Case Manager — Advanced Search

AirMDR Advanced Case Search allows users to perform structured queries in Case Manager using field-based filters and logical operators to quickly locate relevant cases.

Overview

The Advanced Search feature in AirMDR Case Manager enables analysts and administrators to run structured queries to locate cases more precisely. Instead of relying on simple keyword searches, users can construct queries that filter cases by specific case attributes, logical conditions, and exact phrases.

Advanced search helps users:

• Locate cases based on specific fields (such as case name, status, disposition, or reporter).
• Combine multiple criteria using logical operators.
• Exclude unwanted results.
• Perform exact phrase searches across case investigation content.

Advanced search is triggered using the /advanced prefix in the Case Manager search bar.

When to Use Advanced Search

Use Advanced Search when:

• You need precise filtering using case fields
• You want to combine conditions using AND / OR / NOT
• You need to exclude specific results
• You are performing structured investigation queries

Accessing Advanced Search

UI Navigation

AirMDR UI → Case Manager → Case Search Bar

To use advanced search:

1. Navigate to Case Manager.
2. Locate the search bar.
3. Begin your query using the prefix:
   /advanced
   
4. Enter the query conditions.
5. Press Enter to execute the search.

Query Syntax

Advanced queries allow filtering using logical operators and field-based searches.

Logical Operators Supported

Operator	Syntax	Purpose
AND	&&	Returns results that satisfy both conditions.
OR	||	Returns results that match either one of the specified conditions in the query.
NOT	!	Excludes cases that match the specific condition from the search results.

Example:

/advanced name: Impossible Travel && disposition: Malicious

This query returns cases where:

• Case name = Impossible Travel
• Disposition = Malicious

Exact Phrase Search

In Normal Search (Recommended)

You can use double quotes (" ") to search for exact phrases.

Input	Behavior
lateral movement	Matches words anywhere
"lateral movement"	Matches exact phrase only

In Advanced Search

Quotes do not work in /advanced mode. Use:

/advanced exact: "lateral movement"

Limitations of Advanced Search

• Quotes (" ") are not supported
• Use exact: for phrase matching
• Comments are not searched
• Parentheses are not supported
• Operator precedence applies:
  • ! → && → ||

Search by Specific Fields

You can narrow searches to specific sections of a case.

Field	Description
name	Case title
summary	Investigation summary
assignee	Assigned user
alert	Alert details
findings	Findings section
linked_alerts	Linked alerts
iocs	Indicators (IP/domain/user)
custom_fields	Custom fields
all	Entire case

Important Behavior:

• If no field is selected → searches entire case (including comments)
• If any field is selected → comments are excluded

Query Precedence Rules

• && (AND) has higher precedence than || (OR).
• Parentheses are currently not supported in advanced queries.

Example interpretation:

query1 && query2 || query3

is evaluated as:

(query1 && query2) || query3

Basic Search Examples

Search by IP Address

/advanced all: 3.22.33.44

Finds cases containing the IP address 3.22.33.44.

This produces the same result as a simple search.

Search by Case Name

/advanced name: Impossible Travel

Returns all cases where the case title contains Impossible Travel.

Combine Conditions (OR)

/advanced name: Impossible Travel || name: Login From Rare Country

Returns cases matching either case type.Combine Conditions (AND)

Combine Conditions (AND)

/advanced name: Impossible Travel && disposition: Malicious

Returns malicious Impossible Travel cases.Exclude Results

Exclude Results

/advanced name: Impossible Travel && !status: Closed

Returns Impossible Travel cases that are not closed.Multiple Exclusion Conditions

Multiple Exclusion Conditions

/advanced name: Impossible Travel && !status: Closed && !all: Manchester

Returns cases that:

• Are Impossible Travel
• Are not closed
• Do not contain Manchester

Filter by Assignee Context

/advanced name: Impossible Travel && all: [e-mail] && !case_id: ASO-4231

Use case:

When an analyst is investigating ASO-4231, they can search for similar cases involving the same user but exclude the current case.Exact Phrase Search

Exact Phrase Search

Exact search allows matching precise phrases rather than individual keywords.

Syntax

exact: "phrase"

Exclude exact phrase:

!exact: "phrase"

Examples

Search cases containing exact phrase:

/advanced exact: "data breach"

Exclude phrase:

/advanced !exact: "false positive"

Combined example:

/advanced exact: "P1" && !exact: "drill"

This returns cases that:

• contain P1
• do not contain drill

Query Structure

Advanced queries follow a structured syntax that allows users to filter cases using specific fields and logical conditions.

Query Format

/advanced field_name: value [operator] field_name: value

Components

Component	Description	Example
/advanced	Prefix required to trigger advanced search mode	/advanced
field_name	The case field used for filtering	status
:	Separates field and value	status: Open
value	Value to match in the field	Malicious
operator	Logical operator used to combine conditions	&&

Example Query Structure

/advanced name: Impossible Travel && status: Open

This query returns cases where:

• Case name = Impossible Travel
• Status = Open

Query With Multiple Conditions

/advanced severity: High && status: Open && disposition: Malicious

Returns cases that meet all three conditions.

