About
With advanced conditionalizing capabilities, Vulcan Cyber ExposureOS Magic Search (VMS) is designed to elevate the search and filtering experience. Use Filter to retrieve the information that matters to you most.
Create Complex queries with groups of AND / OR combinations.
Save Searches to recall complex queries, ensuring you can quickly access valuable information whenever needed.
Apply exact and partial match Options using "Is" or "Is Not", or apply "Contains" and "Does Not Contain" criteria to zero in on the information that meets your requirements.
Search for empty or populated values by applying the "Is not empty" and "Is empty" parameters.
Perform relative comparison using "Greater Than" and "Less Than" options to isolate data points that fall within specific numeric ranges.
Availability and support
Magic Search is available on the following pages in the Vulcan Cyber ExposureOS platform:
Single queries
Single queries are your straightforward, go-to tool for refining search results. With the option to choose between "Or" or "And" conditions, single queries allow you to filter your results based on a single set of criteria.
Use the "Or" condition to broaden your search scope and retrieve results that meet any of the specified criteria
Use the "And" condition to create a narrower focus by demanding all criteria to be met. This option is ideal for quick, precise searches.
For example:
Grouped queries (Complex Queries)
Complex or grouped queries let you navigate between multiple sets of criteria, using "And" and "Or" conditions within the same search scope.
Create query groups (AKA, several Single Queries), each with its own rules and conditions, to perform intricate searches.
Perform more nuanced searches, combining various factors to uncover specific insights.
Start by specifying your first condition.
Click the three dots next to the condition and select "Create Group." A visual group box is created.
Within the box, click "+Add Rule" to add more rules and conditions to this specific group query.
Create your first group of conditions using either "And" or "Or".
To create another group, click the "+Add Rule" outside of the borders of the first group box.
Create the second group of conditions.
You can keep creating as many groups as you wish.
Differences between "And" and "Or" in Grouped Queries
By default, the "And" condition is automatically selected when creating a group, but you can change it to "Or" as needed. Each logic choice leads to different search results, as illustrated below:
Using the "And" Logic
When using "And" logic to combine results between different query groups, it means that each result must meet the conditions of every query group. For example, if we are searching for vulnerabilities that contain "2022" or "OpenSSL" in their name (Query Group A) and have a CVSS score greater than 9 (Query Group B), each search result must fulfill both conditions.
Using the "Or" Logic
When using the "Or" condition to combine results between different query groups, it means that each result must satisfy the conditions in either Query Group A or Query Group B (and so on). For instance, if we want to find vulnerabilities with an Exploitable threat tag and were last seen in the past 14 days (Group Query A), and also retrieve vulnerabilities with a CVSS score greater than 9 and are patchable using the "Or" condition, each result must meet at least one of these criteria.
Parameters, Operators, and Input Type (UI and API)
The following tables contain the supported parameters, operators, and input type (Aka, rule sets) per category, including an API reference guide:
Connector-Specific Parameters
Connector-specific parameters allow you to refine your searches by utilizing a subset of each integrated connector’s native fields. This addition extends the capabilities of the out-of-the-box (OOB) parameters currently available in our Magic Search, providing you with more granular control and tailored results.
Parameter | Sub-Category | Operator | Input type |
[Any integrated Connector Name] | At least one of the following:
|
|
|
Important Notes
Only integrated and connected connectors in your environment will be available for search.
Parameters are dynamically available based on the connectors integrated within your environment. For instance, if you connect with the Qualys or Tenable connectors, you’ll gain access to their unique parameter.
If a sub-category like 'finding (Instance)' does not appear as an option, it indicates that no respective data exists/is ingested for that connector.
The Vulcan Cyber ExposureOS platform is pre-configured to ingest specific parameters from each connector. Parameters visible are those mapped and available within Vulcan Cyber ExposureOS, not necessarily all that a connector offers.
When searching, input is accepted as free-text only, even for parameters like dates or integers.
Integration and Syncing
Integrating a new connector may take up to 24 hours for all relevant data to appear in your search options.
FAQs
Can I search all fields I see on the Vulnerability Details page using Connector-Specific Parameters?
Not necessarily. Only the parameters ingested and mapped by Vulcan Cyber ExposureOS are searchable.
What happens if a connector is disabled or deleted?
Disabled connectors still display their parameters; however, deleted connectors will have their parameters removed from search options.
Can Connector-Specific Parameters be used in combination with other parameters?
Yes. They can also be saved as part of a saved search or a filter in playbooks. Tags based on saved searches will function if the search includes connector-specific parameters.
Why results may be higher when selecting fewer Business Groups?
This happens only if the Risk Level filter is also set.
All Business Groups:
The system considers all findings (instances) across all assets.
The vulnerability’s risk level is determined by the highest risk level across the entire environment.
This gives a consolidated view of vulnerabilities at their most critical state.
Specific Business Groups:
The system considers only findings (instances) within the selected BGs.
The vulnerability’s risk level is determined by the highest risk level among the assets in the selected BGs.
By narrowing the scope, the risk level can drop (e.g., from Critical to High) if the most critical findings (instances) are outside the selected BGs.
Read more about: Why filtering by specific business Groups may show more results than 'All Business Groups': Understanding the Risk Level filter.