Run an analyzed log search

Data Explorer allows you to search through analyzed logs from your ingested log sources. You can filter by log source, build custom queries, and create visualizations of your results.

Before you begin

  • You must have a valid Data Explorer license.

    For more information, see Data Explorer Lizenzoptionen.

  • If you are an MSP, you must be assigned the Data Exploration role in the MSP Portal.

    For more information, see Benutzerverwaltung.

Run a predefined search

  1. Melden Sie sich bei Arctic Wolf Unified Portal an.
  2. Klicken Sie im Navigationsmenü auf Datenerkundung > Datenerkunder.
  3. Optional: In the Date Range boxes, click Calendar to select a time range.
  4. In the Load Query (Optional) list, select a preset or saved custom query.
    After selecting a query from the Load Query (Optional) list, predefined values are added to the Query Builder.
  5. Click Run Query .

  6. Optional: Complete any of these actions:

Create and run a query

  1. Melden Sie sich bei Arctic Wolf Unified Portal an.
  2. Klicken Sie im Navigationsmenü auf Datenerkundung > Datenerkunder.
  3. Optional: In the Log Sources section, select one or more log sources to scope your search to specific data.
  4. Optional: In the Date Range boxes, click Calendar to select a time range.
  5. In the Query Builder section, use operators to define a dataset.
    For more information, see:
    Tip: You can start by loading a predefined query into the Query Builder. In the Load Query (Optional) list, select a predefined query. Then, modify the query as desired.
  6. Optional: Add a regex template to your query:
    Note: Arctic Wolf® uses RE2 and Java regex engines. Support for Lucene regex expressions is not available.
    1. In the Data Explorer section, click Regex Templates.
    2. In the Search templates box, filter and search for a regex template, such as IP address, and then select the desired regex template.
    3. Click Use in Query.
      Tip: Click Copy Pattern to manually insert the regex pattern into a query.
    4. In the Select a Field dialog, select the field for the regex template, and then do one of these actions:
    1. Click Insert into current query to insert the regex template into your current query.
    2. Click Start new query to copy the regex template and start a new query.
      Note: This action removes any Data Explorer and operator fields you previously selected.
  7. Click Run Query .
    Search results appear in a table.

    If your search included a field set, one or more widgets might appear in the Available Data Visualizations section.

  8. Optional: Complete any of these actions:

Create and run an query

Use the query editor in Data Explorer to write advanced queries using the , a pipe-based syntax for filtering, aggregating, and transforming analyzed log data.

uses a pipe-based syntax to chain operations such as filtering, aggregating, sorting, and rendering results. For a complete list of operators and syntax, see /de-de/arctic-wolf-unified-portal/unified-portal/data-explorer/search-analyzed-logs/aql-reference.

Note: The query editor supports exporting up to 10,000 rows of results.
  1. Open Data Explorer, then click AQL to open the query editor.
  2. From the Log Source list, select a log source to query.
  3. Set the date range for your search.
  4. In the query editor, write your query.
  5. Click Run.

    Your results appear in the results table below the editor.

To reuse the query or schedule an alert, click Save. Saved queries store your columns, visualizations, and aggregations as part of the query object.