTs, and NOTs over ORs - however precedence can be explicitly specified using brackets.","type":"text"}]},{"type":"codeBlock","content":[{"text":"SYSTEM=EMU OR SYSTEM=MAGPIE AND SYSTEM=FROGMOUTH","type":"text"}]},{"type":"paragraph","content":[{"text":"In this case, the following query components will be evaluated first: SYSTEM=MAGPIE AND SYSTEM=FROGMOUTH","type":"text"}]},{"type":"paragraph","content":[{"text":"This will return no data (no systems can be both MAGPIE and FROGMOUTH), and the final query element (OR SYSTEM=EMU) will be evaluated, resulting in events that have a system name of EMU being returned.","type":"text"}]},{"type":"codeBlock","content":[{"text":"(SYSTEM=EMU OR SYSTEM=MAGPIE) AND SYSTEM=FROGMOUTH","type":"text"}]},{"type":"paragraph","content":[{"text":"This will select any events that have a SYSTEM name of either EMU or MAGPIE, and then attempt to find events in that group that ALSO have a system name of FROGMOUTH","type":"text"}]},{"type":"paragraph","content":[{"text":"Since events cannot have a system name that is both FROGMOUTH and something else, no data will be returned.","type":"text"}]},{"type":"codeBlock","content":[{"text":"SYSTEM=EMU OR SYSTEM=MAGPIE AND TABLE=WinSecurity","type":"text"}]},{"type":"paragraph","content":[{"text":"Since our AND will be evaluated first, this will look for Windows Security events for MAGPIE, and then ALSO introduce all events for EMU, regardless of whether the table was Windows, Solaris or Firewall logs.","type":"text"}]},{"type":"codeBlock","content":[{"text":"(SYSTEM=EMU OR SYSTEM=MAGPIE) AND TABLE=WinSecurity","type":"text"}]},{"type":"paragraph","content":[{"text":"This will ONLY look for Windows security logs - from either EMU or MAGPIE","type":"text"}]},{"type":"codeBlock","content":[{"text":"USERNAME='AJSMITH' AND EVENTID LIKE '%login' AND SYSTEM REGEX '^(AU|US|UK)-' AND ((DATE='WEEKDAY' AND (TIME < '08:00:00' OR TIME > '17:00:00')) OR DATE='WEEKEND')","type":"text"}]},{"type":"paragraph","content":[{"text":"Multiple levels of brackets are supported - in this case, we are looking for login events by AJSmith from systems that start with AU, US or UK, on either the weekend, or out of normal work hours during the week.","type":"text"},{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"To search for some IP addresses you will need to use the advanced search and escape the dot in the IP address as per this example. make sure you have a space at the end of the IP address to get an exact match or you may see other IP addresses that start with the last octet. ","type":"text"}]},{"type":"codeBlock","content":[{"text":"DATE='TODAY' AND ALLFIELDS REGEXI '(10\\.1\\.1\\.1 |10\\.1\\.1\\.2 ) '","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Restricted words and characters","type":"text"}]},{"type":"paragraph","content":[{"text":"The range of characters you can use in your search values depends significantly on the operator you have chosen.","type":"text"}]},{"type":"paragraph","content":[{"text":"For all operators, the space, single quotes (') and double quotes (“) characters are considered special. If you wish to use these as part of your search, the following rules apply:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Content that includes space characters must be surrounded by EITHER single or double quotes.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"EVENTID=login","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"EVENTID=”login failed”","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you wish to use single or double quotes as part of your search criteria, they must be escaped with the backslash character (\\)","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"STRINGS CONTAINS “User: \\”Fred\\””","type":"text","marks":[{"type":"code"}]}]}]}]}]}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"INCLUDES","type":"text","marks":[{"type":"strong"}]},{"text":" operator uses commas to separate potential values. If you wish to use the comma as part of your search criteria, it is recommend that you use regular expressions instead.","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"LIKE","type":"text","marks":[{"type":"strong"}]},{"text":" operator uses the percent sign “%” to represent an arbitrary number of characters.","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"REGEX","type":"text","marks":[{"type":"strong"}]},{"text":" operators (REGEX, !REGEX, REGEXI, !REGEXI) have a range of reserved characters that represent particular features within a regular expression. These characters must be escaped with the backslash character (\\) when used as a literal value, in most instances.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Special Case Values - DATE","type":"text"}]},{"type":"paragraph","content":[{"text":"Date recognition is flexible in SnareStore. The following date formats are recognised, using the associated operators text in italics is optional","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"Format","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"Valid Operators","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"YYYY-MM-DD","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"All","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"eg: DATE = 2017-06-23","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"TODAY","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The date on which the query was run","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"NOW","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The date on which the query was run","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"YESTERDAY","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The day prior","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"TOMORROW","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The day after","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"N","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"Translates to \"Current date/time minus N days\" (for DATE) or \"Current time minus N minutes\" (for TIME).","type":"text"},{"type":"hardBreak"},{"text":"This allows you to rerun a saved query, with an updated range, without changing the query.