> For the complete documentation index, see [llms.txt](https://docs.panther.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.panther.com/~/changes/2402/search/search-tool.md).

# Search

Construct a data query without writing SQL

## Overview

In the Search tool in Panther, search across all of your data—including log events, rule matches, and more—without writing SQL. You can use dropdown fields to create filter expressions, and group them using `AND` and `OR` functionality. It's also possible to execute [PantherFlow](/~/changes/2402/pantherflow.md) queries in Search.

Filter expressions can be constructed in different ways: as [key/value pairs](#key-value-filter-expression), a [free text](#free-text-filter-expression) search, or a [regular expression](#regular-expression-regex-filter-expression) search. Each of these can also use [wildcard characters](#using-wildcards-in-filter-expressions). You can combine different types of filter expressions in one search.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FYdounRUAM3xac7SUd7tG%2Fimage.png?alt=media&amp;token=c3c0dbdd-d92d-4488-85d5-da87356bca63" alt="In the Search page in Panther, there are two conditions joined by &#x22;OR&#x22; : &#x22;Source Domain is apigateway.amazonaws.com&#x22; and &#x22;.*aws:.*admin.*&#x22;. Below the search conditions is a histogram, followed by a results table."><figcaption></figcaption></figure>

When a search is run, a results table is displayed below a histogram visualizing the distribution of result events over time. The results table is customizable—you can [add or remove event fields](#adding-removing-and-reordering-fields-in-the-results-table) as columns. Also from the results table, you can [add inclusive/exclusive filters](#how-to-create-an-inclusive-or-exclusive-filter-expression-from-results) to your search, pivot, and [look up related enrichment data](#how-to-explore-enrichment-data-for-a-value-from-results). Your results set, as well as each result event, can be [summarized with AI](#ai-event-summaries-in-search).

You can [collaborate with your team](#sharing-a-search) by downloading the results table, or sharing a link to your specific search in Panther.

{% hint style="warning" %}
Search is only available to customers with a [Snowflake](/~/changes/2402/search/backend/snowflake.md) data lake. It is not available to Panther instances with an [Athena](/~/changes/2402/search/backend/athena.md) data lake.
{% endhint %}

## How to use Search

You can effectively search your data using:

* A combination of filters: Start by making selections in the [database, table, and date range filters](#using-database-table-and-date-range-filters)—then [create your own filter expressions](#creating-filter-expressions).
* PantherFlow: [Learn how to use PantherFlow in Search below](#using-pantherflow-in-search)

### Using database, table, and date range filters

Use the database, table, and date range filters to narrow the scope of your search. Using these controls is optional, but can significantly improve search performance when searching over large data sets. Learn more about each of these filters below.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F0YLVxy2bQuc87mUri8vt%2FScreenshot%202023-09-07%20at%202.54.27%20PM.png?alt=media&amp;token=bdb2de74-9bf6-48ea-9da3-0c9b8a7e7012" alt="The Search UI in Panther is shown. Three dropdowns in the upper-right corner are shown. The first has a selection of &#x22;Logs,&#x22; the second has a selection of &#x22;All tables,&#x22; and the third has a value of &#x22;Last 24 hours.&#x22;"><figcaption></figcaption></figure>

#### Database filter

Use the database filter to narrow your search to certain databases, such as only **Logs** or **Rule Matches**.&#x20;

The default value of this filter is **Logs**. The options contained in the database filter are:

* Rule Matches
* Logs
* Lookups
* Monitor
* Cloud Security
* Rule Errors
* Signals

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FanMShbwFdqYkhIlY1MZ1%2FScreenshot%202023-09-08%20at%203.45.32%20PM.png?alt=media&amp;token=fc4ab8b9-4aa0-485b-9e82-398594a1017f" alt="Three dropdown fields are shown. The first one is open, and the checkbox next to &#x22;Logs&#x22; is selected. The middle dropdown has a selection of &#x22;All tables&#x22; made, and the third has a selection of &#x22;Last 24 hours.&#x22;" width="375"><figcaption></figcaption></figure>

#### Table filter

Use the table filter to narrow your search to certain tables, within the databases indicated by the [database filter](#database-filter).

The default value of this filter is **All tables**, which includes all tables for each included database. You can narrow the search by selecting only certain tables in this dropdown.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F2buLB2QVjgTtQ5dADCZd%2FScreenshot%202023-09-08%20at%203.40.36%20PM.png?alt=media&amp;token=d38eb746-bf81-4dd9-94e2-21ceb498add4" alt="Three dropdowns are shown: in the first, &#x22;Monitor&#x22; is selected. the second one is open, and the checkbox next to &#x22;Classification Failures&#x22; is checked. In the third dropdown, &#x22;Last month&#x22; is selected." width="375"><figcaption></figcaption></figure>

#### Date range filter

Use the date range filter to narrow your search to a certain period of time.&#x20;

The default value of this filter is **Last 20 mins**. You can use one of the preset relative options (like **Last hour** or **Last week**), set your own relative window with **Relative time**, remove the time constraint with **All time**, or set a specific window with **Custom range**.

