Global Search (⌘K)
Search across alerts, SIEM events, endpoints, IOCs, tickets, playbooks, decoys, vulnerabilities, and malware submissions simultaneously. Keyboard shortcut Cmd/Ctrl+K from anywhere in the platform.
/
How global search works
OverviewHow Global Search Works
Press ⌘K (Mac) or Ctrl+K (Windows) anywhere in the platform to open the search modal. It searches nine data types simultaneously with a 300ms debounce:
| Type | Fields searched |
|---|---|
| Alerts | source, raw content, tags |
| SIEM Events | host, user, srcIp, message |
| EDR Agents | hostname, IP address, department |
| IOCs | indicator value, source name |
| Tickets / Incidents | title, description |
| SOAR Playbooks | name, description |
| Decoys | name, type, location |
| Vulnerability Findings | CVE ID, service, and the affected asset's hostname |
| Malware Submissions | file name, file hash |
Results are grouped by type with entity-specific icons. The total result count is shown in the footer. Results link to each module's base page — Playbooks, Decoys, Vulnerability Management, and Malware currently don't support deep-linking to a specific record via a query param, so those four types open the module's list view rather than the exact record.
Keyboard navigation
- ↑ / ↓ — move between results
- Enter — open the highlighted result
- Escape — close the search
Recent searches
The last 6 queries are saved to localStorage and shown as pills when the search is empty. Click any pill to re-run that search.
Search tips
How to useSearch Tips
What works well
- IP addresses — finds all SIEM events, alerts, and IOCs involving that IP:
185.220.101.34 - Hostnames — finds the agent, all its SIEM events and alerts:
DESKTOP-HR-03 - CVE IDs — finds vulnerability records and any alerts referencing the CVE
- Usernames — finds all SIEM events and alerts for that user
- Hash values — finds IOCs and EDR events with that hash
What to try when search returns nothing
- The search requires at least 2 characters
- SIEM events older than your retention window may not be indexed
- IOC search matches on the
valuefield — try the full indicator e.g.185.220.101.34not just185
Performance
Search uses Prisma contains (SQL LIKE) queries. For better performance at scale (100k+ rows), add a full-text search index in PostgreSQL:
CREATE INDEX siem_message_fts ON "SIEMEvent" USING gin(to_tsvector('english', message));Then switch the /api/search route to use Prisma's search mode instead of contains.