Query Syntax Reference
PracticeSIEM uses a query language modeled on Splunk and modern SIEM search bars. Filter events by field equality, numeric comparisons, wildcards, and boolean operations.
Search Syntax Patterns
user=root
Exact match for string or identifier.
status!=200
Exclude successful requests to see errors and redirects.
bytes_out>1000000
Numeric filter for large data transfers and file exfiltration.
cmd="*powershell*"
Wildcard matching across command lines and file paths.