<div align="center"><figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FNWUl2dprcr24P0hL64Av%2FScreenshot%202025-01-15%20at%2011.32.40%E2%80%AFAM.png?alt=media&amp;token=1ef89de1-e1f2-4ce9-8201-6fdaadc26ba0" alt="A dropdown field with the selection &#x22;Last 20 mins&#x22; is shown. It is expanded and multiple options are shown, including &#x22;Last 3 months&#x22; and &#x22;All time&#x22;." width="258"><figcaption></figcaption></figure> <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FaCGJzqOvRDrM5Hnm985w%2FScreenshot%202025-01-15%20at%2011.37.28%E2%80%AFAM.png?alt=media&amp;token=2595a230-3ebc-45c1-b8c4-ceaa4e182cb0" alt="Two fields are shown: one is a numerical field with increase/decrease arrows, and the other is a dropdown with the value &#x22;mins&#x22; selected. At the bottom are &#x22;Cancel&#x22; and &#x22;Apply&#x22; buttons." width="375"><figcaption></figcaption></figure> <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F8JGJI4KRoJvDKxHXpYQE%2FScreenshot%202025-01-15%20at%2011.39.00%E2%80%AFAM.png?alt=media&amp;token=08250738-5f32-4e1c-86cf-64aa28c49a02" alt="A date and time picker is shown. On the left-hand side there are preset relative values, like &#x22;Last hour,&#x22; &#x22;Last 3 days,&#x22; etc. On the right-hand side is a calendar picker, as well as dropdown fields to select the time. At the bottom are &#x22;Cancel&#x22; and &#x22;Apply&#x22; buttons. " width="375"><figcaption></figcaption></figure></div>

### Creating filter expressions

A filter expression is a clause containing your [key/value search logic](#key-value-filter-expression), [free search terms](#free-text-filter-expression), or [match patterns](#regular-expression-regex-filter-expression). To create filter expressions, click the **Add search filter** bar or use the `command` + `/` keyboard shortcut.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FbLvy1vCukxPTDvRniluO%2FScreenshot%202023-10-23%20at%204.15.40%20PM.png?alt=media&amp;token=cd15410d-a51f-4f10-87bc-43a424a8f613" alt="The Search tool is shown. The search bar, which has placeholder text of &#x22;Add search filter,&#x22; is empty. It is circled."><figcaption></figcaption></figure>

#### Key/value filter expression

With a key/value filter expression, you will select an event key and provide a value (if necessary).

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fn1pbz3kp4k3ZgpYDhPiE%2Fimage.png?alt=media&amp;token=0af5bc22-bf45-466b-8b3b-12547faf3144" alt="In the Search bar is one filter expression. It reads &#x22;Emails has john.doe@email.com&#x22;"><figcaption></figcaption></figure>

To create a key/value filter expression:

1. Click the **Add search filter** bar, or press `command`+`/`.
2. Select an event key from the dropdown list. The dropdown menu contains options grouped into the following categories:
   * **Panther Fields**: Includes [Indicator Fields](/~/changes/2402/search/panther-fields.md#indicator-fields) (also known as `p_any` fields), and [Core Fields](/~/changes/2402/search/panther-fields.md#core-fields) (`p_udm` fields), which are useful when searching across log types.\
     ![In the Search bar, a dropdown shows "Panther Fields" including Actor IDs, AWS Account IDs, and AWS ARNs](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FzqpRG9FCDDkLpxZidqec%2FScreenshot%202023-09-07%20at%2012.59.31%20PM.png?alt=media\&token=d8477df0-8c89-4cb6-a42e-a65a3d64445c)
   * **Multiple tables:** Fields that are found in more than one log type.\
     ![In the Search bar, there is a dropdown showing "Multiple Tables" options, including apiVersion, kind, and level](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FGV0l640rFJNzeIKZAohB%2FScreenshot%202023-09-07%20at%2012.59.13%20PM.png?alt=media\&token=d8c52c5a-6536-4a28-8317-e2556e75b6d9)
   * All remaining tables with a matching field(s) are displayed in alphabetical order.&#x20;
3. Select an operator (also known as a condition) from the dropdown menu.
   * The dropdown options will be limited to those applicable to the selected field's data type.
   * See a full list of available operators on [Search Filter Operators](/~/changes/2402/search/search-tool/filter-operators.md).
4. Enter a value, if the selected operator requires one.
   * Learn more about using the [wildcard character below](#using-wildcards-in-filter-expressions).
5. If you would like to create another filter expression:
   * To create an `AND` filter, click outside the expression you just created (but within the same horizontal bar), or press `TAB`.&#x20;
   * To create an `OR` filter, click **+ Add OR Condition**.
6. When you are ready to execute your search, click **Search** or press `ENTER`.
   * If there are more than two rows, they will collapse. To expand all filters into view, click **Show +n conditions**.

{% hint style="info" %}
You can also quickly [create key/value filter expressions from the results set](#how-to-create-an-inclusive-or-exclusive-filter-expression-from-results) of an initial search.&#x20;
{% endhint %}

#### Free text filter expression

In a free text filter expression, you will enter a string.&#x20;

{% hint style="warning" %}
Free text filter expressions search every field in every event (within the database, table, and date constraints), including fields nested in complex objects. This could cause your search to take a long time to execute.

To improve search performance while using a free text filter expression, [select a subset of tables](#table-filter) to search.&#x20;
{% endhint %}

To create a free text filter expression:

1. Click the **Add search filter** bar, or press `command`+`/`.
2. Enter the text value.
   * Learn more about using the [wildcard character below](#using-wildcards-in-filter-expressions).
3. If you would like to create another filter expression:
   * To create an `AND` filter, click outside the expression you just created (but within the same horizontal bar), or press `TAB`.&#x20;
   * To create an `OR` filter, click **+ Add OR Condition**.
4. When you are ready to execute your search, click **Search** or press `ENTER`.
   * If there are more than two rows, they will collapse. To expand all filters into view, click **Show +n conditions**.

