Searching

The Brinqa platform includes several ways to search through data or limit what data is being reviewed in a given context, like on a report.

• List Search: Find data on a list view with a text indexing and search engine. Using text search you can search all attributes, a specific attribute, or a combination of attributes.
• Faceted Search: Faceting is the arrangement of data into categories (which are based on indexed attributes). Within each category, Brinqa reports on the number of hits or occurances of unique values. Faceting makes it easy for users to explore data sets on list views, where there are many attributes and many values for each attribute.
• Filters: Filter data in various views, reports, and dashboards by using conditions.

List Search¶

List searches can be performed on list views, the pages that display a table of all instances of the associated data model (e.g. all hosts). List search is built on a text indexing and search engine, and can be performed by entering queries into the search bar at the top of the list view. List searches can be combined with faceted searches on list views.

Searches run from the search bar will only return results from attributes that have the "index text" setting set. See the attribute article for more information about attribute settings.

Search terms¶

A search query is broken up into terms and operators. There are two types of terms: single terms and phrases.

• A single term is a single word such as "test" or "hello"
• A phrase is a group of words surrounded by double quotes such as "UI redress attack"

Phrase searches will ignore stop words (common words that are excluded from searches) and punctuation.

Term Modifiers¶

Brinqa search supports a variety of term modifiers that add flexibility to searches. These modifiers include wildcard characters, characters for making a search "fuzzy" or more general, and so on. The sections below describe these modifiers in detail.

Wildcard searches¶

Wildcards use a symbol to stand in for zero or more characters in a term when its exact spelling or variation is not known. Wildcard characters can be applied to single terms, but not to search phrases.

To perform a single character wildcard search, use the question mark (?) symbol. This wildcard finds terms that contain any one character to replace the question mark. For example, to find "text" or "test", search for:

te?t

To perform a multiple character wildcard search, use the asterisk (*) symbol. This wildcard finds terms that contain zero or more characters to replace the asterisk. For example, to find "planned" or "placed", search for:

pl*d

Fuzzy searches¶

Fuzzy searches allow users to get results that are close to the specified query, but not an exact match. They are particularly useful when search terms may have multiple spellings, the spelling is unclear, or the value may be abbreviated (e.g. pkwy vs. parkway). Fuzzy searches are different from wildcard searches in that you don't need to know the exact character(s) that might be changed.

Fuzzy searches can be performed by adding a tilde (~) to the end of a single term along with a number. The number specifies how many characters in the word can be different, either absent or with a different value.

For example, sym~2 would return results with sym, symbl (two characters added), sam (one character change), lam (two character change), among others.

Proximity searches¶

Proximity searches allow users to search a phrase, but specify that the words in the phrase may or may not be directly next to each other. The phrase is within the standard double quotation marks (""), but a tilde (~) and number are added to the end of the phrase. The number determines how many words apart the terms in the phrase can be.

For example, the query "fake certificate"~3 might return results containing "fake self-signed certificate", since "fake" and "certificate" are still within three words of each other.

Attribute searches¶

Data indexed in the Brinqa search engine is organized in fields, which are defined based on data model attributes. If you do not specify an attribute in a query, Brinqa searches across all searchable attributes (i.e. attributes where the index search option is enabled). Using attribute searches, you can add precision to your search by searching for a term only in a specific attribute.

To specify an attribute, type the attribute name (not title) followed by a colon (:) and then the term you are searching for within the attribute. For example, if you want to find a vulnerability titled "Apache HTTP" which contains the consequence "denial of service" you could include either of the following terms in your search query on the vulnerability list view:

• title: "Apache HTTP" AND consequence: denial
• title: "Apache HTTP" AND consequence: "denial of service"

The attribute is only valid for the term that it directly precedes, so the query

consequence: denial of service

finds only "denial" in the consequence attribute. It will find "of" and "service" in all attributes.

Attribute searches on related data models¶

To search by attributes on related data models (e.g. host OS when searching vulnerabilities), include the related attribute's data model as a prefix (e.g. host.os).

For example, to find all hosts with vulnerabilities containing "Dirty Cow" in the title and with the DNS "prod" or "uat", you could search the host list view with the following query:

vulnerabilities.title: "Dirty Cow" AND (dns: prod OR dns: uat)

In that query, the title attribute is modified with the data model that attribute is on (vulnerabilities). You could perform a search for the same results on the vulnerability list view with the following query:

title: "Dirty Cow" AND (host.dns: prod OR host.dns: uat)

Note that now the title attribute does not require modification because the search is being performed on that data model's list view. The DNS attribute now requires modification to indicate the host data model, instead.

Time Values¶

Date and time attributes can be searched both with absolute and relative values. The table below covers the options for relative time value searches.

Table 1. Time values

Operators¶

Brinqa search allows standard Boolean operators, as well as relational operators, ranges, and boosted searches. The OR operator is the default conjunction operator, so if there is no Boolean operator between two terms, the OR operator is used. The OR operator links two terms and finds a matching data set if either of the terms exist, like a union using sets.

The table below covers operator options and what they do.

Table 2. Operators

Grouping search terms¶

Brinqa search supports using parentheses to group clauses to form sub-queries. This can be very useful if you want to control the Boolean logic for a query. The query below searches for all hosts with vulnerabilities containing "NetBIOS" in the title and whose risk rating is "high" or "critical":

vulnerabilities.title: "NetBIOS" AND (risk_rating: high OR risk_rating: critical)

Faceted Search¶

Attributes with the Supports Facets setting can be used to filter data presented on list views.

To use faceted search, navigate to the list view of a data model and click the filter icon button above the search bar. This will open a side panel with available facets.

Each facet displays the number of datasets with that attribute value next to it. Different attribute facets can be selected simultaneously, e.g. severity and operating system. However, selecting multiple facets within the same attribute is not supported at this time.

Adding new facets¶

To make an attribute available in the facet panel, it must be marked Supports Facets.

1. Navigate to Administration > Data Management > Data Models
2. Open the data model with the attribute you need to modify. Some data models will only be modifiable from the Platform application.
3. Open the attribute that should be made facetable
4. Check the Supports Facets box near the bottom of the attribute modal
5. Click Update on the attribute modal
6. Click Update on the data model form

Filters¶

Filters, while not strictly a search, allow you to limit the data that appears in views and visualizations. They use the same condition UI that appears throughout the system. To apply a filter:

1. Navigate to the view or report whose data you want to filter
2. Click the Edit button associated with the section you want to filter
3. Select Filters
4. Add filters using the filter clause interface:

Table 3. Filter clause interface

Adding new filters¶

If you don’t see an attribute as a filtering option, it isn’t set to allow filters in the data model. This can be changed by modifying the attribute’s metadata.

1. Navigate to the application the attribute’s data model is associated with
2. Navigate to Administration > Data Management > Data Models
3. Select the data model associated with the attribute
4. Find the desired attribute on the data model and click the Actions button
5. Select Edit
6. At the bottom of the modal window, check Supports Filter
7. Click Update on the attribute modal
8. Click Update on the data model form