Hunting

##Β Searching through hunting rulesets

Users can search through their VT Hunting rulesets. There is a search bar just above the list of rulesets:

933

This search bar allows the following search modifiers:

owner: Search by the username of the owner of a ruleset. This is useful when you have shared rulesets.

Example:

owner:myvtuser
name:Filter rules based on the ruleset name.

Example:

name:my_ruleset_name
rules: Search according to strings found in the body of the rules that make up a rulesets, this includes the individual rule names.

Example:

rules:my_rule_name
Free text, no modifiers Searches across any of the fields above.

Searching through hunting notifications

Users can search through their VT Hunting notifications. The notifications view has a header, on its right-hand side there is a search box.

1014

This search bar allows accepts free text, it will search over the ruleset name, the rule name and the rule namespace, exclusively. At present notifications filtering may not be mixed with other advanced VT Intelligence search modifiers.