#### Regular expression (regex) filter expression

Using regex in Search can be powerful for dynamic text-based searches across logs. Search supports [POSIX-extended regular expressions](https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap09.html#tag_09_04).&#x20;

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fw0K0OotOea4wTDjzuRrQ%2Fimage.png?alt=media&amp;token=fa185219-f6f6-432d-bfed-6b79db92e180" alt="A single filter expression is created in the Search bar. It reads &#x22;.*aws:.*admin.*&#x22;"><figcaption></figcaption></figure>

To create a regex filter expression:

1. Click the **Add search filter** bar, or press `command`+`/`.
2. Press `command`+`/` to enter into regex mode.&#x20;
   * To exit regex mode, you can press `command`+`/` again.
3. Enter the regular expression you wish to search, e.g., `.*aws:.*admin.*`.
   * Learn more about using the [wildcard character below](#using-wildcards-in-filter-expressions).
4. If you would like to create another filter expression:
   * To create an `AND` filter, click outside the expression you just created (but within the same horizontal bar), or press `TAB`.&#x20;
   * To create an `OR` filter, click **+ Add OR Condition**.
5. When you are ready to execute your search, click **Search** or press `ENTER`.
   * If there are more than two rows, they will collapse. To expand all filters into view, click **Show +n conditions**.

### Using wildcards in filter expressions

The wildcard character (`*`) may be used as a placeholder at the beginning, middle, or end of a string or expression. The wildcard character may be used within a [key/value filter expression](#key-value-filter-expression) (only where the key has `type: string` and the operator is `LIKE`), [free text filter expression](#free-text-filter-expression), or [regex filter expression](#regular-expression-regex-filter-expression).&#x20;

The position of the wildcard character determines which data is returned as a match:

* Beginning: Any character(s) at or preceding the `*` are considered a match.
* Middle: Any character(s) at the `*` are considered a match.
* End: Any character(s) at or following the `*` are considered a match.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FwdacsGzDOg7R1n89Dd2s%2FSearch_wildcards_section.png?alt=media&amp;token=c180686c-a2af-4303-8496-3a08a1efc71e" alt="In the Search page in Panther are three conditions: &#x22;Log Type is not Windows.EventLogs&#x22;, &#x22;Log Type like AWS*Flow&#x22;, and &#x22;ACCE*&#x22;. Below is a histogram, followed by a results table."><figcaption></figcaption></figure>

### Searching Indicators of Compromise

{% hint style="warning" %}
This functionality is not available when searching with [PantherFlow](/~/changes/2402/pantherflow.md).
{% endhint %}

When responding to a public breach disclosure or threat hunting generally, you may need to quickly find out whether any values in a list of Indicators of Compromise (IoCs) are found across any of your organization's event logs.

To search IoCs in Search:&#x20;

1. Make [database, table, and date range filter](#using-database-table-and-date-range-filters) selections.
2. Click the **Add search filter** bar, or press `command`+`/`.
3. Type or paste in the indicator or list of indicators.&#x20;
4. From the dropdown options that appear, select the **(auto-detect)** option.
   * Search parses the inputted string where there are spaces, commas, and semicolons—then detects whether each value matches a [Panther Indictor Field](/~/changes/2402/search/panther-fields.md#indicator-fields). For each detected indicator field, Search creates a [key/value filter expression](#key-value-filter-expression). Other values remain as [free text expressions](#free-text-filter-expression).&#x20;
   * Each filter expression is joined by an `OR`.&#x20;
5. Click **Search** or press `ENTER`.

#### Video walkthrough

{% embed url="<https://www.youtube.com/watch?v=Tr0LpLvOhXg>" %}

### Using PantherFlow in Search

{% hint style="info" %}
PantherFlow is in open beta starting with Panther version 1.110, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
{% endhint %}

To execute a [PantherFlow](/~/changes/2402/pantherflow.md) query in Search:

1. In the left-hand navigation bar of your Panther Console, click **Investigate** > **Search**.
2. On the left side of the [database filter](#database-filter), click **\</>** to toggle to PantherFlow mode.\
   ![A toggle with a magnifying glass icon and "\</>" is hovered over, and its tooltip reads, "PantherFlow mode."](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FRsuzYyyEBWPrLd1jbXcO%2Fimage.png?alt=media\&token=0f35de15-e5e8-4ebe-83ce-c4ce40295458)
   * This will replace the filter expression builder with a PantherFlow code editor.
3. Enter your PantherFlow query.

   <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p>If your PantherFlow query specifies a database/table, the <a href="/~/changes/2402/search/search-tool.md#using-database-table-and-date-range-filters">database, table, and date range filters</a> in the upper-right corner of the Search page are ignored. </p><p>If your PantherFlow query does not specify a database/table, the database, table, and date range filters are all applied. In this scenario, if your PantherFlow query includes a date/time range (with a <code>| where p_event_time ...</code> statement), both date/time ranges are applied—i.e., returned data must fall within the date/time range set in both the date range filter <em>and</em> the range defined by the <code>| where p_event_time ...</code> statement.</p><p><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FxGBqXyTA65lNK3VV57t5%2Fimage.png?alt=media&amp;token=6efa2ab3-b271-4b58-aaec-8fe1b5f7506c" alt="To the right of a &#x22;Search&#x22; header, three dropdown fields are circled. Their chosen values are &#x22;Logs,&#x22; &#x22;All tables,&#x22; and &#x22;Last 20 mins.&#x22;"></p></div>

   * Learn how to construct a PantherFlow query in [the PantherFlow documentation](/~/changes/2402/pantherflow.md).
   * Note the current [limitations of PantherFlow](/~/changes/2402/pantherflow.md#limitations-of-pantherflow).
4. Click **Search**.

