Searching Entity Data

[JaredBloomberg]

Hello,

If I understand correctly you currently cannot use UDM search to look at entity data directly? For example, if I type in metadata.entity_type != "" I get an error saying that that field does not exist. Is there some other way to directly query/search the entity data in Chronicle?

[citreno · Accepted solution]

It's tough, with some licenses you can use BigQuery to search it but the newer license model doesn't automatically include BQ access. There's two main ways I'm aware of - one is using a dashboards you can use the entity data model to build a data visualization. The second is using TestRule but you have to correlate it with some sort of UDM event as well, so your search needs to be $udm and $graph event at the same time, like in this example. Both are a little awkward but workable with enough commitment and sifting. That said it appears support for this type of search may be coming in the roadmap as part of the YL2 revamp, so hoping the Google team will have good news on that front soon. 

[JaredBloomberg]

That is actually very helpful, thank you!

[Mustache]

If your environment has ingested an entity, you can query that entity (such as an IP). On the overview page of the UDM search, you will then get the entity information, for example an IP will show you the IP, it's prevalance, etc. At the bottom-right of that first block of info, you will see "VIEW MORE". This is alluded to in the screenshots via @citreno's example link

If you click that, it will show you more graph information. You can then start to correlate graph data regarding the type of entity you're searching for (domain name, IP, user, etc etc etc) 

I hope this helps!