[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-02。"],[[["\u003cp\u003eRaw Log Scan in Google Security Operations allows users to search unparsed logs when the information is not found in the normalized data.\u003c/p\u003e\n"],["\u003cp\u003eUsers can search for specific artifacts in raw logs like usernames, filenames, registry keys, command-line arguments, raw HTTP data, and domain names.\u003c/p\u003e\n"],["\u003cp\u003eRegular expressions can be used in Raw Log Scan to match sets of character strings and narrow searches within the security data.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Security Operations supports Google RE2 open-source regular expression syntax for performing raw log searches.\u003c/p\u003e\n"],["\u003cp\u003eThere are a number of regular expressions provided that are intended to search for events on Windows logs, including account creation, logon attempts, and process management.\u003c/p\u003e\n"]]],[],null,["# Use raw log scan to search logs\n===============================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nWhen you perform a search, Google Security Operations first examines the security data that has been ingested, parsed, and normalized. If the information isn't found in the normalized data, you can use **Raw log scan** to examine the raw, unparsed logs. You can also use regular expressions to examine the raw logs in more detail.\n| **Note:** The search field is limited to 150 characters.\n\nYou can use **Raw log scan** to investigate artifacts that appear in logs (but aren't indexed), including:\n\n- Usernames\n- Filenames\n- Registry keys\n- Command-line arguments\n- Raw HTTP request-related data\n- Domain names based on regular expressions\n- [Asset namespaces](../investigation/asset-namespaces) and addresses\n\nRaw log scan\n------------\n\nTo use **Raw log scan** , enter a search string in the **Search** field on either the\nlanding page or the menu bar (for example, an MD5 hash). Enter at least 4\ncharacters (including wildcards). If Google SecOps cannot find the search\nstring, it opens the **Raw logs scan** option. Specify the **Start Time** and\n**End Time** (the default is 1 week) and click **Search**.\n\nEvents associated with the search string are displayed. You can open the\nassociated raw log by clicking the arrow button.\n\nYou can also click the **Log sources** menu and select one or more\nof the data sources you're searching. The\ndefault setting is **All**.\n\nRegular expressions\n-------------------\n\nYou can use regular expressions in Google SecOps to search for and match sets of character\nstrings in your security data. Regular expressions\nhelp to narrow your search using fragments of information rather than requiring an exact match.\n\nTo run a search using regular expression syntax:\n\n1. In the **Search** field, enter a regular expression. Your regular expression must be 4 to 66 characters long.\n2. Select the **Run query as regex** checkbox and click **Search**.\n\nThe Google SecOps regular expression infrastructure is based on [Google RE2](https://github.com/google/re2/wiki/Syntax), an open-source regular expression engine. Google SecOps uses the same regular expression syntax.\n\nThe following table highlights some of the common regular expression syntaxes you can use for your searches.\n\n\u003cbr /\u003e\n\nThe following examples illustrate how you can use regular expressions to search data:\n\n- `goo.le\\.com`---Matches any string that starts with `goo`, followed by any single character, followed by `le.com`, such as `google.com` or `go0le.com`.\n- `goo\\w{3}\\.com`---Matches strings that start with `goo`, followed by exactly three word characters (`\\w`), and ending with `.com`. Examples include `google.com`, `goojle.com`, or `goodle.com`.\n- `[[:digit:]]\\.[[:alpha:]]`---matches a string that has a single digit, followed by a dot (.), followed by a single alphabetic character, such as `34323.system`, `23458.office`, or `897.net`.\n\n### Sample regular expressions to search for Windows logs\n\nThis section provides regular expression query strings you can use with Google SecOps **Raw log scan** to find commonly monitored Windows events. These examples assume the Windows log messages are in JSON format.\n\nFor more information about commonly monitored Windows Event IDs, see the [Events to Monitor](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor) topic in Microsoft documentation. The examples provided follow a similar pattern, described in these use cases.\n\n#### Find account management events\n\nThese regular expression query strings identify common account management events using the EventID attribute.\n\n#### Find logon success events\n\nThese regular expression query strings identify types of successful logon events using the EventID and LogonType attributes.\n\n#### Find logon failure events\n\nThese regular expression query strings identify types of failed logon events using the EventID and LogonType attributes.\n\n#### Find process, service and task events\n\nThese regular expression query strings identify certain process and service events using the EventID attribute.\n\n#### Find events related to object access\n\nThese regular expression query strings identify different types of process and service related events using the EventID attribute.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
