Data Explorer

You can use Data Explorer to gather information about recent system and network events and user activities.

With Data Explorer, you can search through analyzed logs, which are generated as part of the Arctic Wolf® Managed Detection and Response (MDR) service. Analyzed logs are parsed, normalized, and enriched logs from the Arctic Wolf observation pipeline.

Note: Analyzed logs are made available in the Unified Portal after Arctic Wolf has reviewed the logs and completed any necessary follow-up actions. As a result, some of the most recent data might not be visible in Data Explorer right away.

How far back you can search depends on your Data Explorer license. For more information, see Data Explorer license options.

You can search analyzed logs using the Query Builder interface to build queries with guided operators, or using the Arctic Wolf Query Language (AQL), a pipe-based syntax for advanced queries. If your organization has access to AI Mode, you can also run natural language searches. For more information, see Arctic Wolf Query Language (AQL).

When using AI Mode, your search results automatically include a Summary Card with a formatted narrative highlighting key domains, IP addresses, and timeframes, as well as automatically generated pie or line charts based on the data. When using the Query Builder or AQL, you can click Summarize to generate a narrative summary, visualizations, and recommended actions. For more information, see Summarize search results with Aurora Security Assistant.