> For the complete documentation index, see [llms.txt](https://siff.gitbook.io/siff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://siff.gitbook.io/siff/guides/activity-and-config-search.md).

# Activity & Config Search

### Overview <a href="#overview" id="overview"></a>

Activity, Config, and Collections provide a similar search interface to find what you are looking for. The differences between these are:

1. Acitivity search includes a start and end time/date range to encompass *when* a change happened. Results shown are any changes that match the search terms and have a *Modified Date* within the time/date range.
2. Config search allows a single point-in-time for search purposes which shows the known configuration at that time. In other words, *Modified Date* occured before the time specified. The default "now" provides results showing the latest config. Config search also *requires* at least one search term, is limited to 1000 results maximum, and returns the current configuration only (not changes) for a particular element + service definition + resource combination.
3. Collections are used to group elements based on the search criteria against the current configuration. The *Last Checked* (MonitoredAt) field is used to determine inclusion and avoid matching out-of-date configs. Collections are used in certain configuration (such as *Policies*) but can also be used within other searches. When managing Collections the results show the list of matching elements.

### Search Interface <a href="#search-interface" id="search-interface"></a>

![Search Bar](https://docs.siff.io/guides/activity-config-search/searchbar-numbered.png) ![Search Bar Editing](https://docs.siff.io/guides/activity-config-search/searchbar-editing-numbered.png)

The search bar allows you to add/edit search terms, clear the search, and refresh the search.

1. Category: Specify the category for new search terms. See *Categories & Fields* below for more information.
2. Term: Add a search term. By default hitting `enter` will add a logical `OR` term. If logical `AND` is desired then use the `AND` button. To edit an existing search term select the term and the input will update to the current value. The `OR/AND` options are replaced by `Save/Cancel` when editing.
3. OR/AND: Used when adding terms (2).
4. Clear: will clear all search terms.
5. Refresh: refresh the search results. Note that any time a term is added, modified, or removed the search is refreshed automatically.
6. Search Terms: `OR` terms of the same category are grouped together with `AND` terms on separate lines.
7. Selecting a search term enters edit mode. The term input (2) updates to the term value and the term now shows some controls (left-to-right):
   1. Disable/Enable: disable will keep the search term it is not used in the search.
   2. Negate: Logical `NOT` the term, will also update the colour to red.
   3. Delete: remove the term.
   4. Close: exit edit-mode (or hit `ESC` or click the *Cancel* button)

The example screenshot above is from the Activity app and so also has the date/time range shown `Last 5 Years`. Select this to change the range. Config is similar, and Collections have a separate input field *Last Checked Within* to specify what is considered current.

#### Wildcard (default) and Exact Match <a href="#wildcard-default-and-exact-match" id="wildcard-default-and-exact-match"></a>

When adding search terms the default is to perform a wildcard search which is *not* case sensitive. Wildcard symbols are not needed or supported explicitly.

In the example search above the term `/etc/hosts` is a wildcard search and would match any resource that contains that string regardless of case, e.g. **`/etc/hosts`**`.allow` or `/backup`**`/etc/HOSTS`**.

If an exact match is desired then surround the term with double quotes. Also in the example search above `"/etc/hostname"` is an exact match and will only match resources with that exact specific name and matching case.

#### Field Search <a href="#field-search" id="field-search"></a>

Some categories additionally support further restricting a search to specific fields. In the example search above the term `group:"root"` searches the *group* field in the *Property* category for the exact match `root`. Field search supports both wildcard and exact matches, so for example `group:root` will also work.

Refer to *Categories and Fields* below for more details. Note that field names are *not* case sensitive when doing field search.

