Skip to main content Link Search Menu Expand Document (external link)

Query - Field Entity Match Filter

Table of contents
  1. sEntityinfo(field, entity_list_name)
  2. Example:

sEntityinfo(field, entity_list_name)

The sEntityinfo filter is used to search/match the exact content of a field, for any matching values in the specified ‘Entity Info’ list.

The entity information lists can be found in https://demo.cloud.fluencysecurity.com/user/EntityInfo.

Example:

  search {from="-3d@d",to="@d"} sContent("@eventType","nxlogAD") and sEntityinfo("@fields.EventID","AD_EventID")
  let EventID = f("@fields.EventID") 
  aggregate count() by EventID

The results are as below. In this example, “AD_EventID” is the entity name and “@fields.EventID” is the field. Only search within those column whose field values (“@fields.EventID”) match the entity name (“AD_EventID”).

The decription of the eligible event ID during this search can be checked as below:

  search {from="-3d@d",to="@d"} sContent("@eventType","nxlogAD") and sEntityinfo("@fields.EventID","AD_EventID")
  let EventID = f("@fields.EventID") 
  let {Description}= entitylookup(EventID, "AD_EventID")

Page last updated: 2022 Oct 26