Skip to content
Documentation

KQL Search and Filtering

UEC list pages use a Kusto-inspired operator grammar.

UEC list pages use a Kusto-inspired operator grammar. A query can combine typed field clauses, comparison operators and free text; all clauses in one query are AND-combined. Plain text without operators falls back to a broad text search over that page’s default fields.

Device search in light mode Device search in dark mode

Syntax

Section titled “Syntax”
field operator value

Examples:

status == online
version >= 2.1.0
status == online version >= 2.1.0
status == online Finance
name == "My Production Policy"

Multiple clauses are automatically ANDed. There is no AND/OR keyword in the list search grammar.

Operators

Section titled “Operators”
Operator Aliases Meaning
== =, =~ Equal / case-insensitive equality
!= <>, !~ Not equal
: ~ Contains / substring
> — Greater than
>= — Greater than or equal
< — Less than
<= — Less than or equal

~ and !~ do not introduce regex matching; they are treated like contains/equality aliases.

Quoting

Section titled “Quoting”

Use double quotes when a value contains spaces:

name == "My Production Policy"
title : "application blocked"
actor == "john.doe@company.com"

Without quotes, the parser treats each word as a separate token.

Version comparison

Section titled “Version comparison”

Ordering comparisons on version fields use semantic-version comparison, so:

version >= 2.1.0

correctly treats 2.10.0 as greater than 2.9.0. Agent Configuration revisions compare integers. Equality and contains comparisons use normal string matching.

Page fields

Section titled “Page fields”

Devices

Section titled “Devices”
Field Aliases
hostname device, host
ip address
user —
version agent, agentversion
os platform
status state
compliance obedience

Devices also accept a comma/space-separated hostname list for bulk lookup.

Policies

Section titled “Policies”
Field Aliases
name policy, title
type kind
platform os

Device Groups

Section titled “Device Groups”
Field Aliases
name group, groupname
type grouptype, kind

Software Catalog

Section titled “Software Catalog”
Field Aliases
name app, application, software
publisher vendor
version ver

Alerts

Section titled “Alerts”
Field Aliases
title name, subject
message msg, body
severity sev, priority
status state
device host, hostname

Audit Log

Section titled “Audit Log”
Field Aliases
action event
actor / user by
resource / resourcetype entity, entitytype, type

Agent Configuration

Section titled “Agent Configuration”
Field Aliases
name —
description desc
createdby author, by
version ver, rev

Recipes

Section titled “Recipes”
Goal Query
Online Windows devices on current agent status == online os == Windows version >= 7.3.1
Offline Linux devices status == offline os == Linux
High severity blocked alerts severity == High title : blocked
Exact policy name == "Ring 2 Browser Allow"
Microsoft publisher, not exact-only publisher : Microsoft
Exact Microsoft publisher publisher == Microsoft
Find two hosts HOST-A, HOST-B
Current app versions name : chrome version >= 125

Where KQL is active

Section titled “Where KQL is active”

Devices, Policies, Device Groups, Software Catalog, Alerts, Audit Log and Agent Configuration. Some other pages expose typed filter chips and source-specific operators rather than the shared parser. The URL retains the list state so filtered views can be shared.