Skip to main content

Global search

Analyst

Ticketra provides full-text search across your tenant's data, backed by OpenSearch.

  1. Open the Search page.
  2. Enter a term — an IP, a hostname, a case title, part of a comment.
  3. Results are returned ranked by relevance and scoped to your tenant.

What's searchable​

Search spans the indexed content of your investigations — cases, observables, and ingested events. Because PostgreSQL is the source of truth and OpenSearch is a rebuildable index, occasionally-stale results self-heal: the index is reconstructed from the database.

Permissions & scope

Search requires the logs:search permission. Results are always tenant-scoped — you only ever see your own tenant's data (system users see the tenant they're operating in).

Tips​

  • Pivot from a result. Click through to a case or observable to continue the investigation; from an observable you can see every case it touches.
  • Search is not the audit log. To answer "who did what", use the Audit Log (requires audit:read), not search.

If results look stale or empty​

OpenSearch is a secondary index. If it was rebuilt or recently started, recent items may take a moment to appear. Operators can confirm OpenSearch health via the health endpoint; see Troubleshooting.