KSC Open API
Kaspersky Security Center API description
Full-text search

Full-text search on certain unstructured text data is supported. Examples of unstructured data: the description" and "comments" attributes for a host, various "event description", "event type name", and "event task display name" attributes of an event, etc.
Full-text search uses a full-text query. A full-text query is a series of clauses separated by spaces and special words.

Wildcard

Full-text search supports single and multiple character wildcard searches within single terms. To perform a single character wildcard search, use the question mark (?) symbol. To perform a multiple character wildcard search, use the asterisk (*) symbol. The single character wildcard search looks for terms that match that with the single character replaced. A multi-character wildcard search looks for 0 or more characters. You can also use a wildcard search in the middle of a term.

Note:
You cannot use the asterisk (*) or question mark (?) symbol as the first character of a search.

Example:

  • To search for "text" or "test", you can use the search:
     te?t 
    
  • To search for "test", "tests", or "tester", you can use the search:
     test* 
    
  • To search by using a wildcard search in the middle of a term:
     te*t 
    

Boolean operations

As indicated above, a full-text query is a series of clauses separated by spaces and special words. Special words are AND (&&), OR (||), and NOT, which are used as logical operations to make a complex query. They must be uppercase.
Clauses may be prefixed by a plus(+) or a minus(-) sign, indicating that the clause is required or prohibited, respectively.

Examples:

  • User enters the following text into the "hosts description contains text:" field:
        samba suse
        samba OR suse
        samba || suse
    
    This means that any host found must have either the word "samba" or word "suse" in its description.
  • User enters the following text into the "hosts description contains text:" field:
        +samba +suse
        samba && suse
        samba AND suse
    
    This means that any host found must have both "samba" and "suse" in its description (or comment). Both words must be in the same attribute ("description" or "comments").
  • User enters the following text into the "hosts description contains text:" field:
        myhost -samba -suse
    
    This means that any host found must have "myhost", and neither "samba" nor "suse" in its description.

Alternative syntax is also possible: the quoted part of a string is considered to have a "+" sign before each word. So, the text (with quotes) looks like the following:

 "samba suse" 

is equivalent to:

 +samba +suse 

When using full-text search syntax with a quoted string inside a "Search filter" (see Search filter syntax), you should use escape quotes.
Example: Host has a display name which starts with A and the host comment contains the words `samba` and `suse`:

    (&(KLHST_WKS_DN="A*")(KLHST_WKS_COMMENT="+samba +suse"))

    is equivalent to Search filter with escape quotes:

    (&(KLHST_WKS_DN="A*")(KLHST_WKS_COMMENT="""samba suse"""))
Note:
Full-text queries that contain only exclusions (clauses with a minus sign only) are not supported for the host, but not for event and inventory.