Global Search (⌘K)
Search across alerts, SIEM events, endpoints, IOCs, and tickets simultaneously. Keyboard shortcut Cmd/Ctrl+K from anywhere in the platform.
Route:
/How global search works
OverviewHow Global Search Works
Press ⌘K (Mac) or Ctrl+K (Windows) anywhere in the platform to open the search modal. It searches five data types simultaneously with a 300ms debounce:
| Type | Fields searched |
|---|---|
| Alerts | source, raw content, tags |
| SIEM Events | host, user, srcIp, message |
| EDR Agents | hostname, IP address, department |
| IOCs | indicator value, source name |
| Tickets / Incidents | title, description |
Results are grouped by type with entity-specific icons. The total result count is shown in the footer.
Keyboard navigation
- ↑ / ↓ — move between results
- Enter — open the highlighted result
- Escape — close the search
Recent searches
The last 6 queries are saved to localStorage and shown as pills when the search is empty. Click any pill to re-run that search.
Search tips
How to useSearch Tips
What works well
- IP addresses — finds all SIEM events, alerts, and IOCs involving that IP:
185.220.101.34 - Hostnames — finds the agent, all its SIEM events and alerts:
DESKTOP-HR-03 - CVE IDs — finds vulnerability records and any alerts referencing the CVE
- Usernames — finds all SIEM events and alerts for that user
- Hash values — finds IOCs and EDR events with that hash
What to try when search returns nothing
- The search requires at least 2 characters
- SIEM events older than your retention window may not be indexed
- IOC search matches on the
valuefield — try the full indicator e.g.185.220.101.34not just185
Performance
Search uses Prisma contains (SQL LIKE) queries. For better performance at scale (100k+ rows), add a full-text search index in PostgreSQL:
CREATE INDEX siem_message_fts ON "SIEMEvent" USING gin(to_tsvector('english', message));Then switch the /api/search route to use Prisma's search mode instead of contains.