--- title: "Start a new search" slug: "start-a-new-search" updated: 2025-08-11T15:39:29Z published: 2025-08-11T15:39:29Z canonical: "docs.hunters.ai/start-a-new-search" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt > Use this file to discover all available pages before exploring further. # Start a new search The Search tool is designed to help you investigate and analyze your raw data effectively. It provides a user-friendly interface for running queries, exploring datasets, and uncovering valuable insights. With built-in filters and intuitive guidance, the tool simplifies the process of building both basic and advanced searches, enabling you to quickly narrow down results and focus on the data that matters most. Whether you're investigating specific events or analyzing patterns across multiple data sources, the Search tool is your gateway to actionable information. You can search through your data using two different search modes: ****🔨 Query builder mode**** ****📘 About the query builder**** The search query builder includes the following elements: 1. Filters 2. Query 3. Scope ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Search tool breakdown(2).png) Click to enlarge --- #### Filters ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Search filters.png) Search Filters The Filters section includes 3 filters - - **Time range** - select the timeframe on which to run your query. You can select from a list of relative time frames, like **Last 24 hours**, **Last 3 days**, etc, or specify a custom range of dates and times. - **Data source** - a list of logs you can run your search on. This list shows only data sources connected to your environment that include information within the supported event classes. - **Event class** - a list of [OCSF event classes](https://schema.ocsf.io/classes?extensions) you want to include in your search. This list shows currently supported OCSF event classes. ****Supported event classes**** Hunters currently supports the below event classes: | Event class | What is it? | Why is it important? | | --- | --- | --- | | [1001 - File Activity](https://schema.ocsf.io/1.3.0/classes/file_activity) | Creation, modification, deletion, or access of files on a system. | Tracks potential malicious activity, such as unauthorized file access, malware installation, or data exfiltration. | | [1004 - Memory Activity](https://schema.ocsf.io/1.3.0/classes/memory_activity) | Reads, writes, or executions within system memory. | Helps identify suspicious in-memory operations, like code injection or exploitation attempts. | | [1006 - Scheduled Job Activity](https://schema.ocsf.io/1.3.0/classes/scheduled_job_activity) | Creation, modification, or execution of scheduled tasks or cron jobs. | Detects malicious persistence mechanisms often used by attackers to execute malware periodically. | | [1007 - Process Activity](https://schema.ocsf.io/1.3.0/classes/process_activity) | Creation, modification, termination, or other operations on system processes. | Monitors for rogue or suspicious processes, such as those initiated by malware or unauthorized scripts. | | [2002 - Vulnerability Finding](https://schema.ocsf.io/1.3.0/classes/vulnerability_finding) | Discovery of system vulnerabilities or weaknesses. | Identifies and prioritizes risks that could be exploited by attackers, enabling timely remediation. | | [2004 - Detection Finding](https://schema.ocsf.io/1.3.0/classes/detection_finding) | Detections or alerts generated by security products. | A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. | | 201001 - Win Registry Key Activity | Creation, deletion, or modification of Windows registry keys. | Detects potential persistence mechanisms or configuration changes made by malware. | | 201002 - Win Registry Value Activity | Changes to specific values within Windows registry keys. | Tracks detailed registry changes often tied to malware behaviors or system misconfigurations. | | [3001 - Account Change](https://schema.ocsf.io/1.3.0/classes/account_change) | Creation, deletion, or modification of user accounts. | Identifies unauthorized account creation or privilege escalation, crucial for detecting insider threats or compromised accounts. | | [3002 - Authentication](https://schema.ocsf.io/1.3.0/classes/authentication) | Login attempts, successful authentications, or failures. | Detects brute-force attacks, credential theft, or unauthorized access. | | [3005 - User Access](https://schema.ocsf.io/1.3.0/classes/user_access) | Access attempts to systems or applications by users. | Tracks user behavior for anomalies, helping identify potential insider threats or compromised accounts. | | [3006 - Group Management](https://schema.ocsf.io/1.3.0/classes/group_management) | Creation, modification, or deletion of user groups. | Monitors privilege escalation or unauthorized group changes, which can weaken security policies. | | [4001 - Network Activity](https://schema.ocsf.io/1.3.0/classes/network_activity) | Network connections, data transfers, or communications between systems. | Identifies anomalous traffic, such as data exfiltration, lateral movement, or communication with malicious servers. | | [4002 - HTTP Activity](https://schema.ocsf.io/1.3.0/classes/http_activity) | HTTP requests and responses. | Tracks web-based threats, including phishing, command-and-control (C2) communication, or data leakage. | | [4003 - DNS Activity](https://schema.ocsf.io/1.3.0/classes/dns_activity) | DNS queries and responses. | Detects domain abuse, including lookups to known malicious domains or DNS tunneling. | | [4009 - Email Activity](https://schema.ocsf.io/1.3.0/classes/email_activity) | Sending, receiving, or