Legacy Search is - unsurprisingly, given its name - disappearing from the SecOps user interface. You may have already noticed the link’s absence, but please be assured that this is part of an exciting rollout of new search features and functionality.
If you miss the old interface, it can still (for now) be reached by simply appending legacy-siem-search to your SecOps URL, something like this:
https://[YOURINSTANCE].backstory.chronicle.security/legacy-siem-search
However, now is a good time to highlight that there are no remaining features within the legacy search view that are not achievable within the modern, default search interface in SecOps.
Raw log search can be performed in the modern search view simply by using the syntax:
raw = “google.com”
Using google.com as an example string. Additionally, there are filtering options over the raw logs that you can now perform, such as appending “parsed = <true/false>”, for example:
raw = “google.com” parsed = false
This is a powerful feature if you are investigating some logs that got ingested but not parsed in your system. The full documentation on this and other raw log filter options is at https://cloud.google.com/chronicle/docs/investigation/filter-data-raw-log-scan-view
