IT Security Search 11.4.1 - User Guide

Running Searches

To begin searching, enter what you are looking for in the search box. For example, start with a user name, a network share path, a computer name or a phrase to look for in event fields.

A search involves all available item types (events, users, files, computers and so on) at once, no matter which item type is currently highlighted. By default, the number of results returned is limited to 100,000. For Recovery Manager for Active Directory items, the limit is fixed at 5,000.

Viewing Data by Object Type

IT Security Search groups the discovered data by object type:

• Computers
• Events
• Files
• Groups
• OUs
• Shares
• Users

• Various other object types for which only Enterprise Reporter provides data, such as those related to Exchange, Azure and Office 365.

You can restrict the view to these object types by clicking the corresponding tab at the top of the grid; for miscellaneous object types provided only by Enterprise Reporter, click the More tab. On this tab, you have the option to make a dedicated tab for any such object type. For that, locate its item in the Object Type list on the left and click the pin icon on that item; this pins a new tab for the object type next to the More tab. When you don't need the tab any more, you can close it; you can pin it again later at any time.

The object type is also switched when you use links in the context of some object's details, such as Activity initiated by this user or Who granted permissions to this file.

Specifying a Time Range for Events

To display events from only a specific time period, use the time range filter. For that, click the clock icon in the search box. If you choose not to specify a time range, the search will involve all available data.

Customizing the Event Grid Layout

When you view events of a particular kind, you may want to see a specific set of fields, including fields unique to such events. You may also want to hide fields that don't matter to you. To make such changes to the event layout, use the tools in the Columns drop-down menu to the right of the grid.

To add a field as a column, type its name in the text box provided in the drop-down menu and click Add. You can specify any name. To look up the correct field names, use the details view for any relevant event.

To remove an existing column, click the trash can icon next to its name.

To restore the default set of fields, click Reset to defaults.

To reorder columns, drag their headings around in the grid.

Your custom layout settings are used when you export events to PDF or CVS (using the Export to drop-down menu).

Understanding the Event Timeline

The event timeline is a bar graph representation of search results, where you can quickly spot event patterns. For example, it helps you find out the peak hours for the events you are interested in or easily track activity outside business hours.

Viewing Details of Search Results

When you select an item from the result list, the right pane shows brief details about the item. To go to the full details view for this item, click View Details.

The details view also suggests links to related data which you might be interested in and which you might be trying to find in the first place. Clicking such a link starts a search in an automatically supplied context. For example, when you are viewing the details of a folder in a network share, the following links are ready for you:

• Who accessed this folder
• Who granted permissions to this folder
• Files and folders in this share

Information about users, groups, computers and organizational units can come from more than one source. At this time, the following systems provide data about them: Enterprise Reporter, Recovery Manager for Active Directory and Active Roles. When multiple sources have information about the same object, IT Security Search shows data from the source that submitted it first, so that the results can be displayed sooner. A warning is shown about additional data that may be available. If you want these results, click the run a full scan link in the warning text. This will cause IT Security Search to retrieve the data from the remaining sources and correlate it.

Navigating Session History Using Breadcrumbs

As you work with the search results, your search path is saved as a breadcrumb sequence. This helps you go back to any previous step in your session without retracing the steps.

Using Facets to Filter Results

Facets are quick view filters by property value. When you apply a facet, IT Security Search shows only matching items. You can apply multiple facets at once, progressively limiting the number of results; you can also remove any of the facets you have applied.

Facets are shown to the left of the result pane. To apply a facet, click an available value link. For example, if you are viewing the details of a deleted user account (where the value of State is Deleted) and want to focus on other deleted users, click the Deleted link.

Alternatively, you can use the item's properties to work with facets. The properties that support this have funnel icons next to them in the details pane. To apply a facet, click such a property.

Fine-Tuning Your Search Terms

Simple searches produce results where the term you specify is contained anywhere in the discovered data. To make your searches less broad and more relevant, you can use hints—for example, by prefixing the field names to look in. For details, see Search Term Syntax.

Automating Complex Search Scenarios

Some search workflow ideas are best expressed as multi-stage search queries where data produced by a search is automatically streamed into the next search in a chain. The pipe operator (|) helps you achieve this, and field names in curly braces specify which fields to analyse in that data.

Example 1: Find the managers of all users who have created or deleted files on the \\FILESRV1\Software network share

"\\FILESRV1\Software" | Description:{SharePath} AND (What="File Created" OR What="File Deleted") | Who={Who} | DisplayName="{ManagedByDisplayName}"

Example 2: Find events by users from the Milwaukee office on computer FILESRV1

Office="Milwaukee" | Who:{SAMAccountName} AND Where:filesrv1

Example 3: Find computers where members of the Accounting group have logged in

"Accounting" | Who:{SAMAccountName} AND What:logon | Where={Where}

Example 4: Find all users from the same office as user dshaw

Who="dshaw" | Office="{Office}"

Search Term Syntax

Use the following syntax for search terms in the search box. Searches are case-insensitive.

