This topic describes how to search for entities on the Users > Entities page by entering a search pattern and display the search results in order of relevance.

To search for an Entity

  1. Log in to NetWitness Platform and click Users.

    The Overview tab is displayed.

  2. Click the Entities tab

  3. On the Search bar, enter the entity name to be searched.

Supported search for an Entity

NetWitness UEBA allows you to use several different characters while searching for the entity:

  • It supports the following characters such as Numbers (0-9), Underscores (_), and periods (. ).

  • Searching for entities supports both uppercase (A-Z) and lowercase (a-z) letters, for example, “charlie” and “Charlie” and “CHARLIE“.

  • If you search for "Jasmine" as the entity name for “Jasmine King”, a list of all the names that include the word "Jasmine" will be displayed.

    12_3_search_jasmine.png

  • When you look up the name "Jasmine King" in the search, the results will show all the names that contain both "Jasmine" and "King," which will include "Jasmine King" as well.

    12_3_Search_King.png

  • When you use substrings to search for an entity name, such as "yan," the list will show names that include those substrings, like "Charlie Ryan or Ryan Williams".

    12_3_Search_Ryan.png

Unsupported search for an Entity

  • Following special characters are supported:

    • Semicolon {;}

    • Colon {:}

    • Close parenthesis {)}

    • Close bracket {]}

    • at sign {@}

    • forward slash {/}

    • Back slash {/}

    For example, if you looking for an entity email address, you can enter the "first name" and "last name" to fetch the email address.

    12_3_search_rsa.png

  • Entities that end with a period (.) are not supported.

    12_3_Search_WilliamT.png