Search and Export Data from the Security Data Lake

To find the data you want in the Security Data Lake, narrow down your search by filtering for specific integrations and/or time ranges. By default, all integrations are selected, and the date/time range is set to the last 15 minutes.

To filter your search by integration:

1. Click the filter button.

2. Select the desired integration (or integrations) from the Integration dropdown.

3. Click Apply Filters.

To filter your search by date and time range:

1. Click the date/time range dropdown.

2. Select the desired date/time range, or click Custom Range to select specific starting and ending dates/times.

Search results are displayed on-screen so you can review them before initiating an export. Up to 50 records are displayed in this preview mode.

1. The Integration field shows the name of the data source from which this record was ingested.

2. The Time of Ingestion field shows the date and time when this record was ingested and processed by Red Canary.

3. The Data field shows the raw text of the record as sent by the source system.

4. By default, only the first few lines of the raw record are displayed. Click the Expand button to see the full record.

Because the amount of data included in an export search can be quite large, a download link is generated and sent to your email on request.

To generate an export request:

1. Click the Download button.

2. Choose the maximum size of the download to generate. If the number of records that match the search criteria exceed that amount, the results will be truncated. This is to help ensure that the export file is not too large to successfully download.

3. In the background, the raw data that matches the search criteria will be compiled into a comma-separated values (CSV) file. When it is ready, you will receive an email notification.