Find an Event

You can search all events that were processed by Ruxie in the past 14 days, including those that were tuned or became Expel alerts.

For example, you could use this feature to ensure Ruxie processed an EDR alert about a departing employee yesterday at 8:30am, or you could find events for a specific user that came from a specific IP address.

You can run a maximum of 100 searches in 24 hours.

Search for Events

1. Log in to Workbench.

2. In the left side menu, select Search for an Event.

3. Click Select parameter..., then select a parameter for your search and enter a value for the parameter.

1. Select Add another parameter to enter an additional parameter, and then enter another value. You can repeat this process to add multiple search parameters.

Multiple parameters create a more targeted search. However, be aware that the search uses the logical 'AND' operator, so results must match all parameters.

1. Select your specific device vendors (or leave it as "All Device Vendors"), and select the timeframe.

2. Select Search.

3. Workbench now searches for alerts in the evidence database, and then displays the 100 most recent results. You can view the event details by:

   • Selecting Event Details in the Time column.

   • Selecting the alert name in the Related Expel Alerts column (in cases where the event is linked to an Expel Alert).

Learn more in About Event Details.

Troubleshooting

If the search takes longer than 1 minute, it will time out. If this happens, try to make your search more specific and then run it again. You could do this by adding another parameter or by reducing the time period.