Logs is where you search the events Vigilbase has collected from your providers. Every event is normalised into a common shape and keeps a link to its raw payload. Open it from the sidebar or press g then l. You need the logs.query permission.
Search
Type in the search box, or use field:value. The Search syntax help in the search box lists every option.
| Search | Finds |
|---|---|
actor:alice@example.test | Exact match |
action:authentication.* | Prefix match |
-outcome:success | Excludes a value |
severity:>=60 | Numeric comparison (severity and port only) |
level:high,critical | Any of several values |
host:"vpn gw" | Quoted value |
Other words search the action, category and display names. Fields you can use are action, outcome, level, severity, provider, dataset, category, actor, target, device, entity, ip, src, dst, port, host, country and event.
Choose Filters to refine by provider, dataset, level, outcome, action, country, source IP or entity, then choose Apply filters.
By default Logs shows Activity: sign-ins, admin and privilege changes, token grants, configuration changes, network events and findings. Choose All events to include inventory and configuration snapshots.
Read the results
- Events over time is a histogram of matching events. Select a bar to zoom to it.
- Choose Columns to show or hide columns such as Level, Source, Timestamp, Asset, Country, Action and Message.
- Expand a row to see the event. Normalised shows the common fields; Raw JSON shows the provider payload as text, with its SHA-256 hash. Sensitive fields are redacted unless your role allows them.
- From an expanded row, Open entity opens the entity in Security Fabric, Pivot adds a value to the search, and Copy event ID copies the ID.
- Evidence & provenance shows the connection, dataset, ingest time, parser, quality flags and retention for the event.
Searches over older data can run in the background. You can keep working, or choose Cancel.
Completeness
Every result says how complete it is: Complete for this range, or a note that counts are approximate or not exact. Open the details to see feed gaps, late arrivals, parser failures, sampling and data outside full retention.
No events in a range is not proof that nothing happened. If a feed was missing or behind, the result says so.
Live tail
Choose Live tail to watch matching events arrive. You need the logs.live_tail permission. Field filters apply to live tail; free text does not. Live tail pauses while you scroll; choose Show new events to catch up, or Stop live tail to return to search. Live events are not a completeness guarantee.
Export
Choose Export to export the current results. You need the logs.export permission. Large exports run in the background. When the export is ready, choose Download before the link expires. Exports are recorded in the audit log.