#### Categories and Fields <a href="#categories-and-fields" id="categories-and-fields"></a>

| Category       | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |                                                                   |                        |                            |                                                                    |                   |                      |                                                                                                                |                              |                          |                        |                      |                  |                       |                  |                                                                                                                                                                                                                                                                                                                                                      |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ---------------------- | -------------------------- | ------------------------------------------------------------------ | ----------------- | -------------------- | -------------------------------------------------------------------------------------------------------------- | ---------------------------- | ------------------------ | ---------------------- | -------------------- | ---------------- | --------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Content**    | <p>Search within the content of the entries. Performing an exact search on content will give the same answers as a wildcard search.<br><br>Note: Activity also supports the following field search:</p><ul><li>SearchableDiffContent (search for content added or removed)</li></ul><p>Example searches:<br></p><ul><li><code>something</code> (wildcard entire content)</li><li><code>SearchableDiffContent:-something</code> (wildcard content removed)</li><li><code>SearchableDiffContent:+something</code> (wildcard content added)</li><li><code>SearchableDiffContent:something</code> (wildcard added or removed)</li><li><code>SearchableDiffContent:"-whole line"</code> (exact content line removed)</li></ul>                                                                                                                                                                                                                                                                                               |                                                                   |                        |                            |                                                                    |                   |                      |                                                                                                                |                              |                          |                        |                      |                  |                       |                  |                                                                                                                                                                                                                                                                                                                                                      |
| **Address**    | <p>Search for entries by element addresses or names. All fields are searched by default. Field and exact search are supported with some exceptions noted below:<br></p><ul><li>Address (primary IP)</li><li>ContainerID</li><li>ContainerName</li><li>ContainerImage</li><li>IP Addresses (not for field search)</li><li>Virtual IP Addresses (not for field search)</li><li>MAC Addresses (not for field search)</li><li>Host/Domain Names (not for field search)</li></ul><p>When searching for an IP address CIDR notation is also supported. Example searches:<br></p><ul><li><code>"server.location.siff.io"</code> (exact hostname)</li><li><code>location.siff.io</code> (wildcard hostname)</li><li><code>10.3.0.0/24</code> (CIDR search)</li><li><code>192.168.0</code> (wildcard IP)</li><li><code>"192.168.0.1"</code> (exact IP)</li><li><code>aa:bb:cc:dd:ee:ff</code> (MAC address, not available on all device types)</li><li><code>containerimage:wordpress</code> (wildcard field specific)</li></ul> |                                                                   |                        |                            |                                                                    |                   |                      |                                                                                                                |                              |                          |                        |                      |                  |                       |                  |                                                                                                                                                                                                                                                                                                                                                      |
| **Collection** | Search using an existing Collection by name. When used this way the collection is a list of elements and the search includes/restricts the results to only these elements.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                   |                        |                            |                                                                    |                   |                      |                                                                                                                |                              |                          |                        |                      |                  |                       |                  |                                                                                                                                                                                                                                                                                                                                                      |
| **Platform**   | <p>Search based on the type of element. All fields are searched by default. Field and exact search are supported:<br></p><ul><li>OSPlatform</li><li>OSVersion</li><li>OSArch</li><li>Distribution</li></ul><p>Example searches:<br></p><ul><li><code>ciscoios</code> (all field wildcard)</li><li><code>distribution:me380x</code> (wildcard field specific)</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                                                                   |                        |                            |                                                                    |                   |                      |                                                                                                                |                              |                          |                        |                      |                  |                       |                  |                                                                                                                                                                                                                                                                                                                                                      |
| **Service**    | <p>Search by Service Definition name or alias. Both fields are searched by default. Field and exact search are supported:<br></p><ul><li>ServiceName</li><li>ServiceAlias</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                   |                        |                            |                                                                    |                   |                      |                                                                                                                |                              |                          |                        |                      |                  |                       |                  |                                                                                                                                                                                                                                                                                                                                                      |
| **Resource**   | <p>Search by Resource name or Command Line. Both fields are search by default. Field and exact search are supported:<br></p><ul><li>Resource</li><li>CommandLine (only applicable for command type entries)</li></ul><p>Example searches:<br></p><ul><li><code>/etc/hosts</code> (all field wildcard)</li><li><code>"/etc/hostname"</code> (all field exact)</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                                                                   |                        |                            |                                                                    |                   |                      |                                                                                                                |                              |                          |                        |                      |                  |                       |                  |                                                                                                                                                                                                                                                                                                                                                      |
| **Tag**        | <p>Search by Tag, Change Request ID, or whether Issue is flagged. Field and exact search are supported:<br></p><ul><li>Tag</li><li>ChangeRequestID</li><li>Issue (NOTE: this is a boolean field, supports <code>true</code> or <code>false</code> value)</li></ul><p>Example Searches:</p><ul><li><code>tag123</code> (all field wildcard)</li><li><code>tag:"tag123"</code> (tag field exact match)</li><li><code>issue:"true"</code> (search for issues)</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                                                   |                        |                            |                                                                    |                   |                      |                                                                                                                |                              |                          |                        |                      |                  |                       |                  |                                                                                                                                                                                                                                                                                                                                                      |
| **Comment**    | <p>Search for entries based on comments or who left a comment.<br><br>Example searches:<br></p><ul><li><code>"<jason@siff.io>"</code> (exact search for commenter)</li><li><code>maintenance</code> (wildcard comment or commeter)</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                   |                        |                            |                                                                    |                   |                      |                                                                                                                |                              |                          |                        |                      |                  |                       |                  |                                                                                                                                                                                                                                                                                                                                                      |
| **Property**   | <p>This is the largest category covering other meta-data fields. Most fields are searched by default (see below). Field and exact search are supported:<br></p><ul><li>ChangeType (<code>new</code>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | <code>update</code>)</li><li>ValidationType (<code>planned</code> | <code>unplanned</code> | <code>autovalidated</code> | <code>manualvalidated</code>)</li><li>Status (<code>success</code> | <code>warn</code> | <code>timeout</code> | <code>unknown</code>)</li><li>Checksum</li><li>EntryID</li><li>Filetype (Resource Type: <code>text file</code> | <code>large text file</code> | <code>binary file</code> | <code>directory</code> | <code>command</code> | <code>api</code> | <code>registry</code> | <code>dns</code> | <code>permission denied</code>)</li><li>Owner (files/directories)</li><li>Group (files/directories)</li><li>Permission (files/directories)</li><li>Security (files/directories)</li><li>Attribution</li><li>AccessName</li><li>CollectorID (<strong>only</strong> field search)</li><li>CollectorName (<strong>only</strong> field search)</li></ul> |
| **Violations** | <p>Find entries with violations. All fields are searched by default. Field and exact search are supported:<br></p><ul><li>Policy</li><li>Alias</li><li>Rule</li></ul><p>Example searches:<br></p><ul><li><code>alias:"log4shell"</code></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                   |                        |                            |                                                                    |                   |                      |                                                                                                                |                              |                          |                        |                      |                  |                       |                  |                                                                                                                                                                                                                                                                                                                                                      |