Searching
Searching in Keep Aware allows you to easily find suspicious activity, threats and discover risk across the organization. Keep Aware provides a deep level of visibility into browser activities such as page visits, credential use, uploads, downloads, extension activity, and other in-tab behavior.
Any search can be easily transformed into detection logic and deployed as policy through Policies and Profiles. To get started with searching, view one of the guides below.
Searching in Keep Aware
Searching in Keep Aware allows you to easily find suspicious activity, threats and discover risk across the organization. Keep Aware provides a deep level of visibility into browser activities such as page visits, credential use, uploads, downloads, extension activity, and other in-tab behavior.
Event and Threat Fields
Event and Threat fields can be used in search queries and detection queries within Policies. These fields represent metadata for every browser activity.
Extension Fields
Extension fields can be used in search queries and detection queries within Policies. These fields represent metadata for certain extensions, extension permissions, reputation information such as popularity and reviews, and organization-specific risk indicators provided by Keep Aware. By default, most manifest information is included by Keep Aware. To learn more about extension manifests, visit Chrome Manifest.
Asset Fields
Asset fields can be used in search queries and detection queries within Patterns. These fields represent metadata for users, browsers, and operating systems.
Application Account Fields
Web application account fields can be used in search queries and detection queries within Policies. These fields represent metadata for web applications, including user account and instance information and an organization-specific business relevance score (BRS) provided by Keep Aware.
Threat Hunting
This document maintains a running list of example use cases for searching across Keep Aware data for threat activity.