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"THIS TIME LAST WEEK","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The week prior","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"THIS TIME NEXT WEEK","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The week after","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"THIS TIME LAST YEAR","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The same date as the current date, one year prior","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"THIS TIME NEXT YEAR","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The same date as the current date, one year after","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"THE","type":"text","marks":[{"type":"em"}]},{"text":" DAY AFTER TOMORROW","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"Today + 2 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"THE","type":"text","marks":[{"type":"em"}]},{"text":" DAY BEFORE YESTERDAY","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"Today - 2 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"1ST OF THIS MONTH","type":"text"},{"type":"hardBreak"},{"text":"1ST ","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"text":" OF THIS MONTH","type":"text"},{"type":"hardBreak"},{"text":"FIRST OF THIS MONTH","type":"text"},{"type":"hardBreak"},{"text":"FIRST ","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"text":" OF THIS MONTH","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The first day of the month on which the query is run","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"LAST OF THIS MONTH","type":"text"},{"type":"hardBreak"},{"text":"LAST ","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"text":" OF THIS MONTH","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The last day of the month on which the query is run","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"1ST OF LAST MONTH","type":"text"},{"type":"hardBreak"},{"text":"1ST ","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"text":" OF LAST MONTH","type":"text"},{"type":"hardBreak"},{"text":"FIRST OF LAST MONTH","type":"text"},{"type":"hardBreak"},{"text":"FIRST ","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"text":" OF LAST MONTH","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The first day of the previous month","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"LAST OF LAST MONTH","type":"text"},{"type":"hardBreak"},{"text":"LAST DAY OF LAST MONTH","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The last day of the previous month","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"FIRST OF THE MONTH","type":"text"},{"type":"hardBreak"},{"text":"THE","type":"text","marks":[{"type":"em"}]},{"text":" FIRST DAY OF THE MONTH","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The first day of ANY month","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"LAST MON","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"LAST TUE","type":"text"},{"text":"SDAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"LAST WED","type":"text"},{"text":"NESDAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"LAST THU","type":"text"},{"text":"RSDAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"LAST FRI","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"LAST SAT","type":"text"},{"text":"URDAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"LAST SUN","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The date of the last supplied day","type":"text"},{"type":"hardBreak"},{"text":"Note that if it is CURRENTLY monday, a request for LAST monday would be the equivalent of \"THIS TIME LAST WEEK\".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"NEXT MON","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"NEXT TUE","type":"text"},{"text":"SDAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"NEXT WED","type":"text"},{"text":"NESDAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"NEXT THU","type":"text"},{"text":"RSDAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"NEXT FRI","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"NEXT SAT","type":"text"},{"text":"URDAY","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"NEXT SUN","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The date of the next supplied day","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"MON","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"text":" LAST WEEK","type":"text"},{"type":"hardBreak"},{"text":"TUE","type":"text"},{"text":"SDAY","type":"text","marks":[{"type":"em"}]},{"text":" LAST WEEK","type":"text"},{"type":"hardBreak"},{"text":"WED","type":"text"},{"text":"NESDAY","type":"text","marks":[{"type":"em"}]},{"text":" LAST WEEK","type":"text"},{"type":"hardBreak"},{"text":"THU","type":"text"},{"text":"RSDAY","type":"text","marks":[{"type":"em"}]},{"text":" LAST WEEK","type":"text"},{"type":"hardBreak"},{"text":"FRI","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"text":" LAST WEEK","type":"text"},{"type":"hardBreak"},{"text":"SAT","type":"text"},{"text":"URDAY","type":"text","marks":[{"type":"em"}]},{"text":" LAST WEEK","type":"text"},{"type":"hardBreak"},{"text":"SUN","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"text":" LAST WEEK","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The date associated with the supplied day.","type":"text"},{"type":"hardBreak"},{"text":"If the current date is Monday, the statement is equivalent to the \"LAST X\" statement above.","type":"text"},{"type":"hardBreak"},{"text":"If the current date is a Tuesday, the statement will return a date of 8 days ago.