### Creating a Saved Search

{% hint style="warning" %}
While it's possible to create a Saved Search in Search, it's not possible to schedule it (i.e., to create a [Scheduled Search](/~/changes/2402/search/scheduled-searches.md)).
{% endhint %}

Creating a Saved Search means you can quickly reuse commonly run searches. Learn more on [Saved and Scheduled Searches](/~/changes/2402/search/scheduled-searches.md).

To create a Saved Search:

1. Create a search by following the instructions in [How to use Search](#how-to-use-search).
2. Under the **Add search filter** box, click **Save As**.

   <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FxcaUYnytZCIYQWhYvckf%2FScreenshot%202023-09-08%20at%204.00.47%20PM.png?alt=media&amp;token=3281f155-4b01-4be7-95c8-a61d9c3673fc" alt="The Search UI is shown, with one filter expression created (&#x22;kind is http&#x22;). Below the search bar, the &#x22;Save As&#x22; text is circled." width="563"><figcaption></figcaption></figure>
3. Enter values for the fields in the popup modal:
   * **Search Name**: Add a descriptive name.
   * **Tags** (optional): Add tags. Tags can be helpful to group related searches.
   * **Description** (optional): Describe the purpose of the search.
4. Click **Save Search**.
   * See the next section to learn how to open and reuse Saved Searches.

### Open and reuse a Saved Search in the Search tool

After creating a Saved Search in the Search tool, you can view and reuse it. It can be opened from the Search page, or from the Saved Searches page.

{% tabs %}
{% tab title="Search page" %}

#### Open a Saved Search from the Search page:

1. In the left-hand navigation bar of your Panther Console, click **Investigate** > **Search**.
2. In the upper right corner, click the three dots icon, then **Open Saved Search**.
   * An **Open a Search** modal will pop up, displaying previously saved search.
3. Find the search you'd like to open, select it, then click **Open Search**.
   * The Saved Search will populate in Search.
     {% endtab %}

{% tab title="Saved Searches page" %}

#### Open a Saved Search from the Saved Searches page:

1. In the left-hand navigation bar of your Panther Console, click **Investigate** > **Saved Searches**.
2. Find the search you'd like to open, utilizing the search bar and **Filters** at the top, if necessary.
3. In the top right corner of the search's tile, click the three dots icon.
4. Click **View in Search**.
   * You will be redirected to Search, where the Saved Search will populate.
     {% endtab %}
     {% endtabs %}

## Analyzing Search results

The results of a Search contain a [histogram](#search-results-histogram), a [table of result events](#adding-removing-and-reordering-fields-in-the-results-table), and [summary visualizations](#search-results-summary-charts).

### Search results histogram

The results histogram displays the distribution of events within the search's date and time window, to help quickly contextualize results.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FihDQi4iCMiXxzkVbdX1z%2Fimage.png?alt=media&amp;token=fb68c6d7-2e80-4451-a42a-0d773fd99147" alt="A histogram is shown, depicting a number of bars spanning from JUN 05 20:08 to JUN 05 21:03."><figcaption></figcaption></figure>

After a search is run, the histogram is shown collapsed by default. You can expand it by clicking the diagonal arrows button in the upper-right corner of the chart. Clicking the button again will collapse the chart.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FDxRQd88wTWF1Dm0cMCGa%2Fsearchhistogram.png?alt=media&amp;token=fa8574a7-535b-4b20-ac47-95be3458ed15" alt="A histogram is shown. A double-sided arrow button in the upper-right corner, with the tooltip &#x22;Expand,&#x22; is circled."><figcaption></figcaption></figure>

#### Interacting with the histogram

To see additional data insights into the counts by log type for any of the time periods, hover over a bar within the chart.

![A rectangle has the text, "Wednesday 05 June 2024, 15:00 (UTC)." Then, below, "AWS.CloudTrail" and "Panther.Audit."](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F1glMKOYUVLbOwHUbFU1I%2Fimage.png?alt=media\&token=d5fd7ac5-6b87-4633-b8ca-f246e87e8761)

To drill down and create a new search (in a new browser tab) with a time period set to that of one of the histogram bars, click the bar.

{% hint style="info" %}
This drill down functionality is only available for bars in the table that represent timeframes longer than one minute.
{% endhint %}

### Adding, removing, and reordering fields in the results table

You can customize a search's results table by [adding](#how-to-add-a-column-in-the-search-results-table), [removing](#how-to-remove-a-column-in-the-search-results-table), and [reordering](#how-to-reorder-columns-in-the-search-results-table) columns.

You can also [create a new filter directly from the results table](#how-to-create-an-inclusive-or-exclusive-filter-expression-from-results), [replace filter expressions with a results table value](#how-to-replace-filter-expressions-with-a-value-from-results), and [explore enrichment data for a results table value](#how-to-explore-enrichment-data-for-a-value-from-results).

#### How to add a column in the Search results table

You can add a column to the Search results table using the [**Available Fields** list](#add-a-column-to-the-search-results-table-from-the-available-fields-list) on the left-hand side of the table, or from the [JSON event view](#add-a-column-to-the-search-results-table-from-the-json-event-view).&#x20;

It is only possible to add *nested* fields to the table from the [JSON event view](#add-a-column-to-the-search-results-table-from-the-json-event-view).

{% tabs %}
{% tab title="Available Fields list" %}

#### Add a column to the Search results table from the Available Fields list

1. In the field list on the left-hand side of the results table, within the **Available Fields** header, locate the column you'd like to add to the results table.

