We are happy to announce the addition of new filters for event search queries in Wallarm. Now you can easily search for malicious requests that have been detected based on specific criteria:

• Search by Wallarm node UUID: You can search for malicious requests detected by a particular Wallarm node using the ‘node_uuid:’ prefix followed by the UUID of the desired node. Using this filter is valuable when you need to validate the protection status for every node within a cluster. You can include multiple ‘node_uuid:’ prefixes in your search query. For example:

attacks incidents today node_uuid: 13c431b2-3d2a-12cf-9909-408418077431 node_uuid: 1244b531-734a-1822-ac84-b28ccdac1b56

• Search by Regex-based attack indicator rule: You can search for malicious requests detected using a Regex-based attack indicator rule by using the ‘custom_rule’ parameter. The event details will contain a link to the triggered rule. With this parameter, you can easily find malicious requests detected by your rules and verify their correctness. Additionally, you can also exclude similar malicious requests from the search results using an exclamation point (the  ‘!’ symbol). For example:

attacks incidents today !custom_rule

For more information on search query formats, please refer to the Wallarm documentation.