Case Manager — Advanced Search

Overview

The Advanced Search feature in AirMDR Case Manager enables analysts and administrators to run structured queries to locate cases more precisely. Instead of relying on simple keyword searches, users can construct queries that filter cases by specific case attributes, logical conditions, and exact phrases.

AirMDR Case Manager Advanced search helps users to:

Locate cases based on specific fields (such as case name, status, disposition, or reporter).
Combine multiple criteria using logical operators.
Exclude unwanted results.
Perform exact phrase searches across case investigation content.

Advanced search is triggered using the /advanced prefix in the Case Manager search bar.

When to Use Advanced Search?

Use Advanced Search when:

You need precise filtering using case fields
You want to combine conditions using AND / OR / NOT
You need to exclude specific results
You are performing structured investigation queries

Accessing Advanced Search

AirMDR UI → Case Manager → Case Search Bar To use advanced search:

Navigate to Case Manager.
Locate the search bar.
Begin your query using the prefix:
/advanced
Enter the query conditions.
Press Enter to execute the search.

Searchable Fields in Advanced Search

Case Fields Supported in Advanced Queries

The following table lists supported case fields that can be referenced in advanced queries.

Core Case Fields

Case Field	Query Field	Example
Case ID	`case_id`	`case_id: ASO-1234`
Archived	`archived`	`archived: true`
Assignee	`assignee`	`assignee: John Doe`
Reporter	`reporter`	`reporter: Jane Smith`
Created At	`created_at`	`created_at: 2025-01-01`
Modified At	`modified_at`	`modified_at: 2025-01-15`
Case Name	`name`	`name: Impossible Travel`
Disposition	`disposition`	`disposition: Malicious`
Escalated to Customer	`escalated_to_customer`	`escalated_to_customer: true`
Organization Code	`organization_code`	`organization_code: ACME`
Priority	`priority`	`priority: High`
Severity	`severity`	`severity: Critical`
Status	`status`	`status: Open`
Category	`category`	`category: Authentication`
Sub Category	`sub_category`	`sub_category: Impossible Travel`
Marked for Review	`marked_for_review`	`marked_for_review: true`
Reviewed	`reviewed`	`reviewed: true`
Case Reinvestigated	`case_reinvestigated`	`case_reinvestigated: true`
Confidence	`confidence`	`confidence: High`

Case Score Fields

Field	Query Field
Case Score	case_score.score
Case Score Summary	case_score.summary
Case Score Completed At	case_score.completed_at

Case Detail Fields (Advanced Query Support)

These fields search inside case investigation details.

Case Detail Field	Query Field
Actions Title	case_detail_fields.actions.title
Alert	case_detail_fields.alert
Summary	case_detail_fields.summary
Findings Title	case_detail_fields.findings.title
Findings Summary	case_detail_fields.findings.summary
Investigation Summary	case_detail_fields.investigation_summary
Provider	case_detail_fields.provider
Linked Alerts	case_detail_fields.linked_alerts
Custom Field Values	case_detail_fields.custom_field_value_map
Conclusion	case_detail_fields.conclusion
Activity Timeline	case_detail_fields.activity_timeline
FAQs	case_detail_fields.faqs
Custom Questions	case_detail_fields.custom_questions
Explore Deeper Questions	case_detail_fields.explore_deeper_questions

Query Structure

Advanced queries follow a structured syntax that allows users to filter cases using specific fields and logical conditions.

Query Format

/advanced field_name: value [operator] field_name: value

Components

Component	Description	Example
`/advanced`	Prefix required to trigger advanced search mode	`/advanced`
`field_name`	The case field used for filtering	`status`
`:`	Separates field and value	`status: Open`
`value`	Value to match in the field	`Malicious`
`operator`	Logical operator used to combine conditions	`&&`

Example Query Structure

/advanced name: Impossible Travel && status: Open

This query returns cases where:

Case name = Impossible Travel
Status = Open

Query With Multiple Conditions

/advanced severity: High && status: Open && disposition: Malicious

Returns cases that meet all three conditions.

Query With OR Condition

/advanced name: Impossible Travel || name: Login From Rare Country

Returns cases matching either condition.

Query With Exclusion

/advanced name: Impossible Travel && !status: Closed

Returns Impossible Travel cases that are not closed.

Query Syntax

Advanced queries allow filtering using logical operators and field-based searches.

Logical Operators Supported

Operator	Syntax	Purpose
AND	`&&`	Returns results that satisfy both conditions.
OR	\|\|	Returns results that match either one of the specified conditions in the query.
NOT	`!`	Excludes cases that match the specific condition from the search results.

Example:

/advanced name: Impossible Travel && disposition: Malicious

This query returns cases where:

Case name = Impossible Travel
Disposition = Malicious

Exact Phrase Search - In Normal Search & In Advanced Search

In Normal Search (Recommended)

You can use double quotes (" ") to search for exact phrases.

Input	Behavior
`lateral movement`	Matches words anywhere
`"lateral movement"`	Matches exact phrase only

In Advanced Search

Quotes do not work in /advanced mode. Use:

/advanced exact: "lateral movement"

Limitations of Advanced Search

Quotes (" ") are not supported
Use exact: for phrase matching
Comments are not searched
Parentheses are not supported
Operator precedence applies:
- ! → && → ||

Search by Specific Fields

You can narrow searches to specific sections of a case.

Field	Description
name	Case title
summary	Investigation summary
assignee	Assigned user
alert	Alert details
findings	Findings section
linked_alerts	Linked alerts
iocs	Indicators (IP/domain/user)
custom_fields	Custom fields
all	Entire case
case_id	Enter specific case ID

Important Behavior:

If no field is selected → searches entire case (including comments)
If any field is selected → comments are excluded

Query Precedence Rules

&& (AND) has higher precedence than || (OR).
Parentheses are currently not supported in advanced queries.

Example interpretation:

query1 && query2 || query3

is evaluated as:

(query1 && query2) || query3

Basic Search Examples

Search by IP Address

/advanced all: 3.22.33.44

Finds cases containing the IP address 3.22.33.44.This produces the same result as a simple search.

Search by Case Name

/advanced name: Impossible Travel

Returns all cases where the case title contains Impossible Travel.

Combine Conditions (OR)

/advanced name: Impossible Travel || name: Login From Rare Country

Returns cases matching either case type.Combine Conditions (AND)

Combine Conditions (AND)

/advanced name: Impossible Travel && disposition: Malicious

Returns malicious Impossible Travel cases.Exclude Results

Exclude Results

/advanced name: Impossible Travel && !status: Closed

Returns Impossible Travel cases that are not closed.Multiple Exclusion Conditions

Multiple Exclusion Conditions

/advanced name: Impossible Travel && !status: Closed && !all: Manchester

Returns cases that:

Are Impossible Travel
Are not closed
Do not contain Manchester

Filter by Assignee Context

/advanced name: Impossible Travel && all: naman@airmdr.com && !case_id: ASO-4231

Use case:When an analyst is investigating ASO-4231, they can search for similar cases involving the same user but exclude the current case.Exact Phrase Search

Exact Phrase Search

Exact search allows matching precise phrases rather than individual keywords.

Syntax

exact: "phrase"

Exclude exact phrase:

!exact: "phrase"

Examples

Search cases containing exact phrase:

/advanced exact: "data breach"

Exclude phrase:

/advanced !exact: "false positive"

Combined example:

/advanced exact: "P1" && !exact: "drill"

This returns cases that:

contain P1
do not contain drill

Search Result Ordering

Results are sorted by creation time (newest first)
Not sorted by relevance

Match Weight (for finding results)

Field	Priority
Case ID	Highest
Case Name	High
Summary / Findings	Medium
Others	Lower

Single vs Multi-word Search Behavior

Input	Behavior
`malware`	Exact word match
`lateral movement`	At least 1 word matches
`3-word query`	At least 2 words match

Multi-word queries follow ~75% match logic.

Entity / IOC Filtering

You can filter cases using entities such as IPs, domains, or usernames.

Steps

Open filter panel
Add entity value
Select type (optional)
Choose:
- AND → all must match
- OR → any can match

Examples

IP search → 192.168.1.100
User search → user@company.com
Domain search → evil.com

Case ID Partial Search

Supports substring search
Minimum 3 characters required

Input	Result
`1234`	Matches SEC-1234
`SEC`	Matches all SEC cases

Common SOC Search Queries

Security analysts often search cases using specific operational patterns. The examples below demonstrate common investigation scenarios.

Find Open High-Severity Cases

/advanced severity: High && status: Open

Use this query to quickly identify active high-priority investigations.

Find Cases Assigned to a Specific Analyst

/advanced assignee: John Doe && status: Open

Returns open cases assigned to a specific analyst.

Find Malicious Cases

/advanced disposition: Malicious

Used to locate confirmed malicious incidents.

Find Open Cases Excluding Closed Investigations

/advanced !status: Closed

Useful for viewing all active cases.

Find Cases Containing a Specific User or Indicator

/advanced all: user@company.com

Returns cases where the email appears anywhere in the case content

Best Practices

Use Field Filters

Instead of searching raw keywords:

Impossible Travel

Use:

/advanced name: Impossible Travel

This ensures the search only applies to case titles.

Use Exclusions to Reduce Noise

Example:

!status: Closed

This ensures analysts see only active investigations.

Combine Multiple Conditions

Example:

/advanced severity: High && status: Open && disposition: Malicious

This helps SOC teams quickly identify high-risk active cases.

Limitations

Parentheses are not supported in queries
&& has higher precedence than ||
Queries must start with /advanced

Troubleshooting

No Results Returned

Check the following:

Ensure /advanced prefix is included.
Verify the field name spelling.
Confirm field values exist in the dataset.

Unexpected Results

Possible reasons:

Incorrect logical operator precedence
Typo in field name
Field not supported in advanced queries.

Getting Started

AirMDR Detections

Integrations

API Reference

AirMDR Product Suite

Case Manager — Advanced Search

Overview

Accessing Advanced Search

UI Navigation

Searchable Fields in Advanced Search

Core Case Fields

Query Structure

Components

Example Query Structure

Query Syntax

In Normal Search (Recommended)

In Advanced Search

Query Precedence Rules

Basic Search Examples

Syntax

Examples

Search Result Ordering

Match Weight (for finding results)

Single vs Multi-word Search Behavior

Entity / IOC Filtering

Steps

Examples

Case ID Partial Search

Common SOC Search Queries

Best Practices

Limitations

Troubleshooting

No Results Returned

Unexpected Results

​Overview

​Accessing Advanced Search

​UI Navigation

​Searchable Fields in Advanced Search

​Core Case Fields

​Query Structure

​Components

​Example Query Structure

​Query Syntax

​In Normal Search (Recommended)

​In Advanced Search

​Query Precedence Rules

​Basic Search Examples

​Syntax

​Examples

​Search Result Ordering

​Match Weight (for finding results)

​Single vs Multi-word Search Behavior

​Entity / IOC Filtering

​Steps

​Examples

​Case ID Partial Search

​Common SOC Search Queries

​Best Practices

​Limitations

​Troubleshooting

​No Results Returned

​Unexpected Results

Overview

Accessing Advanced Search

UI Navigation

Searchable Fields in Advanced Search

Core Case Fields

Query Structure

Components

Example Query Structure

Query Syntax

In Normal Search (Recommended)

In Advanced Search

Query Precedence Rules

Basic Search Examples

Syntax

Examples

Search Result Ordering

Match Weight (for finding results)

Single vs Multi-word Search Behavior

Entity / IOC Filtering

Steps

Examples

Case ID Partial Search

Common SOC Search Queries

Best Practices

Limitations

Troubleshooting

No Results Returned

Unexpected Results