   <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F526U0zgpEtAEObtfgwnK%2Fimage.png?alt=media&amp;token=c6e57bfa-0f1f-445e-b6c2-4cc737b45cd8" alt="A list of event fields is displayed underneath an &#x22;Available Fields&#x22; header." width="167"><figcaption></figcaption></figure>

   * Only top-level fields are shown in this list. If you'd like to add a nested field to the table, you can do so from the [JSON event view](#add-a-column-to-the-search-results-table-from-the-json-event-view).
2. To the right of the field, click **+** (the plus symbol).
   * The field will be added as a column in the results table, and listed on the left-hand side of the table within **Selected Fields**.
     {% endtab %}

{% tab title="JSON event view" %}

#### Add a column to the Search results table from the JSON event view

1. In the results table, click on a row to open the JSON event view slide-out panel.
2. Locate the field you'd like to add to the results table.
3. While hovering over the field, click **+** (the plus symbol).\
   ![The JSON event view of a log is shown. To the right of one field, the plus button is circled.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F8qdOEb7BQbZzDSSTgYsS%2FScreenshot%202023-09-12%20at%203.15.23%20PM.png?alt=media\&token=b47686c7-fdb2-40dc-a5ef-7cea75047b34)
   * The field will be added as a column in the results table, and listed on the left-hand side of the table within **Selected Fields**.
     {% endtab %}
     {% endtabs %}

#### How to remove a column in the Search results table

You can remove a column from the Search results table using the [**Selected Fields** list](#remove-a-column-from-the-search-results-table-from-the-selected-fields-list) on the left-hand side of the table, from the [JSON event view](#remove-a-column-from-the-search-results-table-from-the-json-event-view), or from the [table header row](#remove-a-column-from-the-search-results-table-from-the-header-row).

{% tabs %}
{% tab title="Selected Fields list" %}

#### Remove a column from the Search results table from the Selected Fields list

1. In the field list on the left-hand side of the results table, within the **Selected Fields** header, locate the field you'd like to remove from the results table.
2. To the right of the field, click **-** (the minus symbol).

   ![Under the "Selected Fields" header, there are log fields. To the right of "PantherAudit.actionName" the minus button is hovered over. Its tooltip reads, "Remove column"](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FCcUyt8lxRtbxZKETvRkd%2Fimage.png?alt=media\&token=2eff01b4-748b-4276-9d6e-ba81d5f7e85d)

   * The field's column will be removed from the results table, and listed on the left-hand side of the table within **Available Fields**.
     {% endtab %}

{% tab title="JSON event view" %}

#### Remove a column from the Search results table from the JSON event view

1. In the results table, click on a row to open the JSON event view slide-out panel.
2. Locate the field you'd like to remove from the results table.
3. While hovering over the field, click **-** (the minus symbol).\
   ![The JSON event view of a log is shown. To the right of one field, the minus button is circled.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FceiAs8wlkECLii71yBhv%2FScreenshot%202023-09-12%20at%203.45.23%20PM.png?alt=media\&token=36c75c5d-2521-4edc-9ffb-598a0fc1e73a)<br>
   * The field's column will be removed from the results table, and listed on the left-hand side of the table within **Available Fields**.
     {% endtab %}

{% tab title="Table header row" %}

#### Remove a column from the Search results table from the header row

1. In the results table, hover over the header of the column you'd like to remove.
2. On the right side of the column header, click **X**. \
   ![A header reading "GitHubAudit.config.content\_type" is shown, and the "X" to its right is circled.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FhcDEdqz8qePnauLXmErh%2FScreenshot%202023-09-12%20at%203.48.26%20PM.png?alt=media\&token=3d1f9900-78e7-4af3-aed5-c3c6295b3ca6)
   * The field's column will be removed from the results table, and listed on the left-hand side of the table within **Available Fields**.
     {% endtab %}
     {% endtabs %}

#### How to reorder columns in the Search results table

* Reorder the columns in the results table by clicking on a column header and dragging it to the desired position.&#x20;

### Viewing full result events

The results table is loaded, by default, in a compact view. This view displays all log fields, including the often sizable `EVENT` field, in a single row. To view the `EVENT` value in this view, scroll horizontally.

To more easily view the full event data, you can use [detailed table view](#detailed-results-table-view) or the [JSON event slide-out panel](#json-event-slide-out-panel). An added benefit of using the slide-out panel is the ability to show or hide [Panther fields](/~/changes/2402/search/panther-fields.md).

#### Detailed results table view&#x20;

The results table can alternatively display logs in a detailed view. This view displays the `EVENT` field value in a new row below the event's other fields, with text-wrapping.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fw6KR7r5uLLOLpKHQGil2%2Fimage.png?alt=media&amp;token=d322c68f-aa08-46f1-ae8e-0bdb17b9da45" alt="A tooltip of a button below a histogram (and at the top of the results table) reads &#x22;Detailed view.&#x22; A full event in the results table has been circled."><figcaption></figcaption></figure>

To enable detailed view, click the toggle button in the upper-right corner of the table:

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FJfEpTp59sKTft2gfVDvx%2FcompactViewToggle.webp?alt=media&amp;token=26803dee-b51a-46e7-ace8-37638f2427f9" alt="Below a histogram (and at the top of the results table), a button&#x27;s tooltip reads, &#x22;Compact view.&#x22;"><figcaption></figcaption></figure>

#### JSON event slide-out panel

It's possible to view the full event data, in JSON format, by clicking an event row. This will open a slide-out panel on the right side of the browser window.