For details about the fields that you can use in your search queries, see Data Field Reference.

Single-Word Terms

This is known as full-text search. The search involves all available fields and uses the Contains operator.

Term Combinations

Searching in Specific Attributes

To apply your search term only to a particular attribute, prepend the name of the attribute with a colon (:) or equals sign (=) to your search term, as shown in the table below. If the attribute name is made up of multiple words, enclose it in brackets (as in [log name]:security). All the syntax conventions described above also apply.

The following distinction is important:

• Labels unambiguously mapped to entry attributes; for example, Path:"Documents and Settings" in file access entries
  In this case, the search involves the specified field and uses the Contains operator.
• Labels mapped to different attributes in different contexts (known as normalized attributes); for example, Where:primrose would mean the primrose domain for users or groups, the primrose computer for files or shares, and so on
  In this case, the search involves the associated fields as necessary and may even modify the search terms.

For details about the meanings of labels in particular contexts, see Normalized Attributes below.

Specifying Quotation Marks

If your search term must include double quotes ("), then for each double quote you need supply an additional double quote as an escape character. See the following examples:

This requirement does not apply to apostrophes, which are frequently used as quotes. Single quotes of this kind do not need escaping and should be specified in a plain string, as in "local 'Administrator' user".

Filter Syntax

Select one of the operators (explained in the following table), and enter your filter terms.

The following search syntax rules described above also apply to filter terms:

• Terms are case-insensitive.
• The term can be a single word, multiple words, or a phrase in quotation marks.
• In single-word terms, a trailing asterisk is treated as a wildcard character.
• In exact phrases, an asterisk is treated as a regular character.

Normalized Attributes

The following table shows what attributes are involved in searches that use the Who, What and Where labels. Active Directory attributes are bolded. Information about events is not included, because Who, What and Where are mapped directly to the same-name fields in InTrust and Change Auditor events.

Using Functions in Queries

Functions are a way to transform the results of a query to other objects inside a larger query. IT Security Search functions take a query as their single argument and return a collection of objects. Function names are case-insensitive.

The following functions are implemented:

If the argument query returns objects that a function cannot be applied to, the function skips these objects. For example, the Members function doesn't do anything about user account objects.

Example

Suppose you want to get events from all computers where user martystu is an administrator. Use the following query:

MemberOf_Deep(Who=martystu) AccountSID="S-1-5-32-544" | Where="{DomainName}" Who=martystu

This query takes advantage of the well-known SID of the built-in Administrators group. First it finds all aliases of this user account, then it gets all local Administrators groups where those accounts are members, no matter whether direct or indirect (membership information is discovered by Enterprise Reporter). Then the query pipes the results through a sub-query to find all events by these users on computers where they are administrators. For details about search-in-search capabilities, see Making Multi-Stage Searches.

Making Multi-Stage Searches

You have the option to run a search on the results of another search. It is a way to automate your established search practices, and it may provide a clearer and more convenient representation of your intentions.

This is similar to how the output of a command is redirected into another command as its input in PowerShell and Unix shell languages. Accordingly, search result redirection is provided by the familiar pipe (|) operator.

To indicate a field whose value should be carried over from the left query to the right through the pipe, enclose the field name in curly braces, as in {Where} or {EventID}.

Example:

"rd.itsearch"| What:Logon AND Who:"{SAMAccountName}" | Name="{Where}"

In this three-stage search, the initial results are refined twice. First, it finds all users that are members of the rd.itsearch group. For these users, it finds such events that the users' SAM account names are in the Who field, and the What field contains "Logon". From the resulting events, pick only those that have any of the discovered computer names in the Where field.

Auto-Resolution of the Current User

If you specify the {Context.CurrentUser} variable in your query, it is automatically resolved to information that identifies the user who is running the query. The following information is extracted (where available): account name in domain\user format, SAM account name, display name and SID.

For example, if user Alan Smithee supplies a query containing Who="{Context.CurrentUser}", the resulting substituted information can be something like this:

Who=production\asmithee OR Who=ASmithee OR Who="Alan Smithee" OR Who="S-1-5-21-2591644-1571856274-80062049-1617"

If you want a particular identifying field instead of a set of fields, use the following accessors:

• {Context.CurrentUser.FullAccountName}
• {Context.CurrentUser.SamAccountName}
• {Context.CurrentUser.DisplayName}
• {Context.CurrentUser.AccountSid}

Examples:

• Description:"Computer of {Context.CurrentUser.DisplayName}" becomes Description:"Computer of Alan Smithee"
• onpremisessecurityidentifier="{Context.CurrentUser.AccountSid}" becomes onpremisessecurityidentifier="S-1-5-21-2591644-1571856274-80062049-1617"

Specifics of Recovery Manager for Active Directory Data

Recovery Manager for Active Directory provides data about users, groups, computers and organizational units, including those that have been deleted. Searching within that data should be approached in special ways.

