Skip to main content
Sumo Logic

Lab 1 - Search Basics: Metadata and Keywords

This lab give you practical experience to use metadata and keywords to narrow your search scope and improve performance for a security context.
In this lab, you will learn the use of metadata and keywords to narrow your search scope and improve performance.

 

  1. Search for all messages for the last 6 hours with  _sourceCategory=Labs/AWS/CloudTrail that contain the word "root".

_sourceCategory=Labs/AWS/CloudTrail and root

  1. Search for messages across all your AWS data that contain the word "root".

_sourceCategory=Labs/AWS/* and root

  1. Run a Live Tail session for the same query as #1.

 

QUIZ: True or False

  1. Keywords are case-sensitive  

  2. AND is implicit and OR is explicit

  3. Keywords and metadata can use wildcards

  4. Live Tail must contain at least one metadata tag