Search for Events

Most organizations receive thousands of events per day. You can search for events to quickly focus on the most important or relevant information you receive.

There are two ways to search for events in F5 Distributed Cloud App Infrastructure Protection (AIP):

  • Keyword and operator search – Use specific keywords and operators to find events that match your search criteria.
  • Date and Time picker – Select specific dates and times within which to find events. By default, events that occurred during the previous six hours display.
Keyword and Operator Search

You can search for specific events using keywords in the event metadata, such as user, timestamp, or session identification (ID). You can then use an operator to specify the specific keyword match, such as a username, a specific date and time, or a specific session ID number.

You can use keywords two ways:

  • Add metadata from an event to your search query
  • Type keywords into your search query

Add Event Metadata to Your Search Query

Distributed Cloud AIP helps you quickly add event metadata to a search query. This allows you to find other events that occurred on the same server IP address or at the same date and time or by the same user, among other options.

Note

Distributed Cloud AIP translates some metadata field names to other information in the search query. This is a result of the event normalization that occurs when events are ingested by Distributed Cloud AIP. The following event metadata field names change in the search query:

  • server changes to agent_id (Audit, FIM, Linux Host, Login, ThreatIntel) or profile_id (CloudTrail)
  • PID changes to pid
  • PPID changes to ppid
  1. Log into Distributed Cloud AIP.
  2. Click the Events tab. The Events screen displays.
  3. Find the event you want to use as the basis for your search.
  4. Next to the field you want to add to your search query, click the Expand button. The Add to Search option displays.

    add-to-search.png
  5. Click Add to search. Distributed Cloud AIP adds the metadata to the search query field.


    search-query-field.png

  6. Repeat steps four and five for any other metadata you want to add to the search query. For more information on creating a usable search query, see Supported Keys and Operators.

Type Keywords into Your Search Query

Distributed Cloud AIP supports specific keywords and operators. For more information, see Supported Keys and Operators.

Date and Time Picker

The Date and Time picker allows you to select the start and end calendar dates, hours, and minutes within which to display events. By default, the previous six hours of events display. You cannot select a date and time later than the current date and time.

Tip

Distributed Cloud AIP retains events for three calendar days.

  1. Log into Distributed Cloud AIP.
  2. Click the Events tab. The Events screen displays.
  3. Click the Date and Time picker.


    date-time.png

    The Date and Time picker dialog displays.

    DateTimePicker.png

  4. On the calendar, click the date by which to start filtering. Available dates display with a white background.
  5. Click the date by which to stop filtering. If you only want to display events for one day, then click the same day twice.
  6. To select the time, do one of the following:
    • To select a predetermined time window:
      1. Click the specific time option in the left menu.


        DateTimePrePick.png

      2. Click the Apply button. The start and end times change to match the selection.
    • Manually select the date range and/or hours and minutes:
      1. On the left clock (start), select the hour, minute, and second at which to start the search.


        DateTimeClock.png

      2. On the right clock (end), select the hour, minute, and second at which to start the search.
      3. Click the Apply button. The start and end times change to match the selection.


        SelectedDateTime.png

Search Results

Search results display below your search criteria. By default, Distributed Cloud AIP displays all events that occurred during the previous six hours.

There are four key components to search results:


search-results.png

    1. Results Found – Displays the total number of events that match your search criteria.
    2. Sort – Allows you to organize your search results from the newest to the oldest or vice versa. From the drop-down menu, select Ascending (Oldest to Newest) or Descending (Newest to Oldest)
    3. Pages – Displays when more than 50 events match your search criteria. Click a page number button / First button / Previous button / Next button to go to a different page of search results.
    4. Event Details – Detailed metadata displays for each event that matches your search criteria. For more information, see All Events Tab > Event Details.

Exceptions for FIM Create, Delete, and Move Events

The Distributed Cloud AIP Agent depends on inotify to populate FIM events. Due to inotify limitations, Distributed Cloud AIP cannot provide information information about the user that triggers a FIM Create, Delete, or Move event. Additionally, inotify cannot distinguish between events that inotify triggers and events that other processes trigger. As a result, the Distributed Cloud AIP Linux Host Agent will not provide the following information for FIM Create, Delete, or Move events:

  • containerID
  • containerImage
  • containerLabel
  • gid
  • group
  • pid
  • ppid
  • session
  • uid
Was this article helpful?
0 out of 0 found this helpful