Hunting

Searching through hunting rulesets

Users can search through their VT Hunting rulesets. There is a search bar just above the list of rulesets:

This search bar allows the following search modifiers:

owner:	Search by the username of the owner of a ruleset. This is useful when you have shared rulesets. Example: owner:myvtuser
name:	Filter rules based on the ruleset name. Example: name:my_ruleset_name
rules:	Search according to strings found in the body of the rules that make up a rulesets, this includes the individual rule names. Example: rules:my_rule_name
Free text, no modifiers	Searches across any of the fields above.

owner:

Search by the username of the owner of a ruleset. This is useful when you have shared rulesets.

Example:

owner:myvtuser

name:

Filter rules based on the ruleset name.

Example:

name:my_ruleset_name

rules:

Search according to strings found in the body of the rules that make up a rulesets, this includes the individual rule names.

Example:

rules:my_rule_name

Free text, no modifiers

Searches across any of the fields above.

Searching through hunting notifications

Users can search through their VT Hunting notifications. The notifications view has a header, on its right-hand side there is a search box.

This search bar allows accepts free text, it will search over the ruleset name, the rule name and the rule namespace, exclusively. At present notifications filtering may not be mixed with other advanced VT Intelligence search modifiers.