Stay organized with collections Save and categorize content based on your preferences.

UDM Search

The UDM search function enables you to find Unified Data Model (UDM) events within your Chronicle instance. UDM search includes a variety of search options, enabling you to navigate through your UDM data. You can search both for individual UDM events and groups of UDM events tied to shared search terms.

For more information about UDM, see Format log data as UDM and Unified Data Model field list.

To access Chronicle UDM Search, select UDM Search from the application menu on the Chronicle landing page. You can also access UDM search by entering a valid UDM field from any search field in Chronicle and pressing CTRL+Enter.

For a list of all valid UDM fields, see Unified Data Model field list.

UDM Search

Figure 1. UDM Search

Blank UDM Search

Figure 2. UDM Search window which opens with CTRL+Enter

Complete the following steps to enter a UDM search in the UDM Search field. When you finish entering a UDM search, click RUN SEARCH to proceed. The Chronicle user interface only allows you to enter a valid UDM search expression. You can also adjust the range of data to search by opening the date range window.

Date and Run Search

UDM queries are based on UDM fields. All the UDM fields are listed in the Unified Data Model field list. You can also view UDM fields within the context of searches by using Filters or Raw Log Search.

  1. To search for events, enter a UDM field name in the search field and then click RUN SEARCH. The user interface includes automatic completion and displays valid UDM fields based on what you have entered.

  2. Once you have entered a valid UDM field, select a valid operator. The user interface displays the available valid operators based on the UDM field you entered. The following operators are supported:

    • <, >
    • <=, >=
    • =, !=
    • nocase -- supported for strings
  3. Once you have entered a valid UDM field and operator, enter the corresponding log data you are searching for. The following data types are supported:

    • Enumerated values—the user interface displays a list of valid enumerated values for a given UDM field.

      For example (use double quotes and all caps): metadata.event_type = "NETWORK_CONNECTION"

    • Integers

      For example: target.port = 443

    • Regular expressions (regular expression must be within slash (/) characters)

      For example: principal.ip = /10.*/

      For more information on regular expressions, see https://github.com/google/re2/wiki/Syntax

    • String

      For example (must use double quotes): metadata.product_name = "Google Cloud VPC Flow Logs"

  4. You can use the nocase operator to search for any combination of upper and lowercase versions of a given string:

    • principal.hostname != "http-server" nocase
    • principal.hostname = "JDoe" nocase
    • principal.hostname = /dns-server-[0-9]+/ nocase
  5. You can use boolean expressions to further narrow possible range of data displayed. The following examples illustrate some types of supported boolean expressions (AND, OR, and NOT boolean operators can be used):

    • A AND B
    • A OR B
    • (A OR B) AND (B OR C) AND (C OR NOT D)

    The following examples illustrate how the actual syntax might appear:

    Login events to the finance server:

    metadata.event_type = "USER_LOGIN" and target.hostname = "finance-svr"

    Example of using a regular expression to search for the execution of the psexec.exe tool on Windows.

    target.process.command_line = /\bpsexec(.exe)?\b/ nocase

    Example of using the more than operator (>) to search for connections where more than 10 MB of data was sent.

    metadata.event_type = "NETWORK_CONNECTION" and network.sent_bytes > 10000000

    Example using multiple conditions to search for Winword launching cmd.exe or powershell.exe.

        metadata.event_type = "PROCESS_LAUNCH" and
        principal.process.file.full_path = /winword/ and
        (target.process.file.full_path = /cmd.exe/ or
        target.process.file.full_path = /powershell.exe/)

  6. Click RUN SEARCH to run your UDM search and display the results.

  7. Events are displayed on the UDM Search page in the Events timeline table. You can narrow the results further by adding additional UDM fields manually or by using the interface.

Refine the search results

You can use the UDM search user interface to filter and refine results as an alternative to modifying the UDM search and re-running the search.

Events timelines chart

The events timelines chart provides a graphical representation of the number of events occurring each day that are being surfaced by the current UDM search. The width of each bar depends on the time interval searched. For example, each bar will represent 10 minutes when the search spans 24 hours of data. This chart is updated dynamically as you modify the existing UDM search.

Events timelines chart

Figure 3. Events timeline chart

Time range adjustment

You can adjust the time range for the chart by moving the white slider controls left and right to adjust the time range and focus on the period of interest. As you adjust the time range, the UDM Fields and Values and Events tables are updated to reflect the current selection. You can also click on a single bar on the graph to list just those events in that time period.

Once you have adjusted the time range, the Filtered Events and Query Events checkboxes will appear, enabling you to further limit the types of events displayed.

Events timelines chart with time range controls

Figure 4. Events timelines chart with time range controls

Modify the UDM Search with Quick Filters

Using Quick Filters, you can further narrow your UDM search. You can either scroll through the list of UDM fields or search for specific UDM fields or values using the Search field. The UDM fields listed here are associated with the existing lists of events generated by your UDM search. Each UDM field includes the number of events within your current UDM search that also include this piece of data. The list of UDM fields display the total unique number of values within a field. This feature enables you to hunt for particular types of log data that might be of further interest.

The UDM fields are listed in the following order:

  1. Fields with the highest event counts to the lowest event counts.
  2. Fields with only 1 value are always last.
  3. Fields with the exact same event count total are ordered alphabetically from A through Z.

