Search
The search module provides a set of classes for finding and aggregating events stored within DynamiteNSM.
The Search Interface
The Search class provides a method for retrieving events or baseline intervals between a start and end date.
-
class
dynamite_sdk.search.Search(index, as_dataframe=False)[source]
-
execute_query(start: datetime.datetime, end: datetime.datetime, search_filter=None)[source]
Executes a search query, stores the results in events instance variable
- Parameters
-
- Returns
None
Check out these search examples.
The Pivot Interfaces
Events generated by Zeek often have relationships with other events generated around the same time.
For example, a TCP session (represented in Zeek’s conn.log may have several corresponding HTTP events.
The pivot interface allows the user the ability to easily locate these corresponding events.
Check out these pivot examples.
ConnectionEventToNetworkEventsPivot
-
class
dynamite_sdk.search.ConnectionEventToNetworkEventsPivot(event: dynamite_sdk.objects.events.Event, as_dataframe=False)[source]
Provides an interface from a connection event to the corresponding network-event(s) (sub-event)
NetworkEventToConnectionEventPivot
-
class
dynamite_sdk.search.NetworkEventToConnectionEventPivot(event: dynamite_sdk.objects.events.Event, as_dataframe=False)[source]
Provides an interface from pivoting from some network-event (sub-event) to the corresponding connection event