[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-02。"],[[["\u003cp\u003eUDM searches are most efficient when they are narrowly focused, requiring each condition to follow the format of \u003ccode\u003eudm-field operator value\u003c/code\u003e, as more focused searches run faster and use fewer computing resources.\u003c/p\u003e\n"],["\u003cp\u003eTo enhance performance, always restrict the time range of your UDM search to the necessary minimum, while keeping in mind the 90-day maximum search limit.\u003c/p\u003e\n"],["\u003cp\u003eWhen utilizing regular expressions in UDM searches, be mindful that each one adds to the completion time, and while \u003ccode\u003eAND\u003c/code\u003e, \u003ccode\u003eOR\u003c/code\u003e, and \u003ccode\u003eNOT\u003c/code\u003e operators can be used, there is a limit of 169 logical operators within parentheses.\u003c/p\u003e\n"],["\u003cp\u003eRegular expressions cannot be applied to enumerated fields, and the \u003ccode\u003eany\u003c/code\u003e operator is automatically used for repeated fields, treating each value in the list separately, potentially leading to unintended outcomes, especially with the \u003ccode\u003e!=\u003c/code\u003e operator.\u003c/p\u003e\n"],["\u003cp\u003eTimestamp fields must be searched using Unix epoch time, which represents the number of seconds since January 1, 1970, and certain fields like \u003ccode\u003emetadata.id\u003c/code\u003e and \u003ccode\u003emetadata.product_log_id\u003c/code\u003e are not filterable.\u003c/p\u003e\n"]]],[],null,["# Search best practices\n=====================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nThis document describes Google's recommended best practices for using the [**Search**](/chronicle/docs/investigation/udm-search) feature in Google Security Operations. Searches can require substantial computational resources if they're not carefully constructed.\nPerformance also varies depending on the size and complexity of the data in your\nGoogle SecOps instance.\n| **Note:** For raw log searches, the **Search** field is limited to 150 characters.\n\n### Construct effective search queries\n\nEach condition must be in the form of\n`udm-field `*operator value*.\n\nFor example:\n`principal.hostname = \"win-server\"`\n| **Note:** More focused search queries run faster and use less compute resources.\n\n### Narrow the time range for your search\n\nBecause Google SecOps can ingest a large amount of data during a search, it's recommended that you minimize the time range to narrow the scope and improve search performance.\n| **Note:** The maximum time range you can search is 90 days.\n\n### Use regular expressions in search query\n\nYou can use regular expressions when searching data:\n\n- Use `AND`, `OR`, and `NOT`.\n- `AND` is assumed in the absence of the other operators.\n- Use parentheses to modify the order of precedence. There is a maximum limit of 169 logical operators (`OR`, `AND`, and `NOT`) that can be used in the parentheses.\n- Depending on the field type, field operators can include: `= != \u003e= \u003e \u003c \u003c=`\n\nAlternatively, you can use the\n[reference lists](/docs/reference/reference-lists).\n| **Note:** Searches with multiple regular expressions may take longer to complete.\n\n### Use `nocase` as a search modifier\n\n`nocase` can be used as a modifier to ignore capitalization.\n\nFor example, the following search is invalid:\n\n`target.user.userid = \"TIM.SMITH\" nocase`\n\n### Don't use regular expressions for enumerated fields\n\nYou can't use regular expressions for enumerated fields (fields with a range of\npredefined values) like `metadata.event_type` or\n`network.ip_protocol`.\n\nThe following example is an invalid search:\n`metadata.event`*type = /NETWORK*`*/`\n\nWhereas, the following example is a valid search:\n`(metadata.event_type = \"NETWORK_CONNECTION\" or\nmetadata.event_type = \"NETWORK_DHCP\")`\n\n### Using any and all operators in the Events field\n\nIn **Search** , some fields are labeled as **repeated** , which means they contain a list\nof values or message types. Repeated fields are always treated with the `any` operator by default (there's no option to specify\n`all`).\n\nWhen the `any` operator is used, the predicate is evaluated as true if any value\nin the repeated field satisfies the condition. For example, if you search for\n`principal.ip != \"1.2.3.4\"` and events in your search include both\n`principal.ip = \"1.2.3.4\"` and `principal.ip = \"5.6.7.8\"`, a match is generated. This expands your search to include results that match any of\nthe operators instead of matching all of them.\n\nEach element in the repeated field is treated individually. If the repeated\nfield is found in events in the search, the events are evaluated for each\nelement in the field. This can cause unexpected behavior, especially when\nsearching using the `!=` operator.\n\nWhen using the `any` operator, the predicate is evaluated as true if any value\nin the repeated field satisfies the condition.\n\n### Timestamps use Unix epoch time\n\nTimestamp fields are matched using Unix epoch time (number of seconds that have\npassed since Thursday 1 January 1970 00:00:00).\n\nWhen searching for a specific timestamp, the following (in epoch time) is valid:\n\n`metadata.ingested_timestamp.seconds = 1660784400`\n\nThe following timestamp is invalid:\n\n`metadata.ingested_timestamp = \"2022-08-18T01:00:00Z\"`\n\nThere are certain fields that are excluded from filters, including the\nfollowing:\n\n- `metadata.id`\n- `metadata.product_log_id`\n- `*.timestamp`\n\nBecause these fields often contain unique values, they can add unnecessary\ndetail, which may reduce the effectiveness of the search.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