Query With OR Condition

/advanced name: Impossible Travel || name: Login From Rare Country

Returns cases matching either condition.

Query With Exclusion

/advanced name: Impossible Travel && !status: Closed

Returns Impossible Travel cases that are not closed.

Case Fields Supported in Advanced Queries

The following table lists supported case fields that can be referenced in advanced queries.

Core Case Fields

Case Field	Query Field	Example
Case ID	case_id	case_id: ASO-1234
Archived	archived	archived: true
Assignee	assignee	assignee: John Doe
Reporter	reporter	reporter: Jane Smith
Created At	created_at	created_at: 2025-01-01
Modified At	modified_at	modified_at: 2025-01-15
Case Name	name	name: Impossible Travel
Disposition	disposition	disposition: Malicious
Escalated to Customer	escalated_to_customer	escalated_to_customer: true
Organization Code	organization_code	organization_code: ACME
Priority	priority	priority: High
Severity	severity	severity: Critical
Status	status	status: Open
Category	category	category: Authentication
Sub Category	sub_category	sub_category: Impossible Travel
Marked for Review	marked_for_review	marked_for_review: true
Reviewed	reviewed	reviewed: true
Case Reinvestigated	case_reinvestigated	case_reinvestigated: true
Confidence	confidence	confidence: High

Case Score Fields

Field	Query Field
Case Score	case_score.score
Case Score Summary	case_score.summary
Case Score Completed At	case_score.completed_at

Case Detail Fields (Advanced Query Support)

These fields search inside case investigation details.

Case Detail Field	Query Field
Actions Title	case_detail_fields.actions.title
Alert	case_detail_fields.alert
Summary	case_detail_fields.summary
Findings Title	case_detail_fields.findings.title
Findings Summary	case_detail_fields.findings.summary
Investigation Summary	case_detail_fields.investigation_summary
Provider	case_detail_fields.provider
Linked Alerts	case_detail_fields.linked_alerts
Custom Field Values	case_detail_fields.custom_field_value_map
Conclusion	case_detail_fields.conclusion
Activity Timeline	case_detail_fields.activity_timeline
FAQs	case_detail_fields.faqs
Custom Questions	case_detail_fields.custom_questions
Explore Deeper Questions	case_detail_fields.explore_deeper_questions

Search Result Ordering

• Results are sorted by creation time (newest first)
• Not sorted by relevance

Match Weight (for finding results)

Field	Priority
Case ID	Highest
Case Name	High
Summary / Findings	Medium
Others	Lower

Single vs Multi-word Search Behavior

Input	Behavior
malware	Exact word match
lateral movement	At least 1 word matches
3-word query	At least 2 words match

Multi-word queries follow ~75% match logic.

Entity / IOC Filtering

You can filter cases using entities such as IPs, domains, or usernames.

Steps

1. Open filter panel
2. Add entity value
3. Select type (optional)
4. Choose:
   • AND → all must match
   • OR → any can match

Examples

• IP search → 192.168.1.100
• User search → [e-mail]
• Domain search → evil.com

Case ID Partial Search

• Supports substring search
• Minimum 3 characters required

Input	Result
1234	Matches SEC-1234
SEC	Matches all SEC cases

Common SOC Search Queries

Security analysts often search cases using specific operational patterns. The examples below demonstrate common investigation scenarios.

Find Open High-Severity Cases

/advanced severity: High && status: Open

Use this query to quickly identify active high-priority investigations.

Find Cases Assigned to a Specific Analyst

/advanced assignee: John Doe && status: Open

Returns open cases assigned to a specific analyst.

Find Malicious Cases

/advanced disposition: Malicious

Used to locate confirmed malicious incidents.

Find Cases Related to a Specific Detection Type

/advanced name: Impossible Travel

Returns cases where the case title contains Impossible Travel.

Find Open Cases Excluding Closed Investigations

/advanced !status: Closed

Useful for viewing all active cases.

Find Cases Containing a Specific User or Indicator

/advanced all: [e-mail]

Returns cases where the email appears anywhere in the case content

Best Practices

Use Field Filters

Instead of searching raw keywords:

Impossible Travel

Use:

/advanced name: Impossible Travel

This ensures the search only applies to case titles.

Use Exclusions to Reduce Noise

Example:

!status: Closed

This ensures analysts see only active investigations.

Combine Multiple Conditions

Example:

/advanced severity: High && status: Open && disposition: Malicious

This helps SOC teams quickly identify high-risk active cases.

Limitations

• Parentheses are not supported in queries
• && has higher precedence than ||
• Queries must start with /advanced

Troubleshooting

No Results Returned

Check the following:

• Ensure /advanced prefix is included.
• Verify the field name spelling.
• Confirm field values exist in the dataset.

Unexpected Results

Possible reasons:

• Incorrect logical operator precedence
• Typo in field name
• Field not supported in advanced queries.