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"MON","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"text":" NEXT WEEK","type":"text"},{"type":"hardBreak"},{"text":"TUE","type":"text"},{"text":"SDAY","type":"text","marks":[{"type":"em"}]},{"text":" NEXT WEEK","type":"text"},{"type":"hardBreak"},{"text":"WED","type":"text"},{"text":"NESDAY","type":"text","marks":[{"type":"em"}]},{"text":" NEXT WEEK","type":"text"},{"type":"hardBreak"},{"text":"THU","type":"text"},{"text":"RSDAY","type":"text","marks":[{"type":"em"}]},{"text":" NEXT WEEK","type":"text"},{"type":"hardBreak"},{"text":"FRI","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"text":" NEXT WEEK","type":"text"},{"type":"hardBreak"},{"text":"SAT","type":"text"},{"text":"URDAY","type":"text","marks":[{"type":"em"}]},{"text":" NEXT WEEK","type":"text"},{"type":"hardBreak"},{"text":"SUN","type":"text"},{"text":"DAY","type":"text","marks":[{"type":"em"}]},{"text":" NEXT WEEK","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"The date associated with the supplied day.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"HH:MM:SS","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,<,<=,>,>=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"Take the number of hours, minutes and seconds supplied, add it to the local midnight (00:00:00) for the current date, and use the resulting date as a source.","type":"text"}]},{"type":"paragraph","content":[{"text":"eg: 03:00:00, 17:00:00, and 23:59:59 would all result in the equivalent of NOW or TODAY","type":"text"}]},{"type":"paragraph","content":[{"text":"eg: 25:00:00 would be the equivalent of TOMORROW","type":"text"}]},{"type":"paragraph","content":[{"text":"eg: -01:00:00 would be the equivalent of YESTERDAY","type":"text"}]},{"type":"paragraph","content":[{"text":"eg: 240:00:00 would be the equivalent of 10 days from now.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"THIS WEEK","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"<,<=,>,>=,=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"If the date is within the current week.","type":"text"}]},{"type":"paragraph","content":[{"text":"Monday is assumed to be the first day of the week.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"LAST WEEK","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"<,<=,>,>=,=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"If the date is within last weeks range.","type":"text"}]},{"type":"paragraph","content":[{"text":"Monday is assumed to be the first day of this week.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"NEXT WEEK","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"<,<=,>,>=,=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"If the date is within next weeks range.","type":"text"}]},{"type":"paragraph","content":[{"text":"Monday is assumed to be the first day of next week.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"THIS YEAR","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"<,<=,>,>=,=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"If the date is within the current year.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"LAST YEAR","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"<,<=,>,>=,=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"If the date is in last years date range.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"NEXT YEAR","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"<,<=,>,>=,=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"If the date is within next years date range","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"MONDAY","type":"text"},{"type":"hardBreak"},{"text":"TUESDAY","type":"text"},{"type":"hardBreak"},{"text":"WEDNESDAY","type":"text"},{"type":"hardBreak"},{"text":"THURSDAY","type":"text"},{"type":"hardBreak"},{"text":"FRIDAY","type":"text"},{"type":"hardBreak"},{"text":"SATURDAY","type":"text"},{"type":"hardBreak"},{"text":"SUNDAY","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"If the date falls on the value supplied","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"WEEKDAY","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"If the date is a weekday","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"WEEKEND","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"If the date is a weekend","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"FIRST OF THE YEAR","type":"text"},{"type":"hardBreak"},{"text":"FIRST DAY OF THE YEAR","type":"text"},{"type":"hardBreak"},{"text":"THE FIRST DAY OF THE YEAR","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"If the date is the first day of any year (ie: January 1)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"JANUARY","type":"text"},{"type":"hardBreak"},{"text":"FEBRUARY","type":"text"},{"type":"hardBreak"},{"text":"MARCH","type":"text"},{"type":"hardBreak"},{"text":"APRIL","type":"text"},{"type":"hardBreak"},{"text":"MAY","type":"text"},{"type":"hardBreak"},{"text":"JUNE","type":"text"},{"type":"hardBreak"},{"text":"JULY","type":"text"},{"type":"hardBreak"},{"text":"AUGUST","type":"text"},{"type":"hardBreak"},{"text":"SEPTEMBER","type":"text"},{"type":"hardBreak"},{"text":"OCTOBER","type":"text"},{"type":"hardBreak"},{"text":"NOVEMBER","type":"text"},{"type":"hardBreak"},{"text":"DECEMBER","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[79.0]},"content":[{"type":"paragraph","content":[{"text":"=,!