Search

Search is a field query language over flows, devices and incidents. No endpoint accepts executable SQL — not from you, and emphatically not from a language model.

Field queries

src:192.0.2.12 service:tls after:2026-09-09T00:00:00Z
device:camera-01 proto:tcp port:443
domain:example.invalid severity:high status:open

Field	Matches
src, dst	Source or destination address
device	A device by name or identifier
service, proto, port	Service, protocol, port
source	Which sensor kind produced the record
vlan	VLAN
domain, asn, country	Destination attributes
severity, status	Incident attributes
after, before	Time bounds

Adjacent terms mean AND. Quoted values use JSON string escaping.

What it refuses, and why

This version rejects OR, nested groups and leading-negative terms. It does not silently weaken them into something else — a query it cannot express exactly is an error, not an approximation.

The reason is worth stating: because the grammar is narrow, every accepted predicate is guaranteed to be applied by the tenant-scoped store before the result limit. A query language that can express something the store cannot push down produces results that look filtered and are not, and that is a much worse failure than an error message.

Interpretation, then execution

Search is two steps on purpose:

1. Interpret. Your query text becomes a structured, versioned filter, and you are shown an informational preview of the projection, predicates, ordering and limit it will use.
2. Execute. The server recompiles that filter from scratch, injects the tenant scope, and runs it.

The preview is a preview. The filter is the contract. Unknown fields or operators, excessive nesting and raw SQL are rejected at recompilation.

Natural language mode

Optional, and it uses the same analyst provider and budget as the incident narratives. You type a sentence; it returns a server-validated structured filter, not SQL.

That distinction is the whole security design of this feature: model text never reaches a SQL parser and never reaches a query. The model proposes a filter in the same schema you could have typed by hand, and the same validator that checks your filter checks its filter.

If the provider is disabled or the budget is spent, the mode returns an explicit error. There is no silent fallback to something cheaper and wrong.