When searching for events, observe the following general guidelines:

• Many fields require wildcards for partial-match searches. All fields accept wildcards for these searches.

  See Wildcards and Symbols in Searches.

• All fields accept negation (!).

• All fields accept comma-separated lists of search values. Records that contain any of the listed values in the specified field match that search criteria.

• All fields accept comma-separated lists enclosed in quotation marks as search values.

  • For fields that may contain only a single value, records with the specified field containing the exact string specified within the quotation marks match the search criteria. For instance, a search for A, B, "C, D, E" will match records where the specified field contains "A" or "B" or "C, D, E". This permits matching on fields that include the comma in possible values.

  • For fields that may contain multiple values at the same time, records with the specified fields containing all of the values in the quote-enclosed comma-separated list match that search criteria.

  • For fields that may contain multiple values at the same time, search criteria may include single values as well as quote-enclosed comma-separated lists. For instance, a search for A, B, "C, D, E" on a field that may contain one of more of these letters matches records where the specified field contains A or B, or all of C, D, and E.

• Specify n/a in any field to identify events where information is not available for that field; use !n/a to identify the events where that field is populated.

• You can precede many numeric fields with greater than (>), greater than or equal to (>=), less than (<), less than or equal to (<=), equal to (=), or not equal to (<>) operators.

Tip	When searching a field with long complicated values (such as SHA-256 hash values), you can copy the search criteria value from source material and paste it into the appropriate field on the search page.

When searching in all text fields in connection and Security Intelligence events and in most text fields in other event types, searches for partial matches in text fields require an asterisk (*) to represent unspecified characters in a string. Searches without an asterisk are exact-match searches in these fields. Even in fields that do not require wildcards, we recommend always using wildcards for partial-match searches.

For example, to find example.com, www.example.com, or department.example.com, search for *.example.com. Searching for example.com in most cases returns only example.com.

If you want to search for non-alphanumeric characters (including the asterisk character), enclose the search string in quotation marks. For example, to search for the string:

Find an asterisk (*)

enter:

"Find an asterisk (*)"

The system allows you to create named objects, object groups, and application filters that can be used as part of your network configuration. You can use these objects, groups, and filters as search criteria when performing or saving searches.

When you perform a search, objects, object groups, and application filters appear in the format, ${object_name}. For example, a network object with the object name ten_ten_network appears as ${ten_ten_network} in a search.

You can click Object () that appears next to a search field where you can use an object as a search criterion.

The formats accepted by search criteria fields that take a time value are shown in the following table.

You can precede a time value with one of the following operators:

When specifying IP addresses in searches, you can enter an individual IP address, a comma-separated list of addresses, an address block, or a range of IP addresses separated with a hyphen (-). You can also use negation.

For searches that support IPv6 (such as intrusion event, connection data, and correlation event searches) you can enter IPv4 and IPv6 addresses and CIDR/prefix length address blocks in any combination. When you search for hosts by IP address, the results include all hosts for which at least one IP address matches your search conditions, that is, a search for an IPv6 address may return hosts whose primary address in IPv4.

When you use CIDR or prefix length notation to specify a block of IP addresses, the system uses only the portion of the network IP address specified by the mask or prefix length. For example, if you type 10.1.2.3/8, the system uses 10.0.0.0/8.

Because IP addresses can be represented by network objects, you can also click the add network Object () that appears next to an IP address search field to use a network object as an IP address search criterion.

If you group devices—whether just on the FMC, or as actual high availability or scalability configurations—searching for the name for the group correctly returns results for all devices in the group.

If the system finds a match for a group, it replaces the group name with the appropriate member device names for the purpose of performing the search. When you save a search that uses a device group in the device field the system saves the name specified in the device field and performs the device name replacement again each time the search is executed.

The system accepts specific syntax for port numbers in searches. You can enter:

• a single port number

• a comma-separated list of port numbers

• two port numbers separated by a dash to represent a range of port numbers

• a port number followed by a protocol abbreviation, separated by a forward slash (only when searching for intrusion events)

• a port number or range of port numbers preceded by an exclamation mark to indicate a negation of the specified ports

Note	Do not use spaces when specifying port numbers or ranges.

• Audit Log Workflow Fields

• Application Data Fields

• Application Detail Data Fields

• Captured File Fields

• Allow List Event Fields

• Connection and Security Intelligence Event Fields

• Correlation Event Fields

• Discovery Event Fields

• The Health Events Table

• Host Attribute Data Fields

• Host Data Fields

• File and Malware Event Fields

• Intrusion Event Fields

• Intrusion Rule Update Log Details

• Remediation Status Table Fields

• See Nmap Scan Results Fields in the Firepower Management Center Device Configuration Guide

• Server Data Fields

• Third-Party Vulnerability Data Fields

• User-Related Fields

• Vulnerability Data Fields

• Allow List Violation Fields