genian-edr-search
Searches the Elasticsearch indexes of a Genian Insights E console.
Without the stats option the documents themselves are returned; with it the aggregation runs on the console server and only the result comes back. Limit the number of rows with the limit command.
genian-edr-search [profile=VALUE] [duration=VALUE] [from=VALUE] [to=VALUE] [index=VALUE] [dsl=VALUE] [stats=VALUE] [span=VALUE] [terms-size=VALUE]
- profile=VALUE
- Optional. Genian EDR connect profile name. Every Genian EDR profile is queried when omitted
- duration=VALUE
- Optional. How far back from now to search, in s (second), m (minute), h (hour), d (day) or mon (month). e.g. 10m, 1d
- from=VALUE
- Optional. Start of the range in yyyyMMddHHmmss format; omitted trailing digits are padded with zero. The range has no lower bound when omitted
- to=VALUE
- Optional. End of the range in yyyyMMddHHmmss format. The range has no upper bound when omitted
- index=VALUE
- Optional. Index to search: endpoint (default), threat, alert or uploadlist
- dsl=VALUE
- Optional. Lucene query string, the same syntax the console search box takes. Every document is searched when omitted
- stats=VALUE
- Optional. Aggregation as
<function>[, <function>…] [by <field>[, <field>…]], where function is one of count, dc, sum, avg, min, max - span=VALUE
- Optional. Buckets the aggregation by time, e.g. 10m, 1h, 1d. Needs the stats option
- terms-size=VALUE
- Optional. Maximum number of groups per by field. Defaults to 1000, up to 9999. Needs the stats option
Output Fields
Without the stats option the document fields of the searched index are returned under their own names, plus the following.
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Time | EventTime for endpoint, DetectTime for threat and alert, UploadTime for uploadlist |
With the stats option the group fields and the aggregation results are returned.
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Bucket time | Start of the time bucket when the span option is given |
| (by field) | String | Group | Value of a field named in the by clause |
| count | Long | Count | Number of documents in the group |
| dc(field) | Long | Distinct count | Number of distinct values of the field |
| sum(field) | Double | Sum | Sum of the field values |
| avg(field) | Double | Average | Average of the field values |
| min(field) | Double | Minimum | Smallest field value |
| max(field) | Double | Maximum | Largest field value |