Skip to main content
Affinity/Documentation
Español

Getting Started

  • What is Affinity
  • Sign In
  • Your First 15 Minutes
  • Navigation Map

Integrations (Admin)

  • Integration List
  • Create Integration
  • Start Ingestion
  • Secrets

Logs (Analyst)

  • Overview
  • SQL Queries (Presto)
  • Visual Query Builder
  • Use Cases
  • Search & Export
  • Share Queries
  • Create Rule from Logs

Alerts (Analyst)

  • List & Filters
  • Details & Management
  • Full View

Detection & Notifications (Admin)

  • Detection Rules
  • Notifications

Incident Response (Analyst)

  • Extract IOCs
  • Query IOCs in Logs
  • Export Results

Administration

  • User Management
  • Lookup Tables

Troubleshooting

  • Common Issues

Reference

  • Glossary
  • Integration Catalog
  • FAQ
  • Step-by-Step Guides

Logs Overview

RoleAnalystRead6 min

Screen

Security Logs

/logs

View and analyze security event logs across your infrastructure

Your investigation hub. Query millions of events with SQL Presto, build queries visually with the Query Builder, export evidence, and turn findings into detection rules, all in a workspace designed for SOC analysts.

Security Logs page with sidebar and editor showing SELECT * FROM cloudtrail
Security Logs screen: sidebar, query tab, time controls, and SQL editor.

Two ways to build a query

  • SQL editor — Write SQL directly. It is standard Presto SQL. See SQL Queries (Presto)→.
  • Query Builder (the Query Builder button) — Visual builder: pick table, columns, filters, and aggregations, and the SQL is generated for you. See Visual Query Builder→.

Query tabs

  • Each query lives in its own tab (Query 1, Query 2…). Use + to open another and the × to close it.
  • Tabs are independent: you can keep several investigations open in parallel.
Query tabs Query 1, Query 2 with the buttons to open and close tabs
Each query lives in its own tab.

Time range and timezone

  • Quick range: 1h, 3h, 12h, 1d, 1w, or Custom (the Custom Time Range (UTC) modal with From / To and Apply).
  • Timezone: UTC / UTC-3 selector (affects how dates are displayed and interpreted).
Time range selector with 1h, 3h, 12h, 1d, 1w, Custom options and the UTC / UTC-3 timezone selector
Time range and timezone controls.

View modes (top toggle)

  • Query Editor — SQL editor/Query Builder and query tools.
  • Table View — Results table with search, configurable columns, and export.

Results bar

  • Counter {shown} / {total} results (e.g. 100 / 1,901 results).
  • Pagination Page X of Y with ◀ ▶ arrows.
  • Icons: Visible Columns (choose columns), Export (download CSV), and Create Detection Rule (shield).
Results bar with 100 / 1,901 results and columns, export, and create-rule icons
Results bar: counter, columns icon, export, and create-rule.

See also

SQL Queries (Presto) →Visual Query Builder →Use Cases →
Previous

Secrets

Next

SQL Queries (Presto)