SIEM Search Syntax Cheat Sheet: Practical Filtering and Analysis
Quick reference for security analysts querying logs. Learn how to combine field filters, exclude noise, and spot anomalous spikes without memorizing complex manuals.
The fundamentals of SIEM filtering
Every query engine breaks logs down into key-value pairs. Here are the core patterns you will use on 90% of your shifts:
- Exact match: user="john.doe" Finds events where the user field equals john.doe exactly.
- Inequality and exclusion: status!=200 Filters out normal successful web requests so you only see errors and redirects.
- Wildcards: cmd="*powershell*" or ip="10.0.*" Matches any command containing powershell anywhere in the path, or any internal IP in the 10.0 subnet.
Numeric comparisons for anomaly detection
Numeric fields let you filter by response size, port number, or execution duration:
- High ports: dst_port>1024
- Large outbound data transfers: bytes_out>10000000 Finds file transfers over 10 megabytes, which is critical when hunting for data exfiltration over FTP or HTTPS.
- HTTP response codes: status>=400 Pulls all client and server errors in a single filter.
Combining filters with boolean logic
When investigating an incident, you want to narrow down thousands of events to just the relevant thread:
action=failure AND dst_port=22 Shows failed SSH attempts.
user="admin" OR user="root" Pulls events for either high-privilege account.
src_ip=192.168.1.50 NOT user="system" Looks at activity from an endpoint while excluding background system noise.
Try these queries on real logs
The fastest way to cement these patterns into muscle memory is to run them on actual logs. Check out our interactive Query Reference guide for live syntax examples, or jump directly into any of the 28 hands-on investigation cases.
Practice with real log files
Test your detection logic on PracticeSIEM cases matching this guide: