Introduction
This article explains how to use Lucene techniques on the Incidents page.
Lucene Techniques in Incident Management
All Lucene techniques can be used in the search bar of the Incidents page, just like on the Search page. A detailed example is given below.
The example query lists incidents that meet all of the following conditions: the incident owner is the user "mahmut", the incident status is Closed, the occurrence count is not 1, the risk score is not between 0 and 30, the close reason is not "Other" or "False Positive", at least one action or investigation card exists for the incident, the incident category is "Malware", the incident information contains the phrase "Threat Intelligence", and the incident occurred between April 1 and April 14, 2023.
Query:
Incident.OwnerName:mahmut Incident.Status:Closed !Incident.Count:1 !Close.Reason:(Other OR "False Positive") !Risk.Score:[0 TO 30] _exists_:Cards Incident.Category:Malware Incident.Info:*"Threat Intelligence"* Time.Generated:["2023-04-01 00:00:00" TO "2023-04-14 23:59:59"]
Incident.OwnerName: Username of the incident owner. The Incident.Owner field holds the owner's user ID, not the username.
Incident.Status: Incident status (Open or Closed)
Incident.Count: Incident occurrence count
Close.Reason: Reason for closing the incident
Risk.Score: Risk score given for the incident
_exists_:Cards: At least one action or investigation card has been created for the incident
Incident.Category: Incident category, taken from the alert that created the incident
Incident.Info: General incident information
Time.Generated:[X TO Y]: Time interval in which the incident occurred