Navigation and search

The SOAR Platform provides a robust search, and the ability to filter the information on the various pages.

You can use the search in the toolbar, which appears on every page as a magnifying glass, to search for a keyword or phrase in any or all object types.

The search supports the following items:

Wildcards (*), which you can use in any location in your entry.
Tilde (~) at the end of your entry denotes an approximate search, also called a fuzzy search. It returns strings that match your entry exactly, with one character extra, and with one character different from your entry.
Phrases when enclosed in quotation marks.

Search is not case-sensitive.

Using SOAR search

Click the magnifying glass in the menu bar to display the Search field. By default, each search checks for your entry in every object type.

The following sample graphic shows the default, All. To narrow your search to a specific object type, click the Select Context arrow and select the type.

Alternatively, on the Search results page, you can use the tabs to filter by object type.

On the Search results page, each result starts with an icon that represents the object type. Hover over the icon to see a definition of the object type.

On the Search results page, you can add filters that can further narrow your results. The previous graphic shows the default filters, Owner (set to All) and Status (set to Active). To add filters, click Add Filter then select the filters that you want to use. As you click the checkbox next to a filter, it appears with the other filters. The following example shows Malware family name selected.

You can then click the filter and choose or enter a value, depending on the filter.

To remove a filter, click the x. To remove all filters, click Clear Filters.

You can use the Search field within the results page to start a new search while preserving your previous search results. Use the back button on the browser to return to your previous search.

Using Advanced Search

The search feature uses the Elasticsearch search and Analytics Engine, which allows the search feature to support advanced search capabilities.

The characters, + - & | ! ( ) { } [ ] ^ ? : \ / $, are special characters and need to be used with proper syntax or escaped by using the “\” character.

The following sample searches show how to use the advanced search:

When you search for a MAC address, use quotation marks or escape the reserved colon (“:”) characters.
```
"ab:cd:ef:12:56:89"
```
Or
```
ab\:cd\:ef\:12\:56\:89
```
When you search for a file or package path, use quotation marks or escape the reserved characters.
```
"AndroidDownloadManager/6.0.1"
```
Or
```
AndroidDownloadManager\/6\.0\.1
```
Another example.
```
"/home/admin/stuff"
```
Or
```
\/home\/admin\/stuff
```
You can also use regular expressions. For example, you can search for a string, such as “aaabbb”, using a regular expression enabled search query.
```
/a{3}b{3}/
/aaa?bbb?/
```

You can find additional information about Elasticsearch query string functions by clicking the following link.

https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html