One drawback is that full-text search does not work in Recovery Manager for Active Directory. Generally, it is recommended that you complement this data with results from Enterprise Reporter, if possible.

Searching by Distinguished Name

In all attributes that contain distinguished names, such as distinguishedName or manager, only the "equals" operator is used, meaning that the value must match exactly. For example, if the manager attribute of a user is "CN=David Shore,OU=Employees,DC=it,DC=example,DC=corp", then the following happens:

• These queries match the user:
  Manager:"CN=David Shore,OU=Employees,DC=it,DC=example,DC=corp"
  Manager="CN=David Shore,OU=Employees,DC=it,DC=example,DC=corp"
• These queries do not match the user:
  Manager:"CN=David Shore"
  Manager="CN=David Shore"

Searching for Deleted Objects

When Active Directory objects are deleted, they are really moved to the Deleted Objects container; some of their attributes are cleared and some are changed, including the name. These tips will help you compose queries that produce the expected results for deleted objects:

• The name attribute undergoes the following change: <object_name> becomes <object_name>\0ADEL<object_GUID>. If you are aware of this pattern, you can look for deleted objects specifically.
• The samAccountName attribute remains unchanged in deleted users, computers and groups.
• In computers, the dnsHostName attribute also remains unchanged.

Searching Without Specifying Fields

When you supply a search term without prefixing a field name, IT Security Search adds the field name for you, as follows:

It is recommended that you specify the target fields explicitly and use the fields suggested in Searching for Deleted Objects above.

Specifics of Enterprise Reporter Data

Data from Enterprise Reporter contains information about permission assignments, and you can get this information by using the Assignment field in your search queries. This field accepts the following values: Direct, Indirect and All. Example: Assignment=All. If the Assignment field is omitted, its value is assumed to be Direct.

If you use the Assignment field in a query, permissions are analyzed for the objects indicated by the Who field.

Using the PermissionsForFile keyword also gives you permission assignment data from Enterprise Reporter. This keyword requires that you specify a nested search query enclosed in double quotes; the inner query must use single quotes. Example:

PermissionsForFile="Where='server1' AND Path='D:\some\important\folder\'"

In the inner query, the What keyword helps specify the kind of permission to search for. Both of the following queries will return users with the Full Control permission:

PermissionsForFile="Where='server1' AND Path='D:\some\important\folder\' AND what:full"

PermissionsForFile="Where='server1' AND Path='D:\some\important\folder\' AND what:'full control'"

The PermissionsForFile keyword can be used in conjunction with other keywords and doesn't have to specify the entire query. The following will return all users called Administrator who have access permissions:

Who:Administrator PermissionsForFile="Where='server1' AND Path='D:\some\important\folder\'"

Searching for Effective Permissions

You can query effective permissions by including What:Effective. For assignments, this option takes effect if you specify Assignment=All or Assignment=Indirect.

If What:Effective is omitted, the results include all files on which both Allow and Deny permissions are set. For example, if a user is a member of a group which is denied access to a particular file, then the file will be in the results, and Access Type will be recognized as Deny. If What:Effective is included, then the results will contain only Allow permissions.

Examples:

Who="ITSS\UserRead" AND Assignment=All AND What:Effective

Who="ITSS\UserRead" AND Assignment=All AND What:Effective AND What:modify

PermissionsForFile="Where='ITSER.LOCAL' AND Path='C:\ImportantShare\Folder1\' What:Effective"

PermissionsForFile="Where='ITSER.LOCAL' AND Path='C:\ImportantShare\Folder1\' What:Effective What:Modify"

Examples

Queries for events

Queries for files and folders

Data Field Reference

The following topics provide details about fields that you can use in search queries, organized by supported system:

• Enterprise Reporter Data Fields
• InTrust Data Fields
• Change Auditor for Active Directory Data Fields
• Active Roles Data Fields
• Recovery Manager for Active Directory Data Fields

Enterprise Reporter Data Fields

The following are lists of fields that occur in Enterprise Reporter data, organized by type of returned object.

Computers

Files

Groups

OUs

Shares

Users

Other Object Types

In addition to the object types listed above, Enterprise Reporter can provide field data for various other objects. To see the kinds of objects available in your environment, click the More tab in the search result grid. For a list of supported fields of a particular object type, see the details of such an object.