In the JSON event view, [Panther fields](/~/changes/2402/search/panther-fields.md) are displayed at the top of the JSON object followed by the event fields. You can hide or reveal these fields by clicking the **Show Panther fields** toggle.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F5hk1dp0LVAjsD78jFX2j%2Fimage.png?alt=media&amp;token=2ef7fec6-05b9-422e-b4f3-bc59a3d37b6a" alt="In Search, the event JSON slide-out panel is shown. Above the event JSON, a &#x22;Show Panther fields&#x22; toggle, set to ON, is circled."><figcaption></figcaption></figure>

Hovering over fields in the slide-out panel will display icons with which you can perform additional actions, like adding a filter. Learn more in [Iterating on a Search](#iterating-on-a-search).

### Search results summary charts&#x20;

Within the results of a Search, the **Visualizations** tab displays bar charts for field values, which can help provide quick insights into your data. To view these charts, click **Visualizations**.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FuPUL6th6wa6XugqY8EJo%2Fviz.webp?alt=media&amp;token=c812dc6e-bec8-41f2-85ba-86c6aa42ca67" alt="A &#x22;Visualizations&#x22; tab is circled. Two bar charts are shown, titled &#x22;Log Type&#x22; and &#x22;Destination Bytes.&#x22;"><figcaption></figcaption></figure>

You can also [create a filter directly from a summary chart](#how-to-create-an-inclusive-or-exclusive-filter-expression-from-results), [replace filters with a value from a summary chart](#how-to-replace-filter-expressions-with-a-value-from-results), and [explore enrichment data for a summary chart value](#how-to-explore-enrichment-data-for-a-value-from-results).&#x20;

**How to add or remove summary charts**&#x20;

Add or remove visualizations for event fields using the **Available Fields** and **Selected Fields** lists on the left-hand side of the results panel. Adding or removing a field shows or hides the field both as a chart and as a column in the results table.

To add a visualization:

* Within the **Available Fields** list, to the right of a field's name, click **+**.

  <div align="left"><figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FycQgph9vv1dWoLLoBBhp%2Fimage.png?alt=media&amp;token=89138c00-444f-4562-a219-4f1da02ca220" alt="Under an &#x22;Available Fields&#x22; header is a &#x22;Panther Fields&#x22; header, then a field called &#x22;Destination ARNs.&#x22; To its right is a plus sign that&#x27;s been hovered over; its tooltip reads &#x22;Add as column.&#x22;" width="324"><figcaption></figcaption></figure></div>

To remove a visualization:

* Within the **Selected Fields** list, to the right of a field's name, click **–**.

  <div align="left"><figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FX7SPuuBMXX1heI5khdPA%2Fimage.png?alt=media&amp;token=26ff3dca-e5ec-4851-b4d7-4c7f6d418c82" alt="Under a &#x22;Selected Fields&#x22; header are three fields: &#x22;Log Type,&#x22; &#x22;Destination Bytes,&#x22; and &#x22;Destination IP.&#x22; To their right is a minus sign, one has been hovered over; its tooltip reads &#x22;Remove column.&#x22;" width="325"><figcaption></figcaption></figure></div>

**How to set the sort order of a chart**

To sort results in ascending order (lowest to highest):

* In the upper-right corner of a visualization, click the icon with an arrow pointing downward:

  <div align="left"><figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FtwLC6TYpUVu4QtCZaiif%2Fimage.png?alt=media&amp;token=f54f05b1-48ef-41a8-9f83-6c360ac2cb42" alt="An icon with an arrow pointing downward has been hovered over, its tooltip reads, &#x22;Sort Ascending&#x22;" width="112"><figcaption></figcaption></figure></div>

To sort results in descending order (highest to lowest):

* In the upper-right corner of a visualization, click the icon with an arrow pointing upward:

  <div align="left"><figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FoGOz7u0kIYz5wIdE27cv%2Fimage.png?alt=media&amp;token=f6de9f47-b82c-4a46-9be6-c53b7c882682" alt="An icon with an arrow pointing downward has been hovered over, its tooltip reads, &#x22;Sort Descending&#x22;" width="123"><figcaption></figcaption></figure></div>

**How to expand or condense the number of values shown in a chart**

* To view the first 25 values in a visualization, in its lower-right corner, click **Show Top 25**. If there are fewer than 25 values available, the text will read **Show all \<number> rows** instead. To view only the first five values in a visualization, in its lower-right corner, click **Hide additional rows**.

### AI event summaries in Search

{% hint style="info" %}
Panther AI is in open beta starting with Panther version 1.112, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
{% endhint %}

{% hint style="info" %}
Use of Panther AI features is subject to the [AI disclaimer found on the Legal page](/~/changes/2402/resources/help/legal.md#ai-disclaimer).
{% endhint %}

After running a search that generates results, you can view an AI-generated summary for multiple result events, as well as each individual result event.&#x20;

AI event summaries are likely to describe the action(s) the log(s) represent, which may include identifying actors, naming resources accessed, making an evaluation of the security risk posed, connecting actions to MITRE ATT\&CK tactics, and more.

You can control AI response length by configuring the [AI prompt settings](/~/changes/2402/ai.md#ai-prompt-settings).

It's also possible to [view AI event summaries in alerts](/~/changes/2402/alerts.md#using-ai-alert-list-and-alert-event-summaries).

