Filter Query Syntax - Atatus Docs

Atatus Cloud SIEM uses a compact filter language (DSL) to select security events. You use the same syntax when writing the queries in a detection rule and when searching the signals list. This page is the complete reference for that syntax.

Basic structure

A filter is one or more field:value predicates. Multiple predicates are combined with AND by default:

source:okta AND eventAction:user.session.start AND eventOutcome:SUCCESS

Field names must be valid for the data source you are querying. In the rule builder, field auto-complete is scoped to the rule’s first data source, which helps you pick valid names.

Operators

Syntax	Meaning	Example
`key:value`	Exact match on a single value	`eventAction:ConsoleLogin`
`key:(A OR B)`	Match any of several values	`eventAction:(AttachUserPolicy OR AttachRolePolicy)`
`key:[N TO M]`	Range match (inclusive)	`statusCode:[400 TO 499]`
`key:>N` `key:>=N`	Greater than / greater than or equal	`bytesOut:>1000000`
`key:<N` `key:<=N`	Less than / less than or equal	`responseTime:<50`
`key:value`	Wildcard / glob match	`processName:svchost`
`key:*`	Field exists / matches anything	`userName:*`
`"phrase query"`	Match an exact phrase	`message:"permission denied"`
`-key:value`	Negate a predicate	`-eventOutcome:SUCCESS`
`NOT key:value`	Alternative negation syntax	`NOT status:closed`
`(expr)`	Group expressions	`(eventAction:login OR eventAction:logout)`

Logical operators

AND joins predicates that must all match. It is implied between predicates, so you can usually omit it.
OR matches when any predicate matches. Wrap OR groups in parentheses.

source:cloudtrail AND (eventAction:AttachUserPolicy OR eventAction:AttachRolePolicy)

CIDR and IP ranges

You can match IP addresses using CIDR notation or numeric ranges:

sourceIP:10.0.0.0/8 OR sourceIP:[192.168.0.0 TO 192.168.255.255]

Visual builder vs. DSL mode

In the rule builder, the Filter input offers two modes:

Visual builder: Build AND/OR chains row by row, picking a field, an operator, and a value with auto-complete. This covers most common filters.
DSL mode: A text box for the full syntax above. Switch to DSL mode when you need negation, ranges ([N TO M]), CIDR matching, deeply nested groups, or a top-level OR.

Filters written in either mode produce the same query.

Examples

Detect AWS root console logins:

source:cloudtrail AND eventAction:ConsoleLogin AND cloudIdentityType:Root AND eventOutcome:Success

Detect privileged container creation in Kubernetes:

source:kubernetes AND k8sResource:pods AND @requestObject.spec.containers.securityContext.privileged:true

Detect failed SSH authentication:

source:runtime-security-agent AND auditdMessageType:USER_AUTH AND auditdResult:fail

Tips

Balance your delimiters. Parentheses (), brackets [], and quotes " must be balanced, or the filter is rejected.
Do not leave a value empty after a colon, since eventAction: is invalid.
Use known field names. Unknown fields are flagged with a suggestion. Let the auto-complete guide you to canonical field names.
Combine with group-by. Filters select events; the rule’s Group by and Aggregation settings decide how those events are counted. See Creating Custom Detection Rules.

Next steps

Creating Custom Detection Rules: use these filters in a rule.
Investigating Signals: filter the signals list with the same syntax.

​Basic structure

​Operators

​Logical operators

​CIDR and IP ranges

​Visual builder vs. DSL mode

​Examples

​Tips

​Next steps