{%- extends "_layout_help.html" %} {%- block contenthelp %}

{{ _('This view provides access to the IDEA event database. It enables users to create complex database queries and browse the result in the form of a table.') | safe }}

{{ _('IDEA events are messages generated by various detectors upon encountering some computer network or system related security event or incident.') | safe }}

{{ macros_form.render_help_idea_reference() }}

{{ _('Event search form') }}

{{ _('Event search form is designed to be as exhaustive as possible. There is a parameter for each event attribute that is indexed and searchable within the database. As a result full search form is quite large. To conserve space there is a button bar at the top of the form that can toggle visibility of various form sections only when they are needed. Note, that some of the form toggle sections are mutually exclusive. For example you may not search according to both detection and storage times.') }}

{{ _('Following is a list of all available search form parameters:') }}

{{ _('Time related query parameters') }}

{%- for form_field_name in ['dt_from', 'dt_to', 'st_from', 'st_to'] %} {%- set form_field = search_form|attr(form_field_name) %} {{ render_help_dlitem(form_field, form_field_name) }} {%- endfor %}
{{ macros_form.render_help_datetime() }}

{{ _('Origin related query parameters') }}

{%- for form_field_name in ['source_addrs', 'source_ports', 'source_types', 'target_addrs', 'target_ports', 'target_types', 'host_addrs', 'host_ports', 'host_types'] %} {%- set form_field = search_form|attr(form_field_name) %} {{ render_help_dlitem(form_field, form_field_name) }} {%- endfor %}

{{ _('Event related query parameters') }}

{%- for form_field_name in ['groups', 'not_groups', 'protocols', 'not_protocols', 'description', 'categories', 'not_categories', 'severities', 'not_severities'] %} {%- set form_field = search_form|attr(form_field_name) %} {{ render_help_dlitem(form_field, form_field_name) }} {%- endfor %}

{{ _('Detector related query parameters') }}

{%- for form_field_name in ['detectors', 'not_detectors', 'detector_types', 'not_detector_types'] %} {%- set form_field = search_form|attr(form_field_name) %} {{ render_help_dlitem(form_field, form_field_name) }} {%- endfor %}

{{ _('Special query parameters') }}

{%- for form_field_name in ['inspection_errs', 'not_inspection_errs', 'classes', 'not_classess'] %} {%- set form_field = search_form|attr(form_field_name) %} {{ render_help_dlitem(form_field, form_field_name) }} {%- endfor %}

{{ _('Common query parameters') }}

{%- for form_field_name in ['page', 'limit', 'sortby', 'submit'] %} {%- set form_field = search_form|attr(form_field_name) %} {{ render_help_dlitem(form_field, form_field_name) }} {%- endfor %}
{%- endblock contenthelp %}