#### Results table AI summary

To view an AI-generated summary for the events visible in the results table:

* After running a search, in the upper-right corner of the results table, click **Summarize with AI**.<br>

  <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F7cNttvVjc77FDYiK7AYc%2Fimage.png?alt=media&amp;token=514a1b89-48a0-4064-b3b2-abac538e1fe8" alt="Under a &#x22;Search&#x22; page header are various search fields, including three dropdowns and an input for filter chips. Below, at the top of the results table, a &#x22;Summarize with AI&#x22; button is circled."><figcaption></figcaption></figure>

  * In the **AI Summary** slide-out panel, see the summary below the `EVENT SUMMARY FOR LATEST N SEARCH EVENTS` header.
    * The events summarized are the events loaded into view in the results table, which by default is 25 events. If you scroll to the end of the results table and load more events, then click **Summarize with AI**, a higher number of events will be summarized.
  * In the text box below the `EVENT SUMMARY FOR LATEST N SEARCH EVENTS` header, you can ask questions about the data or refine the prompt.

#### Single-event AI summary

To view the AI summary for a single event:&#x20;

* After running a search, within the results table, click an event row.&#x20;
  * In the slide-out panel, see the `EVENT SUMMARY` section.
  * In the text box below the `EVENT SUMMARY` header, you can ask questions about the data or refine the prompt.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FZcYrrA5FVHb7GBpsTDOj%2FScreenshot%202024-05-15%20at%204.02.16%20PM.png?alt=media&amp;token=d66de3de-d7c2-41d0-b789-c84bd0cc0d36" alt="The Search page in the Panther Console is shown, and a slide-out panel is visible. A section titled &#x22;Event Summary&#x22; is circled."><figcaption></figcaption></figure>

## Iterating on a Search

Directly from the JSON event slide-out panel and summary charts, you can [create inclusive/exclusive filters](#how-to-create-an-inclusive-or-exclusive-filter-expression-from-results), [replace filter expressions with a results value](#how-to-replace-filter-expressions-with-a-value-from-results), and [explore enrichment data](#how-to-explore-enrichment-data-for-a-value-from-results).

### How to create an inclusive or exclusive filter expression from results

{% tabs %}
{% tab title="Slide-out panel" %}

#### How to create a filter expression from the JSON event slide-out panel

1. In the results table, locate the event row of interest, and click it.
   * The JSON event slide-out panel will be shown.
2. In the JSON event slide-out panel, hover over the value you'd like to create an inclusive or exclusive filter expression for.\
   ![In the JSON event slide out panel, a field has been hovered over, and the tooltip of a button that has appeared reads, "Filter by value."](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FBOrPKP6bAEo3ITQ159lh%2Fimage.png?alt=media\&token=66806467-56ae-4267-ace7-fa1528976fdd)
   * To create an inclusive filter, click <img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F88zggGTcgZELMeFX5Arj%2FScreenshot%202023-11-15%20at%2010.39.34%20AM.png?alt=media&amp;token=2b17a266-b193-43ac-b0c1-f8f90bcec2ac" alt="A filter icon with a plus sign." data-size="line">.
   * To create an exclusive filter, click <img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FPymqGfMEjdC4mrVuO0W3%2FScreenshot%202023-11-15%20at%2010.39.49%20AM.png?alt=media&amp;token=b05895bd-e74f-4932-8c5f-2c80a8ee9d62" alt="A filter icon with a minus sign." data-size="line">.
3. View the new filter expression in the search bar at the top of the window.
4. To refresh the search results, click **Search**.
   {% endtab %}

{% tab title="Results summary chart" %}

#### How to create a filter expression from a summary chart

* Within a summary chart, hover over a row value.<br>

  <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FMEzXEpnoUS3Zu4WEIrfZ%2Fimage.png?alt=media&amp;token=73ff9624-9d35-411b-8f89-5b9f21c76d6a" alt="Next to an IP address are two filter icons. One has a tooltip reading &#x22;Filter out value&#x22;"><figcaption></figcaption></figure>

  * To create an inclusive filter, click <img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F88zggGTcgZELMeFX5Arj%2FScreenshot%202023-11-15%20at%2010.39.34%20AM.png?alt=media&amp;token=2b17a266-b193-43ac-b0c1-f8f90bcec2ac" alt="A filter icon with a plus sign." data-size="line">.
  * To create an exclusive filter, click <img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FPymqGfMEjdC4mrVuO0W3%2FScreenshot%202023-11-15%20at%2010.39.49%20AM.png?alt=media&amp;token=b05895bd-e74f-4932-8c5f-2c80a8ee9d62" alt="A filter icon with a minus sign." data-size="line">.
    {% endtab %}
    {% endtabs %}

### How to replace filter expressions with a value from results

{% tabs %}
{% tab title="Slide-out panel" %}

#### How to replace filter expressions with a value from the results table

1. In the results table, locate the event row of interest, and click it.
   * The JSON event slide-out panel will be shown.
2. In the JSON event slide-out panel, hover over the field on which you'd like to pivot.