=","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[493.0]},"content":[{"type":"paragraph","content":[{"text":"If the date is found within the specified month","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"hardBreak"},{"text":"Reference","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[206.0]},"content":[{"type":"paragraph","content":[{"text":"Component","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[398.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[859.0]},"content":[{"type":"paragraph","content":[{"text":"Reference","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[206.0]},"content":[{"type":"paragraph","content":[{"text":"Field","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[398.0]},"content":[{"type":"paragraph","content":[{"text":"A field in SnareQL is a word that represents a field within a particular log type.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[859.0]},"content":[{"type":"paragraph","content":[{"text":"Events within each log type are guaranteed by the Snare Central collection subsystem to include the following fields:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"DATE","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the format YYYY-MM-DD, for example 2020-02-23","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"TIME","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the format: HH:MM:SS, for example: 16:23:49","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SYSTEM","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Upper case system name or IP Address.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"TABLE","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The source log type","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Depending on the source log type, events may also include fields such as:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"EventID (eg: “deny packet”, or “login - ssh”, or “512”.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SourceIP (eg: 193.32.113.12)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"User (eg: AJSmith)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"URL (eg: https://prophecyinternational.com/)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"See ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://prophecyinternational.atlassian.net/wiki/spaces/SCV8/pages/742129903"}},{"text":" for information on fields that are available for each log type. Note that new log types are added on a regular basis.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[206.0]},"content":[{"type":"paragraph","content":[{"text":"Operator","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[398.0]},"content":[{"type":"paragraph","content":[{"text":"An operator in SnareQL is one or more symbols or words that compare the value of a field on its left with one or more values on its right. Some operators may use the negate symbol (!) to reverse the meaning - eg: !=, !REGEX","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[859.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"=","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Standard equality. Case insensitive.","type":"text"}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"!=","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Standard inequality. Case insensitive.","type":"text"}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"<","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Less than. Case insensitive in strings.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Note: TIME is considered a unique value, and is not linked to date. ie: 15:00:00 < 15:00:01 is true - even if the first DATE is in 2019, and the second DATE is 1979","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"True date/time comparisons would require (DATE < X OR (DATE = X AND TIME < Y))","type":"text"}]}]}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"<=","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Less than or equal to. Case insensitive in strings.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Note: TIME is considered a unique value, and is not linked to date. ie: 15:00:00 < 15:00:01 is true - even if the first DATE is in 2019, and the second DATE is 1979","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"True date/time comparisons would require (DATE < X OR (DATE = X AND TIME < Y))","type":"text"}]}]}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":">","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Greater than. Case insensitive in strings.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Note: TIME is considered a unique value, and is not linked to date. ie: 15:00:00 < 15:00:01 is true - even if the first DATE is in 2019, and the second DATE is 1979","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"True date/time comparisons would require (DATE < X OR (DATE = X AND TIME < Y))","type":"text"}]}]}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":">=","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Greater than or equal to. Case insensitive in strings.