Hunting

##Β Searching through hunting rulesets

Users can search through their VT Hunting rulesets. There is a search bar just above the list of rulesets:

933933

This search bar allows the following search modifiers:

owner:

Search by the username of the owner of a ruleset. This is useful when you have shared rulesets.

Example:

owner:myvtuser

name:

Filter rules based on the ruleset name.

Example:

name:my_ruleset_name

rules:

Search according to strings found in the body of the rules that make up a rulesets, this includes the individual rule names.

Example:

rules:my_rule_name

Free text, no modifiers

Searches across any of the fields above.

Searching through hunting notifications

Users can search through their VT Hunting notifications. The notifications view has a header, on its right-hand side there is a search box.

10141014

This search bar allows accepts free text, it will search over the ruleset name, the rule name and the rule namespace, exclusively. At present notifications filtering may not be mixed with other advanced VT Intelligence search modifiers.