Atatus Cloud SIEM uses a compact filter language (DSL) to select security events. You use the same syntax when writing the queries in a detection rule and when searching the signals list.
This page is the complete reference for that syntax.
Basic structure
A filter is one or more field:value predicates. Multiple predicates are combined with AND by default:
source:okta AND eventAction:user.session.start AND eventOutcome:SUCCESS
Field names must be valid for the data source you are querying. In the rule builder, field auto-complete is scoped to the rule's first data source, which helps you pick valid names.
Operators
| Syntax | Meaning | Example |
|---|---|---|
key:value |
Exact match on a single value | eventAction:ConsoleLogin |
key:(A OR B) |
Match any of several values | eventAction:(AttachUserPolicy OR AttachRolePolicy) |
key:[N TO M] |
Range match (inclusive) | statusCode:[400 TO 499] |
key:>N key:>=N |
Greater than / greater than or equal | bytesOut:>1000000 |
key:<N key:<=N |
Less than / less than or equal | responseTime:<50 |
key:*value* |
Wildcard / glob match | processName:*svchost* |
key:* |
Field exists / matches anything | userName:* |
"phrase query" |
Match an exact phrase | message:"permission denied" |
-key:value |
Negate a predicate | -eventOutcome:SUCCESS |
NOT key:value |
Alternative negation syntax | NOT status:closed |
(expr) |
Group expressions | (eventAction:login OR eventAction:logout) |
Logical operators
- AND joins predicates that must all match. It is implied between predicates, so you can usually omit it.
- OR matches when any predicate matches. Wrap OR groups in parentheses.
source:cloudtrail AND (eventAction:AttachUserPolicy OR eventAction:AttachRolePolicy)
CIDR and IP ranges
You can match IP addresses using CIDR notation or numeric ranges:
sourceIP:10.0.0.0/8 OR sourceIP:[192.168.0.0 TO 192.168.255.255]
Visual builder vs. DSL mode
In the rule builder, the Filter input offers two modes:
- Visual builder — Build AND/OR chains row by row, picking a field, an operator, and a value with auto-complete. This covers most common filters.
- DSL mode — A text box for the full syntax above. Switch to DSL mode when you need negation, ranges (
[N TO M]), CIDR matching, deeply nested groups, or a top-level OR.
Filters written in either mode produce the same query.
Examples
Detect AWS root console logins:
source:cloudtrail AND eventAction:ConsoleLogin AND cloudIdentityType:Root AND eventOutcome:Success
Detect privileged container creation in Kubernetes:
source:kubernetes AND k8sResource:pods AND @requestObject.spec.containers.securityContext.privileged:true
Detect failed SSH authentication:
source:runtime-security-agent AND auditdMessageType:USER_AUTH AND auditdResult:fail
Tips
- Balance your delimiters. Parentheses
(), brackets[], and quotes"must be balanced, or the filter is rejected. - Do not leave a value empty after a colon —
eventAction:is invalid. - Use known field names. Unknown fields are flagged with a suggestion. Let the auto-complete guide you to canonical field names.
- Combine with group-by. Filters select events; the rule's Group by and Aggregation settings decide how those events are counted. See Creating Custom Detection Rules.
Next steps
- Creating Custom Detection Rules — use these filters in a rule.
- Investigating Signals — filter the signals list with the same syntax.
+1-415-800-4104