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Note: TIME is considered a unique value, and is not linked to date. ie: 15:00:00 < 15:00:01 is true - even if the first DATE is in 2019, and the second DATE is 1979","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"True date/time comparisons would require (DATE < X OR (DATE = X AND TIME < Y))","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"LIKE","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SQL-style like criteria. \"%\" symbols are considered to be wildcards. Case insensitive.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"!LIKE","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SQL-style like criteria. \"%\" symbols are considered to be wildcards. Case insensitive.","type":"text"}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"CONTAINS","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The target string, contains the supplied string. Case insensitive.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"eg: STRINGS CONTAINS \"userid\" would be true for a STRINGS of \"The following userID logged off: Fred\"","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"!CONTAINS","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The target string, does not contain the supplied string. Case insensitive.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"eg: STRINGS !CONTAINS \"userid\" would be true for a STRINGS of \"This string does not contain the string\"","type":"text"}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"INCLUDES","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The value is one of the supplied comma-separated values. Case insensitive.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"eg: STRINGS INCLUDES \"Fred,Barney,Wilma\" would be true for the String \"Fred\", but not \"Frederick\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The equivalent of (STRINGS = \"FRED\" OR STRINGS = \"BARNEY\" OR STRINGS = \"WILMA\")","type":"text"}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"!INCLUDES / EXCLUDES","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"That value contains NONE of the supplied comma-separated values. Case insensitive.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"EXCLUDES is an alias for ","type":"text"},{"text":"!INCLUDES","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"eg: STRINGS EXCLUDES \"Fred,Barney,Wilma\" would be true for the String \"BamBam\", and would also be true for \"Frederick\", but not \"Fred\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The equivalent of (STRINGS != \"FRED\" AND STRINGS != \"BARNEY\" AND STRINGS != \"WILMA\")","type":"text"}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"REGEX","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The value matches the supplied regular expression.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Regex is CASE SENSITIVE","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Regex is assumed to be a valid RE2 expression.","type":"text"}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"!","type":"text"},{"text":"REGEX","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The value does not match the supplied regular expression.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Regex is CASE SENSITIVE","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Regex is assumed to be a valid RE2 expression (note that Snare Server version 7 uses PCRE).","type":"text"}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"REGEXI","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The value matches the supplied regular expression.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Regex is NOT CASE SENSITIVE","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Regex is assumed to be a valid RE2 expression.","type":"text"}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"!","type":"text"},{"text":"REGEXI","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The value does not match the supplied regular expression.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Regex is NOT CASE SENSITIVE","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Regex is assumed to be a valid RE2 expression.","type":"text"}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"HAS","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Like CONTAINS, but assumes that the supplied match string, are entire words.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Significantly more friendly from an index-perspective; queries that use HAS may return significantly faster than queries that use CONTAINS.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Case insensitive.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"eg: STRINGS HAS \"Fred\" would match: \"The user Fred logged in\", ","type":"text"},{"text":"but not","type":"text","marks":[{"type":"strong"}]},{"text":" \"The user Frederick logged in\".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"eg: STRINGS CONTAINS \"Fred\" would match: \"The user Fred logged in\" ","type":"text"},{"text":"and","type":"text","marks":[{"type":"strong"}]},{"text":" \"The user Frederick logged in\".","type":"text"}]}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[206.0]},"content":[{"type":"paragraph","content":[{"text":"Logical Element","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[398.0]},"content":[{"type":"paragraph","content":[{"text":"A logical element in SnareQL is a word that joins two or more clauses together to form a complex SnareQL query","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[859.