3.5.3. Search Past Investigations

3.5.3.1. Global IOC Search

Most analysis and examination techniques are at the incident- or host-level, but the Search item in the Home screen’s left-hand navigation does allow you to search past incidents for IOCs.

The Text / IOC Search tab accepts (up to 128 characters, case insensitive):

• SHA-256 hashes - exact match

• IP addresses - exact match

• File paths - substring match

• Attached device PID/VID/Serial Number - substring match

Results appear in the Search Results tab, and past searches are saved in the Search History tab.