   ![In the JSON event slide out panel, a field has been hovered over, and the tooltip of a button that has appeared reads, "Replace filters with value."](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FUPxNSckxYvFQ0QlBxy4s%2Fimage.png?alt=media\&token=4086c375-3c8d-4be9-a8b1-dbbb33b75c4b)
3. Click the replace icon <img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FORiW3pbnv7QdbMWz5nQF%2FScreenshot%202023-11-15%20at%2010.53.16%20AM.png?alt=media&amp;token=0dd75218-3479-40ba-8be4-a14f5c500e60" alt="A magnifying glass icon" data-size="line">.
   * All existing filters are replaced with a filter expression representing only the key/value you pivoted on.
4. To refresh the search results, click **Search**.
   {% endtab %}

{% tab title="Results summary chart" %}

#### How to replace filter expressions with a value from summary charts

1. Within a summary chart, hover over the value you would like to replace filter expression values with.\
   ![The Summary tab shows a chart for Log Type. Panther.Audit has been hovered over, and several icons are visible, including a magnifying glass.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FryNu5ZeeAsAhk4lW2fsW%2FScreenshot%202024-01-22%20at%203.34.13%20PM.png?alt=media\&token=2e67342a-5fe1-46a3-8983-c30c37e1bac9)
2. Click the replace icon <img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FORiW3pbnv7QdbMWz5nQF%2FScreenshot%202023-11-15%20at%2010.53.16%20AM.png?alt=media&amp;token=0dd75218-3479-40ba-8be4-a14f5c500e60" alt="A magnifying glass icon" data-size="line">.
   * All existing filters are replaced with a filter expression representing only the key/value you pivoted on.
3. To refresh the search results, click **Search**.
   {% endtab %}
   {% endtabs %}

### How to explore enrichment data for a value from results

{% tabs %}
{% tab title="Slide-out panel" %}

#### How to explore enrichment data for a value from the JSON event slide-out panel

1. In the results table, locate the event row of interest, and click it.
   * The JSON event slide-out panel will be shown.
2. In the JSON event slide-out panel, hover over the value you'd like to explore [enrichment data](/~/changes/2402/enrichment.md) for.\
   ![The p\_any\_ip\_addresses field is shown, and next two one of its values is a series of icons. The table icon is hovered over.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F3JySaR8H4hzCFnGpPawE%2FScreenshot%202024-01-22%20at%203.54.15%20PM.png?alt=media\&token=2b2d1835-694c-467b-b22e-f6e1256a5b02)
3. Click the enrichment icon <img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FPWLo6hdviKCI1guGBbdp%2FScreenshot%202024-01-22%20at%203.57.55%20PM.png?alt=media&amp;token=a9269107-9478-468d-a32a-41e95e198fe1" alt="A small database table icon" data-size="line">.
4. In the **Lookup Enrichment** pop-up modal, use the **`LOOKUP TABLE`** column to locate the row of the enrichment source you would like to explore, then click **`View JSON→`**.\
   ![The Lookup Enrichment modal has two rows, with differing Lookup Table values. The first row's "View JSON" button is circled.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FKH4D7pSwDs3s3dCqhZ85%2FScreenshot%202024-01-22%20at%204.35.33%20PM.png?alt=media\&token=b38e3983-fc24-4744-b248-21a75ea19b5a)
   * The enrichment entry will be shown.\
     ![The Lookup Enrichment modal shows an ipinfo\_asn entry in JSON.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fv6WmR1YnJrssRqlfeFIy%2FScreenshot%202024-01-22%20at%204.37.08%20PM.png?alt=media\&token=139368ca-be91-4fba-a1df-2f235c5b730f)
     {% endtab %}

{% tab title="Results summary chart" %}

#### How to explore enrichment data for a value from a summary chart

1. Within a summary chart, hover over a value for which you would like to explore [enrichment data](/~/changes/2402/enrichment.md).\
   ![A summary chart for the IP Addresses field is shown, and next two one of its values is a series of icons. The table icon is hovered over.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FOFVzS4zCGyGmQRQOlgC7%2FScreenshot%202024-01-22%20at%203.59.47%20PM.png?alt=media\&token=e02195df-0013-46ef-87d0-245c1711239a)
2. Click the enrichment icon <img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FPWLo6hdviKCI1guGBbdp%2FScreenshot%202024-01-22%20at%203.57.55%20PM.png?alt=media&amp;token=a9269107-9478-468d-a32a-41e95e198fe1" alt="A small database table icon" data-size="line">.
3. In the **Lookup Enrichment** pop-up modal, use the **`LOOKUP TABLE`** column to locate the row of the enrichment source you would like to explore, then click **`View JSON→`**.\
   ![The Lookup Enrichment modal has two rows, with differing Lookup Table values. The first row's "View JSON" button is circled.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FKH4D7pSwDs3s3dCqhZ85%2FScreenshot%202024-01-22%20at%204.35.33%20PM.png?alt=media\&token=b38e3983-fc24-4744-b248-21a75ea19b5a)
   * The enrichment entry will be shown.\
     ![The Lookup Enrichment modal shows an ipinfo\_asn entry in JSON.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fv6WmR1YnJrssRqlfeFIy%2FScreenshot%202024-01-22%20at%204.37.08%20PM.png?alt=media\&token=139368ca-be91-4fba-a1df-2f235c5b730f)
     {% endtab %}
     {% endtabs %}

## Sharing a Search

While investigating or threat hunting, it may be useful to share a Search or a results set with your team. To do this:

1. In the upper-right corner of the results table, click **Share**:

   <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FPROCHO1E8ZHCu89KOVar%2Fimage.png?alt=media&amp;token=f6421e4c-5bf1-4019-aed4-873adb92b1c5" alt="The results table is shown. In the upper-right corner, the Share button&#x27;s menu is open, displaying two options: Copy link to view and Download CSV. This button and its options are circled."><figcaption></figcaption></figure>
2. Select one of the menu options:
   * **Copy link to view**: Copies a URL to this specific Search to your clipboard.
   * **Download CSV**: Downloads a CSV of the results table.
     * Note that the downloaded CSV file contains only the first 1,000 results. To download the full results set, use [Data Explorer](/~/changes/2402/search/data-explorer.md). (You can click **Copy as SQL** in Search to quickly recreate it in Data Explorer.)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.panther.com/~/changes/2402/search/search-tool.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
