Searching security events

Security > Events searches every security event Tenvara holds, from every source, in one place. Use it to investigate a detection, answer "who signed in to that server last night", or check a hunch across every customer.

Running a search#

1. Type in the search bar (press / to jump to it). Suggestions offer field names, then the top values of that field over the current time range. Press Tab or Enter to take one.
2. Choose the time range (Last 15 minutes to Last 30 days, Today, or between two times).
3. Add a customer or device if you want to narrow it.
4. Press Enter. Up and down arrows in the bar walk through your earlier searches.

The results show the number of events and the exact time span, a histogram (drag across the bars, or click one, to zoom in), and the events newest first. The columns include Severity, Time, Customer, Action and Message; any other field, such as the device or the user, can be added from Columns. Load more at the bottom brings the next rows, and j, k and Enter move through the list.

A mistake in the search is underlined where it is, with a suggestion for an unknown field ("Did you mean ...?").

Asking in plain English#

When AI is set up with your own Anthropic key and the Security AI feature is on (see Setting up AI), you can describe what you are looking for instead of writing the query:

1. Press Ask in plain English under the search bar.
2. Type the question, for example "failed logons to Harbour View's servers from outside the UK last night".
3. Press Make the search. Tenvara shows the query it wrote, the time range and customer it chose, and a one-line explanation.
4. Press Run this search to run it, or Put it in the search bar to check and edit it first.

The query is checked exactly as a typed one is, against the field list, the time limits and the customers you may see, so it can only ever be a normal search. Nothing runs until you choose to, and the AI never writes database queries. Each question counts against the AI caps and is listed on the Activity tab of Settings > AI.

The search language#

Terms side by side must all match. Short names work too: user, host, action, category, outcome, country, asn, owner, network, process, cmdline, app, upn, src, dst, port, sev and others.

Every public address carries its country, city and network owner, and addresses on a threat intelligence list can be found with intel.category, intel.source and intel.confidence. See Threat intelligence and MITRE coverage.

Some useful searches:

action:logon-failed user:administrator
source:m365 action:sign-in -country:GB
intel.category:* outcome:success
action:member-added labels.privileged:true
process:powershell.exe cmdline:*-enc*
action:(malware-detected OR protection-disabled)

Tip: Host names are stored as the device reports them (upper case for Windows), so host.name:*pc01* is the easy way to match without worrying about case.

Events you will see#

Each event has a normalised action, so the same search works across sources. Common ones:

Looking at one event#

Click an event to open it in the side panel. It shows when it happened, the customer, device, user, source and outcome, where each address is (country and network owner, with a Known bad badge when a threat list knows it), then every field and label. Hover a field to filter for it, filter out it, or copy it. The raw record from the source is at the bottom, with a copy button.

The buttons across the top pivot the search:

• Show events around this: five minutes either side, on the same device.
• Show this user's events: the last week.
• This device's events: everything from the device.

The link button copies a link straight to the event. Pin as evidence keeps a copy of the event on a detection or incident of the same customer, so it outlives the event store's retention.

Opening a search from elsewhere#

Search security events is in the More actions menu of a customer and of a device, and opens this page already narrowed to them. A detection's Open in event search runs the exact search its rule ran.

Saved searches, live tail and export#

• Save search keeps the current search and range. Saved searches appear as buttons under the bar (for example "Failed logons today" or "New admin accounts"). Save them for yourself or share them with everyone.
• Live tail checks for new events every few seconds and adds them at the top. It pauses while an event is open or the tab is hidden.
• Export CSV downloads up to 100,000 matching events, with customer and device names beside their ids. Every export is recorded in the activity log.

Every search is a link: copy the address to share exactly what you are looking at.

How long events are kept#

By default events are kept 90 days, the raw records behind them 30 days, and hourly counts (for charts) 400 days. Administrators can change these on the General tab of Settings > Security monitoring. See Event sources and collection.