Search operators help refine and combine search terms efficiently, allowing for more precise and relevant queries.
What search operators are available in Threat Hunting?
Operator | Definition | Example |
" " | Exact match search | "rose" |
AND | Requires both terms in results | rose AND red |
OR | Includes either term in results | rose OR red |
NOT | Excludes results containing a specific term | "bouquet of roses" AND NOT red |
exists | Ensures a field contains information | emailDomain=example.com AND exists=accessURL |
() | Groups terms within parameters | emailDomain=(example1.com OR example2.com) |
~ | Approximate search (supports values 1 and 2) | ormus~1 |
* | Replaces zero or more characters in search patterns | ormus* (returns results like "ormuspay") |
* | Identifies that a field contains any information | cvv=* |
? | Replaces a single character in search patterns | l?g?n (returns results like login, logon, l0gin, l0g1n) |
Make sure to use parentheses when applying operators in your searches to ensure the correct precedence of operations. This will help refine the results and avoid unintended interpretations of the terms.
Use case examples (recommended)
1. (emailDomain=example1.com OR emailDomain=example2.com) AND detectionDate>=2025-01-01
Use case examples (not recommended)
1. emailDomain=example1.com OR emailDomain=example2.com AND detectionDate>=2025-01-01
See also:
If you have any questions, feel free to reach out at [email protected] 😊