> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Case Manager — Advanced Search

> AirMDR Advanced Case Search allows users to perform structured queries in Case Manager using field-based filters and logical operators to quickly locate relevant cases.

## Overview

The **Advanced Search** feature in AirMDR Case Manager enables analysts and administrators to run **structured queries** to locate cases more precisely. Instead of relying on simple keyword searches, users can construct queries that filter cases by **specific case attributes, logical conditions, and exact phrases**.

<Accordion title="AirMDR Case Manager Advanced search helps users to:">
  * Locate cases based on **specific fields** (such as case name, status, disposition, or reporter).
  * Combine multiple criteria using **logical operators**.
  * Exclude unwanted results.
  * Perform **exact phrase searches** across case investigation content.

  <Info>
    Advanced search is triggered using the `/advanced` **prefix** in the Case Manager search bar.
  </Info>
</Accordion>

<Accordion title="When to Use Advanced Search?">
  Use Advanced Search when:

  * You need **precise filtering using case fields**
  * You want to combine conditions using **AND / OR / NOT**
  * You need to **exclude specific results**
  * You are performing **structured investigation queries**
</Accordion>

## Accessing Advanced Search

### UI Navigation

**AirMDR UI → Case Manager → Case Search Bar**

To use advanced search:

1. Navigate to **Case Manager**.
2. Locate the **search bar**.
3. Begin your query using the prefix:
   ```text theme={null}
   /advanced
   ```
4. Enter the query conditions.
5. Press **Enter** to execute the search.

## Searchable Fields in Advanced Search

<AccordionGroup>
  <Accordion title="Case Fields Supported in Advanced Queries">
    The following table lists **supported case fields that can be referenced in advanced queries**.

    ### Core Case Fields

    | Case Field            | Query Field             | Example                           |
    | :-------------------- | :---------------------- | :-------------------------------- |
    | Case ID               | `case_id`               | `case_id: ASO-1234`               |
    | Archived              | `archived`              | `archived: true`                  |
    | Assignee              | `assignee`              | `assignee: John Doe`              |
    | Reporter              | `reporter`              | `reporter: Jane Smith`            |
    | Created At            | `created_at`            | `created_at: 2025-01-01`          |
    | Modified At           | `modified_at`           | `modified_at: 2025-01-15`         |
    | Case Name             | `name`                  | `name: Impossible Travel`         |
    | Disposition           | `disposition`           | `disposition: Malicious`          |
    | Escalated to Customer | `escalated_to_customer` | `escalated_to_customer: true`     |
    | Organization Code     | `organization_code`     | `organization_code: ACME`         |
    | Priority              | `priority`              | `priority: High`                  |
    | Severity              | `severity`              | `severity: Critical`              |
    | Status                | `status`                | `status: Open`                    |
    | Category              | `category`              | `category: Authentication`        |
    | Sub Category          | `sub_category`          | `sub_category: Impossible Travel` |
    | Marked for Review     | `marked_for_review`     | `marked_for_review: true`         |
    | Reviewed              | `reviewed`              | `reviewed: true`                  |
    | Case Reinvestigated   | `case_reinvestigated`   | `case_reinvestigated: true`       |
    | Confidence            | `confidence`            | `confidence: High`                |
  </Accordion>

  <Accordion title="Case Score Fields">
    | Field                   | Query Field               |
    | :---------------------- | :------------------------ |
    | Case Score              | case\_score.score         |
    | Case Score Summary      | case\_score.summary       |
    | Case Score Completed At | case\_score.completed\_at |
  </Accordion>

  <Accordion title="Case Detail Fields (Advanced Query Support)">
    These fields search inside **case investigation details**.

    | Case Detail Field        | Query Field                                     |
    | :----------------------- | :---------------------------------------------- |
    | Actions Title            | case\_detail\_fields.actions.title              |
    | Alert                    | case\_detail\_fields.alert                      |
    | Summary                  | case\_detail\_fields.summary                    |
    | Findings Title           | case\_detail\_fields.findings.title             |
    | Findings Summary         | case\_detail\_fields.findings.summary           |
    | Investigation Summary    | case\_detail\_fields.investigation\_summary     |
    | Provider                 | case\_detail\_fields.provider                   |
    | Linked Alerts            | case\_detail\_fields.linked\_alerts             |
    | Custom Field Values      | case\_detail\_fields.custom\_field\_value\_map  |
    | Conclusion               | case\_detail\_fields.conclusion                 |
    | Activity Timeline        | case\_detail\_fields.activity\_timeline         |
    | FAQs                     | case\_detail\_fields.faqs                       |
    | Custom Questions         | case\_detail\_fields.custom\_questions          |
    | Explore Deeper Questions | case\_detail\_fields.explore\_deeper\_questions |
  </Accordion>
</AccordionGroup>

## Query Structure

Advanced queries follow a structured syntax that allows users to filter cases using specific fields and logical conditions.

<Accordion title="Query Format">
  ```text theme={null}
  /advanced field_name: value [operator] field_name: value
  ```

  ### Components

  | Component    | Description                                     | Example        |
  | :----------- | :---------------------------------------------- | :------------- |
  | `/advanced`  | Prefix required to trigger advanced search mode | `/advanced`    |
  | `field_name` | The case field used for filtering               | `status`       |
  | `:`          | Separates field and value                       | `status: Open` |
  | `value`      | Value to match in the field                     | `Malicious`    |
  | `operator`   | Logical operator used to combine conditions     | `&&`           |

  ## Example Query Structure

  ```text theme={null}
  /advanced name: Impossible Travel && status: Open
  ```

  This query returns cases where:

  * **Case name = Impossible Travel**
  * **Status = Open**

  <AccordionGroup>
    <Accordion title="Query With Multiple Conditions">
      ```text theme={null}
      /advanced severity: High && status: Open && disposition: Malicious
      ```

      Returns cases that meet **all three conditions**.
    </Accordion>

    <Accordion title="Query With OR Condition">
      ```text theme={null}
      /advanced name: Impossible Travel || name: Login From Rare Country
      ```

      Returns cases matching **either condition**.
    </Accordion>

    <Accordion title="Query With Exclusion">
      ```text theme={null}
      /advanced name: Impossible Travel && !status: Closed
      ```

      Returns **Impossible Travel cases that are not closed**.
    </Accordion>
  </AccordionGroup>
</Accordion>

## Query Syntax

Advanced queries allow filtering using **logical operators and field-based searches**.

<AccordionGroup>
  <Accordion title="Logical Operators Supported">
    | Operator | Syntax | Purpose                                                                           |
    | :------- | :----- | :-------------------------------------------------------------------------------- |
    | AND      | `&&`   | Returns results that satisfy both conditions.                                     |
    | OR       | \|\|   | Returns results that match *either one* of the specified conditions in the query. |
    | NOT      | `!`    | Excludes cases that match the specific condition from the search results.         |

    **Example:**

    ```text theme={null}
    /advanced name: Impossible Travel && disposition: Malicious
    ```

    This query returns cases where:

    * Case name = Impossible Travel
    * Disposition = Malicious
  </Accordion>

  <Accordion title="Exact Phrase Search - In Normal Search & In Advanced Search">
    ### In Normal Search (Recommended)

    You can use **double quotes (**`" "`**)** to search for exact phrases.

    | Input                | Behavior                  |
    | :------------------- | :------------------------ |
    | `lateral movement`   | Matches words anywhere    |
    | `"lateral movement"` | Matches exact phrase only |

    ### In Advanced Search

    Quotes **do not work in **`/advanced`** mode**. Use:

    ```text theme={null}
    /advanced exact: "lateral movement"
    ```

    <Accordion title="Limitations of Advanced Search">
      * Quotes (`" "`) are **not supported**
      * Use `exact:` for phrase matching
      * **Comments are not searched**
      * Parentheses are **not supported**
      * Operator precedence applies:
        * `!` → `&&` → `||`
    </Accordion>
  </Accordion>

  <Accordion title="Search by Specific Fields">
    You can narrow searches to specific sections of a case.

    | Field          | Description                 |
    | :------------- | :-------------------------- |
    | name           | Case title                  |
    | summary        | Investigation summary       |
    | assignee       | Assigned user               |
    | alert          | Alert details               |
    | findings       | Findings section            |
    | linked\_alerts | Linked alerts               |
    | iocs           | Indicators (IP/domain/user) |
    | custom\_fields | Custom fields               |
    | all            | Entire case                 |
    | case\_id       | Enter specific case ID      |

    <Tip>
      **<u>Important Behavior</u>:**

      * If **no field is selected** → searches entire case (including comments)
      * If **any field is selected** → comments are excluded
    </Tip>
  </Accordion>
</AccordionGroup>

## Query Precedence Rules

* `&&` **(AND)** has **higher precedence** than `||` **(OR)**.
* Parentheses **are currently not supported** in advanced queries.

Example interpretation:

```text theme={null}
query1 && query2 || query3
```

is evaluated as:

```text theme={null}
(query1 && query2) || query3
```

## Basic Search Examples

<AccordionGroup>
  <Accordion title="Search by IP Address">
    ```text theme={null}
    /advanced all: 3.22.33.44
    ```

    Finds cases containing the IP address **3.22.33.44**.

    This produces the same result as a simple search.
  </Accordion>

  <Accordion title="Search by Case Name">
    ```text theme={null}
    /advanced name: Impossible Travel
    ```

    Returns all cases where the case title contains **Impossible Travel**.
  </Accordion>

  <Accordion title="Combine Conditions (OR)">
    ```text theme={null}
    /advanced name: Impossible Travel || name: Login From Rare Country
    ```

    Returns cases matching **either case type**.Combine Conditions (AND)
  </Accordion>

  <Accordion title="Combine Conditions (AND)">
    ```text theme={null}
    /advanced name: Impossible Travel && disposition: Malicious
    ```

    Returns **malicious Impossible Travel cases**.Exclude Results
  </Accordion>

  <Accordion title="Exclude Results">
    ```text theme={null}
    /advanced name: Impossible Travel && !status: Closed
    ```

    Returns **Impossible Travel cases that are not closed**.Multiple Exclusion Conditions
  </Accordion>

  <Accordion title="Multiple Exclusion Conditions">
    ```text theme={null}
    /advanced name: Impossible Travel && !status: Closed && !all: Manchester
    ```

    Returns cases that:

    * Are Impossible Travel
    * Are not closed
    * Do not contain Manchester
  </Accordion>

  <Accordion title="Filter by Assignee Context">
    ```text theme={null}
    /advanced name: Impossible Travel && all: naman@airmdr.com && !case_id: ASO-4231
    ```

    Use case:

    When an analyst is investigating **ASO-4231**, they can search for **similar cases involving the same user but exclude the current case**.Exact Phrase Search
  </Accordion>

  <Accordion title="Exact Phrase Search">
    Exact search allows matching **precise phrases** rather than individual keywords.

    ### Syntax

    ```text theme={null}
    exact: "phrase"
    ```

    Exclude exact phrase:

    ```text theme={null}
    !exact: "phrase"
    ```

    ### Examples

    Search cases containing exact phrase:

    ```text theme={null}
    /advanced exact: "data breach"
    ```

    Exclude phrase:

    ```text theme={null}
    /advanced !exact: "false positive"
    ```

    Combined example:

    ```text theme={null}
    /advanced exact: "P1" && !exact: "drill"
    ```

    This returns cases that:

    * contain **P1**
    * do **not contain drill**
  </Accordion>
</AccordionGroup>

## Search Result Ordering

* Results are sorted by **creation time (newest first)**
* Not sorted by relevance

### Match Weight (for finding results)

| Field              | Priority |
| :----------------- | :------- |
| Case ID            | Highest  |
| Case Name          | High     |
| Summary / Findings | Medium   |
| Others             | Lower    |

## Single vs Multi-word Search Behavior

| Input              | Behavior                |
| :----------------- | :---------------------- |
| `malware`          | Exact word match        |
| `lateral movement` | At least 1 word matches |
| `3-word query`     | At least 2 words match  |

<Note>
  Multi-word queries follow \~75% match logic.
</Note>

## Entity / IOC Filtering

You can filter cases using **entities such as IPs, domains, or usernames**.

### Steps

1. Open filter panel
2. Add entity value
3. Select type (optional)
4. Choose:
   * AND → all must match
   * OR → any can match

### Examples

* IP search → `192.168.1.100`
* User search → `user@company.com`
* Domain search → `evil.com`

## Case ID Partial Search

* Supports **substring search**
* Minimum **3 characters required**

| Input  | Result                |
| :----- | :-------------------- |
| `1234` | Matches SEC-1234      |
| `SEC`  | Matches all SEC cases |

## Common SOC Search Queries

Security analysts often search cases using specific operational patterns. The examples below demonstrate common investigation scenarios.

<AccordionGroup>
  <Accordion title="Find Open High-Severity Cases">
    ```text theme={null}
    /advanced severity: High && status: Open
    ```

    Use this query to quickly identify **active high-priority investigations**.
  </Accordion>

  <Accordion title="Find Cases Assigned to a Specific Analyst">
    ```text theme={null}
    /advanced assignee: John Doe && status: Open
    ```

    Returns **open cases assigned to a specific analyst**.
  </Accordion>

  <Accordion title="Find Malicious Cases">
    ```text theme={null}
    /advanced disposition: Malicious
    ```

    Used to locate **confirmed malicious incidents**.
  </Accordion>

  <Accordion title="Find Cases Related to a Specific Detection Type">
    ```text theme={null}
    /advanced name: Impossible Travel
    ```

    Returns cases where the **case title contains Impossible Travel**.
  </Accordion>

  <Accordion title="Find Open Cases Excluding Closed Investigations">
    ```text theme={null}
    /advanced !status: Closed
    ```

    Useful for viewing **all active cases**.
  </Accordion>

  <Accordion title="Find Cases Containing a Specific User or Indicator">
    ```text theme={null}
    /advanced all: user@company.com
    ```

    Returns cases where the email appears anywhere in the case content
  </Accordion>
</AccordionGroup>

## Best Practices

<AccordionGroup>
  <Accordion title="Use Field Filters">
    Instead of searching raw keywords:

    ```text theme={null}
    Impossible Travel
    ```

    Use:

    ```text theme={null}
    /advanced name: Impossible Travel
    ```

    This ensures the search only applies to **case titles**.
  </Accordion>

  <Accordion title="Use Exclusions to Reduce Noise">
    Example:

    ```text theme={null}
    !status: Closed
    ```

    This ensures analysts see only **active investigations**.
  </Accordion>

  <Accordion title="Combine Multiple Conditions">
    Example:

    ```text theme={null}
    /advanced severity: High && status: Open && disposition: Malicious
    ```

    This helps SOC teams quickly identify **high-risk active cases**.
  </Accordion>
</AccordionGroup>

## Limitations

* **Parentheses are not supported in queries**
* `&&` has higher precedence than `||`
* Queries must start with `/advanced`

## Troubleshooting

### No Results Returned

Check the following:

* Ensure `/advanced` prefix is included.
* Verify the field name spelling.
* Confirm field values exist in the dataset.

### Unexpected Results

Possible reasons:

* Incorrect logical operator precedence
* Typo in field name
* Field not supported in advanced queries.