interacting with emails. | Monitors phishing attempts, unauthorized email access, or malicious attachments. | | [4011 - Email File Activity](https://schema.ocsf.io/1.3.0/classes/email_file_activity) | File attachments in email communications. | Detects potentially harmful files, such as malware-laden attachments. | | [4012 - Email URL Activity](https://schema.ocsf.io/1.3.0/classes/email_url_activity) | URLs embedded in email content. | Identifies phishing links or malicious websites targeting users. | | [5001 - Inventory Info](https://schema.ocsf.io/1.3.0/classes/inventory_info) | Information about hardware or software inventory. | Assists in asset tracking, ensuring all devices and software are accounted for and secure. | | [5003 - User Inventory](https://schema.ocsf.io/1.3.0/classes/user_inventory) | Details about user accounts and related information. | Provides visibility into user accounts, helping detect unauthorized or orphaned accounts. | | [6003 - API Activity](https://schema.ocsf.io/1.3.0/classes/api_activity) | Interaction with APIs, including calls, responses, and errors. | Tracks misuse of APIs, such as unauthorized access or data breaches through poorly secured endpoints. | | [6005 - Datastore Activity](https://schema.ocsf.io/1.3.0/classes/datastore_activity) | Operations on databases or data storage systems. | Identifies unauthorized data access, modifications, or exfiltration attempts. | | [6006 - File Hosting](https://schema.ocsf.io/1.3.0/classes/file_hosting) | Activity on file hosting services or platforms. | Detects potential data leaks or unauthorized usage of cloud storage for malicious purposes. | > [!NOTE] > 💡About data sources and event classes > > Each data source has a unique set of event classes available to it and not all event classes exist in every data source. For instance, when selecting `okta-users` logs, you will not be able to search for API activity. > > Hover over an event class from the list to display the the data sources it can be found in. > > > > ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Event class hover info.png) --- #### Query ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Search query builder(1).png) Search Query The Search tool features a flexible query builder designed to adapt to both straightforward and advanced investigative needs. It allows you to construct queries ranging from simple filters to highly complex, layered conditions for more granular data exploration. Key capabilities include: - **OCSF Attributes**: Select from a list of OCSF attributes (or Observables) to find the specific information you need. - **Advanced Operators**: Use a variety of operators, such as equals (=), not equals (!=), like, not like, and more, to define precise search parameters. - **AND/OR Logic**: Combine search clauses using AND or OR relationships to refine your results. ****Available operators**** | Operator | Function | Example | | --- | --- | --- | | EQUALS | Return only results that are equal to the specified value. Equivalent to the SQL `=` symbol. | To find events in which the Notepad instance was run, use: `process.name EQUALS Notepad++` | | NOT EQUALS | Return only results that are different than the specified value. Equivalent to the SQL `<>` or `!=` symbols. | To find events including all processes other than Notepad, use: `process.name NOT EQUALS Notepad++` | | LIKE | Return only results that are similar to the specified value. Allows searching for patterns instead of full equality using the symbol `%`. Equivalent to the SQL LIKE function. | To find events where the file path includes the term 'audit', use: `file.path LIKE %audit%` | | NOT LIKE | Return only results that are not similar to the specified value. Opposite of the LIKE statement. | To find events where the file path does not include the term 'audit', use: `file.path NOT LIKE %audit%` | | CS LIKE | Case sensitive LIKE. | To find events where the file path includes the term 'Audit', use: `file.path LIKE %Audit%` Note that while this **will display** results including 'Audit', it **will not display** results including 'audit', as this is case-sensitive. | | CS NOT LIKE | Case sensitive NOT LIKE. | To find events where the file path does not include the term 'audit', use: `file.path NOT LIKE %Audit%` Note that while this will **not display** results including 'Audit', it **will display** results including 'audit', as this is case-sensitive. | | IN | Return only results that are equal to a value from a list. Similar to creating multiple equal queries with an OR relation. | To find events where the file owner’s email address is one of the specified email addresses, use: `file.owner.email_addr IN john@acme.com,stan@acme.com,lee@acme.com` | | NOTIN | Return only results that are not equal to a value from a list. Similar to creating multiple not equal queries with an OR relation. | To find events where the file owner’s email address is NOT one of the specified email addresses, use: `file.owner.email_addr NOTIN john@acme.com,stan@acme.com,lee@acme.com` | | MATCHES REGEX | Include only rows with attributes that match the specified regular expression (in Python flavor). | | --- #### Scope ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/search scope panel.png) Scope panel As you are building your search query, the scope panel displays which data sources and events will be queried based on your selected parameters. The scope panel updates live based on the changes you make to the search filters and query sections, showing a summary of the expected search. This will provide you with a general overview of the origins of the expected search results, even before running the search itself. If more than one clause exists in the search query, the panel will show a separate scope for each clause upon hovering over the clause, or an aggregated scope of the entire query when hovering over an empty space in the Query field. In the video below, notice how the scope panel changes based on the cursor location. [2024-11-19_17-34-45](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/2024-11-19_17-34-45.mp4) ****💡Build a search query in Builder mode**** **To build and run a search query:** 1. Navigate to **Investigation > Search**. ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Navigate to search.png) 2. From the filters section, select a time range, data sources and event classes. **Learn more** [**here**](/v1/docs/start-a-new-search#📘-about-the-query-builder). 3. In the **Query** field, search for and select the required attribute. Then select the operator and then enter the required value. ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/search query 1.png) 4. To add another statement, click the + sign and select **AND** to add a statement to the existing clause, or **OR** to start a new clause. ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/search query 2.png) > [!NOTE] > 💡Tip > > You can easily duplicate a clause or remove it using these shortcuts: > > ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/search query 3.png) 5. Review the scope of the search on the right-side scope panel. 6. Click **Run query**. **🔎 **SQL mode**** ****📘 About the SQL mode**** The search query builder includes the following elements: 1. AI SQL generator 2. Query 3. Resources ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(58).png) Click to enlarge > [!NOTE] > 📘Note > > Saving SQL queries is not currently supported. We're working on enabling this functionality soon. --- #### AI SQL generator The AI SQL generator allows you to generate an SQL query based on a plain language text. This tool is based on the AI capabilities of Hunters’ Pathfinder LLM engine. ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(59).png) AI SQL generator > [!NOTE] > 📘Note > > The AI SQL Generator currently generates SQL based on OCSF views only. **FAQs** ****Which language model is powering the AI Assistant?**** To power the AI Assistant, Hunters is using the GPT-4o AI language model, powered by Microsoft Azure OpenAI Service. ****Is my data used to train the AI model?**** No. Your data will not be used to train, retrain, or improve any AI model. Hunters AI Assistant runs within Hunters’ private Azure cloud environment, which means it enjoys Microsoft’s robust enterprise-level data protection safeguards. ****Can I opt out of this service?**** Yes, you can. Reach out to [Hunters Support](https://cyberhunter.atlassian.net/servicedesk/customer/portals) to request to opt-out of the AI Assistant tool. > [!WARNING] > ⚠️Attention > > AI-powered features can enhance productivity, but it's essential to recognize their limitations. Given the current nature of generative artificial intelligence technology, Hunters AI responses may sometimes be incorrect or inaccurate. To ensure reliability, always verify AI-generated content for accuracy and relevance before relying on it. > > > > Hunters AI Assistant is subject to Hunters’ [SaaS Terms of Service](https://www.hunters.security/hunters-saas-terms-of-service) and Documentation. --- #### Query ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(61).png) SQL Query In the SQL query panel, you can write your query in SQL. It functions as any other SQL editor, where you can freely write your query using the resources in the Resource panel. > [!NOTE] > 📘Note > > The SQL editor supports both raw tables and OCSF views. --- #### Resources ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Screenshot 2025-06-24 at 14.18.37.png) The Resources panel lists all of the tables at your disposal. This includes all of your connected data sourced and types that are also available in OCSF. As you are building your SQL query, use the Resource panel to copy the required resource name and paste it in your query. You can use the search bar to narrow down the list to the tables that interest you. In the OCSF views folder, you will find, for each OCSF event class, a parent view that aggregates all relevant data sources (e.g*.,* OCSF_2004_DETECTION_FINDING_1_1_0). Each of these parent views is followed by a folder containing data source-specific views, such as OKTA_LOGS_2004_DETECTION_FINDING_1_1_0 and CROWDSTRIKE_DETECTS_2004_DETECTION_FINDING_1_1_0. > [!NOTE] > 📘Note > > The Resources panel shows both raw and OCSF views. ****💡Build a search query in SQL mode**** **To build and run a search query:** 1. Navigate to **Investigation > Search**. ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Navigate to search.png) 2. Switch to **SQL mode**. 3. Create an SQL query using one of the two methods: - To generate an SQL query using plain language, prompt the information you want to retrieve in the AI SQL generator, and then click **Generate SQL**. - To write your SQL query from scratch, use the query panel and then click **Run Query**. > [!NOTE] > 📘Note > > Whichever method you choose, use the resources in the Resource panel to understand where and what you can search. / Raw data refers to unprocessed or unfiltered information that is collected by the Hunters SOC Platform. This data typically consists of a wide variety of information related to the operation of IT systems, including network traffic logs, event logs, system performance metrics, and security event data.