Search

Search is the central log analysis feature of CSIRT-Pro. It uses PRQL (Pipelined Relational Query Language) to query, aggregate, and visualize ingested log data.

---

Screen Layout

The Search screen is built from five elements.

1. Query Editor for writing PRQL queries.
2. Time Range Selector for setting the search time window.
3. Visualization Area that renders query results as charts.
4. Data Table that shows query results in tabular form.
5. Field List for browsing the fields available in the selected pipeline.

---

PRQL Query Language

PRQL is a pipelined, human-readable query language. Each line transforms the data flowing through the pipeline.

Basic Syntax

from `pipeline_name`
filter <condition>
select {<fields>}
sort {<sort-expression>}
take <limit>

Pipeline Name

The pipeline name must be enclosed in backticks (`). Use the exact name you assigned when creating the pipeline.

---

Query Examples

Retrieve All Records

from `firewall_logs`

Filter by Field Value

from `firewall_logs`
filter action == "DENY"
filter src_ip == "192.168.1.100"

Time Range Filter

from `firewall_logs`
filter __time > @2025-01-01
filter __time < @2025-01-31

Time Range Selector

In most cases, use the UI time range selector instead of hardcoding dates in the query. The selector supports presets: Last 15 min, 30 min, 1 hour, 24 hours, 7 days, and Custom range.

Partial Match (Regex)

from `auth_logs`
filter message ~= "failed"

Field Selection

from `firewall_logs`
select {__time, src_ip, dst_ip, action, bytes}

Sorting

from `firewall_logs`
sort {-__time}
take 100

The - prefix sorts in descending order. Without it, the sort is ascending.

Count Aggregation

from `firewall_logs`
filter action == "DENY"
group {src_ip} (
  aggregate {count = count this}
)
sort {-count}
take 10

Sum Aggregation

from `firewall_logs`
group {src_ip} (
  aggregate {total_bytes = sum bytes}
)
sort {-total_bytes}

Average Aggregation

from `web_access`
group {path} (
  aggregate {avg_time = avg response_time}
)
sort {-avg_time}
take 20

Minimum and Maximum Aggregation

from `web_access`
group {path} (
  aggregate {
    min_time = min response_time,
    max_time = max response_time
  }
)

Multiple Aggregations

from `firewall_logs`
group {src_ip} (
  aggregate {
    total = count this,
    total_bytes = sum bytes,
    avg_bytes = avg bytes
  }
)
sort {-total}
take 10

Derived Fields

from `web_access`
derive {is_error = status >= 400}
filter is_error == true

Rename Fields

from `firewall_logs`
select {
  time = __time,
  source = src_ip,
  destination = dst_ip,
  result = action
}

---

Filter Operators

Operator	Description	Example
==	Equal	filter status == 200
!=	Not equal	filter status != 404
>	Greater than	filter bytes > 1000
<	Less than	filter bytes < 5000
>=	Greater than or equal	filter status >= 400
<=	Less than or equal	filter status <= 499
~=	Regex partial match	filter message ~= "error"

---

Aggregation Functions

Function	Description	Example
count this	Count of records	aggregate {n = count this}
sum	Sum	aggregate {total = sum bytes}
avg	Average	aggregate {avg_val = avg response_time}
min	Minimum value	aggregate {min_val = min value}
max	Maximum value	aggregate {max_val = max value}

---

Time Range Presets

Preset	Period
Last 15 minutes	Most recent 15 minutes
Last 30 minutes	Most recent 30 minutes
Last 1 hour	Most recent hour
Last 24 hours	Most recent 24 hours
Last 7 days	Most recent 7 days
Custom	User-defined date/time range

---

Visualization Types

Query results can be displayed using the following chart types.

Chart Type	Use Case
Timeline	Time-series histogram with automatic bucketing
Bar	Category comparison by count
Line	Time-series trend display
Pie	Proportional breakdown
Doughnut	Proportional display with summary center
Polar Area	Radial comparison
Radar	Multi-axis comparison
Markdown	Embedded text annotation

Switching Chart Types

Right-click the chart area to open the context menu and change the chart type.

---

Interactive Filtering

Filter by Cell Value

Click a cell value in the data table to add it as a filter.

1. Click a table cell.
2. Select Add to filter from the context menu.
3. A filter clause is automatically appended to the query.

Top 5 Values

Right-click a field name in the field list to view its top 5 values.

---

Saving and Reusing Visualizations

Save

1. Execute a query and review the results.
2. Click the Save button.
3. Enter a title and save.

Load

1. Select a saved visualization from the dropdown.
2. The query and chart settings are restored.

JSON Export and Import

Visualization configurations can be exported as JSON files and imported into other environments.

---

Data Transfer Format

The Search API returns results in a columnar binary format for efficient data transfer. The web UI deserializes this data automatically for display.

For direct API usage, see the API Reference.

---

Keyboard Shortcuts

Shortcut	Action
Ctrl + Enter	Execute query

---

Practical Examples

Top Denied Source IPs in the Last 24 Hours

from `firewall_logs`
filter action == "DENY"
group {src_ip} (
  aggregate {count = count this}
)
sort {-count}
take 10

Failed Authentication Attempts

from `auth_logs`
filter message ~= "failed"
sort {-__time}
take 100

HTTP 5xx Errors by Path

from `web_access`
filter status >= 500
group {path} (
  aggregate {errors = count this}
)
sort {-errors}
take 20

Data Transfer Volume by Source

from `proxy_logs`
group {src_ip} (
  aggregate {
    total_bytes = sum bytes,
    request_count = count this
  }
)
sort {-total_bytes}
take 10