Keyword, Field and Boolean Search
What is it?
The first stage of a search selects events. You can match a keyword, but a precise search filters on fields (user=j.rai), compares values (bytes>1000000), and combines conditions with AND / OR / NOT and parentheses.
Why it matters
Boolean field filters are how you say exactly what you mean: 'failures for this user OR that user, but not from the VPN range'. Vague keyword searches return the wrong events and hide the right ones.
Where you see it
In the search bar: `sourcetype=auth user=j.rai (result=failure OR result=locked) NOT src=10.8.0.0/16`. Clicking a field value in the events list adds the same filter for you.
What normal looks like
A precise filter returns a small, on-topic set: only the events matching the exact fields and values your question is about.
What suspicious looks like
Not the filter itself — but a filter that returns far more or far less than expected usually means a field name is wrong or a boolean is mis-grouped. Check the query, not just the data.
How analysts investigate
State the condition in words, then translate: fields for the nouns, comparisons for the thresholds, AND/OR/NOT for the logic, parentheses for grouping. Read the result count as a sanity check.
Common beginner mistakes
- Forgetting NOT binds tightly / OR loosely, so `a OR b AND c` is not what you meant — use parentheses.
- Matching a keyword that also appears in unrelated events instead of pinning it to a field.
Say exactly what you mean
vague: failed login → matches any event containing those words
precise: sourcetype=auth result=failure → only real failed-auth events
boolean: sourcetype=auth (result=failure OR result=locked)
user=svc-* NOT src IN (10.8.0.0/16)
parentheses group the OR so NOT applies to the whole thingQuick check
You want failures OR lockouts for admin accounts, excluding the VPN range. Which is right?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.