Advanced Query Tokens
You can use the following search tokens to search for information about events on the Advanced Hunting tab:
Use a text value to search events by query name.
Example
Show event(s) that have a query name
query.name:BitLockerToGo Execution
Use a string value to help you find events by query type (SYSTEM, USER).
Example
Show event(s) with this query type
query.type:SYSTEM
Use a string value to help you find events by query category.
Example
Show event(s) with this query category:
query.category:Common Hunting
Use a text value to help you find the unique identifier associated with the user who created or owns the query.
Example
Show event(s) with this query userid:
query.userid:user12345
Use a text value to help you find the user's name who created or owns the query.
Example
Show event(s) with this query username:
query.username:jdoe
query.isfavoritequery.isfavorite
Use a boolean value to help you find whether a query has been marked as a favorite by the user.
Example
Show event(s) with this query:
query.isfavorite:TRUE