Quick Filters

Figure 5. Quick Filters

Modify a Quick Filter

If you select a UDM field value in the Quick Filters list and click the menu icon, you are given the option to either Show only events which also include that UDM field value or to Filter out that UDM field value. If the UDM field stores integer values (example: target.port) you will also see options to filter by <,>,<=,>=. Filter options will shorten the list of displayed events.

Show Only

Figure 6. Example: Select Show Only

These additional UDM filters are also added to the filter events field above. The filter events field helps you to keep track of the additional UDM fields you have added to the UDM search. You can also quickly remove these additional UDM fields as needed.

Filter events

Figure 7. Filter events

If you click the Filter events menu icon or Add Filter to the left, a window opens enabling you to select additional UDM fields.

Filter events window

Figure 8. Filter events window

When you click APPLY to Search and Run, the UDM fields are added to the Filter events field (see Figure 8) and the displayed events are filtered based on those additional filters. You can also click Apply to Search and Run to add these to the main UDM Search field at the top of the page. The search is automatically run again using the same date and time parameters. Google recommends narrowing your search down as much as possible before clicking APPLY to Search and Run. This helps to improve accuracy and reduces search times.

View events in the Events table

All of these filters and controls will update the list of events displayed in the Events table. Click on any of the listed events to open the Log Viewer where you can examine the raw log and the UDM record for that event. If you click on the timestamp for an event, you can also navigate to the associated Asset, IP address, Domain, Hash, or User view. You can also use the Search field at the top of the table to find a specific event.

Events table

Figure 9. Events table

View events in the Event Viewer

If you hover over an event in the Events table, the open event viewer icon appears on the right side of the highlighted event. Click it to open the Event Viewer.

Event Viewer

Figure 10. Event Viewer

The Raw Log window displays the original raw log in any of the following formats:

  • Raw
  • JSON
  • XML
  • CSV
  • Hex/ASCII

The UDM window displays the structured UDM record. You can hover over any of the UDM fields and a popup displays the UDM definition. By selecting the checkbox for the UDM fields, you get additional options:

  • You can copy the UDM record. Select one or more UDM fields and then select the Copy UDM option from the View Actions drop down menu. The UDM fields and UDM values are copied to the system clipboard.

  • You can add the UDM fields as columns in the Events table by selecting the Add Columns option from the View Actions drop down menu.

  • You can run a UDM search. Select one or more of the UDM fields and then select the Run Search option from the View Actions drop down menu. The UDM fields and values and added as a new UDM search and the search is run.

Use the Columns option to adjust which columns of information are displayed in the Events table. The Columns pop-up menu is displayed. The options available vary depending on the types of events returned by the UDM Search.

You can optionally save the set of columns you have selected here by clicking Save. Give the set of selected columns a name and click Save again. You can load a set of saved columns by clicking Load and selecting the set of saved columns from the list.

You can also download the displayed events by clicking the three dot menu and selecting Download as CSV.

UDM Search Columns

Figure 11. UDM Search columns

Quick Searches

To complete a quick search, complete the following steps:

  1. Click Quick Searches to open the Quick Search window. This window displays your saved searches and search history.

  2. Click on any of the searches listed to load it into the UDM search field.

  3. Click RUN SEARCH when you are ready.

The searches listed are saved to your Chronicle account. If you need to modify any of your saved searches (for example, rename an existing search), delete saved searches, or delete searches from your search history, open the Search Manager by clicking See All Searches.

Quick Search

Figure 12. Quick Search window

Saved Searches and Search History

Use the Search Manager to retrieve saved searches and view your search history by clicking Search Manager. Saved searches and search history are both stored with your Chronicle account. Saved searches and search history are only viewable and accessible by the individual user who creates the record. They cannot be shared or accessed by any other users in your tenant.

Search Manager

Figure 13. Search Manager

To save a search:

  1. From the UDM Search page, click SAVE to save your UDM search for later. This opens the Search Manager. Google recommends giving your saved search a meaningful name.

  2. Click Save Edits when you have finished.

  3. To view saved searches, click Search Manager and then click the Saved Searches tab.

To retrieve and run a saved search:

  1. Click Saved Searches.

  2. Select a saved search from the list. These saved searches are saved to your Chronicle account. You can delete a search by clicking delete.

  3. You can change the name of the search. Click Save Edits when you have finished.

  4. Click Load Search. The search is loaded into the main UDM search field.

  5. Click RUN SEARCH to see the events associated with this search.

Retrieve a search from your search history

To retrieve and run a search from your search history:

  1. Click Search History.

  2. Select a search from your search history. Your search history is saved to your Chronicle account. You can delete a search by clicking delete.

  3. Click Load Search. The search is loaded into the main UDM search field.

  4. Click RUN SEARCH to see the events associated with this search.

Clear, disable, or enable search history

To clear, disable, or enable search history:

  1. Click the three dot menu icon.

  2. Select Clear Search History to clear the search history.

  3. Click Disable to disable search history. You'll have the option to either:

    • Opt-Out Only—Disable search history.

    • Opt-Out and Clear—Disable search history and delete the saved search history.

  4. If you have previously disabled search history, you can enable it again by clicking Enable Search History.

  5. Click Close to exit the Search Manager window.