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AND","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OR","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"NOT","type":"text"}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[206.0]},"content":[{"type":"paragraph","content":[{"text":"Value","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[398.0]},"content":[{"type":"paragraph","content":[{"text":"A string designed to represent the contents of a field in an event within the Snare Central datastore. The value may be a simple string, or a complex regular expression, depending on the operator selected.","type":"text"}]},{"type":"paragraph","content":[{"text":"Quotations are optional for simple values comprising a single word. Single or double quotes are recommended for more complex values such as regular expressions, and are required for strings that contain whitespace.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[859.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AJSmith","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"“Tony Smith”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"“^(AU|US|UK)-[0-9]”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"“Tony%”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"yesterday","type":"text"}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[206.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[398.0]},"content":[{"type":"paragraph","content":[{"text":"A function in SnareQL appears as a word followed by parentheses, which may contain a field.","type":"text"}]},{"type":"paragraph","content":[{"text":"A function performs a calculation on the contents of the field (the value) and returns the results.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[859.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"15MIN(TIME):","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Return the number of 15 minute quadrant associated with the supplied time (0-95).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The day will be divided into 96 quadrants.","type":"text"}]},{"type":"paragraph","content":[{"text":"00:12:03 will become 0","type":"text"},{"type":"hardBreak"},{"text":"00:15:01 will become 1","type":"text"},{"type":"hardBreak"},{"text":"12:01:00 will become 48","type":"text"},{"type":"hardBreak"},{"text":"12:14:59 will become 48","type":"text"},{"type":"hardBreak"},{"text":"12:15:01 will become 49","type":"text"},{"type":"hardBreak"},{"text":"14:45:00 will become 59","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"15MINFLOOR(TIME)","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Return the time to the nearest low 15 minute segment of the day","type":"text"}]},{"type":"paragraph","content":[{"text":"12:01:00 will become 12:00:00","type":"text"},{"type":"hardBreak"},{"text":"12:14:59 will become 12:00:00","type":"text"},{"type":"hardBreak"},{"text":"12:15:01 will become 12:15:00","type":"text"},{"type":"hardBreak"},{"text":"14:45:00 will become 14:45:00","type":"text"},{"type":"hardBreak"},{"text":"15:59:00 will become 15:45:00","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"HOUR(TIME)","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Returns just the hour associated with the supplied time","type":"text"}]},{"type":"paragraph","content":[{"text":"12:01:12 will return 12","type":"text"}]},{"type":"paragraph","content":[{"text":"17:23:34 will return 17","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"HOURMINUTE(TIME)","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Returns the hour and the minute, with a colon deliminiter","type":"text"},{"type":"hardBreak"},{"text":"17:23:49 becomes 17:23","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"MINUTE(TIME)","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Returns just the minute component of the supplied time","type":"text"}]},{"type":"paragraph","content":[{"text":"12:01:12 will return 01","type":"text"},{"type":"hardBreak"},{"text":"17:23:34 will return 23","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SECONDS(TIME)","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Returns just the seconds component of the supplied time","type":"text"}]},{"type":"paragraph","content":[{"text":"12:01:12 will return 12","type":"text"},{"type":"hardBreak"},{"text":"17:23:34 will return 34","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"DAYOFWEEK(DATE)","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Returns the number of the day of the week for a particular date.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"1: Sunday","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"2: Monday","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"3: Tuesday","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"4: Wednesday","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"5: Thursday","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"6: Friday","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"7: Saturday","type":"text"}]}]}]}]}]}]}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Field Reference","type":"text"}]},{"type":"paragraph","content":[{"text":"Each log type supported by the Snare Central collection subsystem has a range of fields available. Intelligent event recognition and segmentation software modules are capable of pulling useful content from a raw incoming event, into key/value pairs.","type":"text"}]},{"type":"paragraph","content":[{"text":"The Snare Central query language can use these fields and values to hunt for critical security data. See ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://prophecyinternational.atlassian.net/wiki/spaces/SCV8/pages/742129903"}},{"text":" for information on fields that are available for each log type.","type":"text"}]}],"version":1}

Browser not supported