See How Aurora Search Finds Proof, Answers Questions, and Powers Automation

• Sidebar 'Find pages...' input filters the navigation only.
• Global search overlay (Cmd/Ctrl+K) for quick navigation and lookup.
• Global search page: /dashboard/search.
• Help Center search: /dashboard/help.
• Command knowledge base search: /dashboard/command/knowledge-base.
• Most list pages include their own filter/search rows (scoped to that page).

Quick search overlay (Cmd/Ctrl+K)

• Toggle with Cmd+K (macOS) or Ctrl+K (Windows/Linux).
• Uses the same search backend for core categories (KB results appear on the full Search page), capped at 10 results per type.
• Shows quick links when the query is empty.

Global search groups results by category and lets you toggle categories on/off. Searches are substring matches over the fields shown below (wildcards are escaped; % and _ are treated as literals).

Query rules and limits

• Minimum query length: 2 characters (ignored when recent=true).
• Maximum query length: 128 characters (longer queries return a validation error).
• Default limit: 10 per type (max 20).
• Results are capped per category (max 20 per category).
• Queries shorter than the minimum return empty results plus min_query_length metadata.
• The Search page starts at 60 per type and "Load more" adds 40 up to 240.
• The API still clamps the per-type limit to 20.
• recent=true returns the most recent items for a single type and requires type.
• recent accepts true/false, 1/0, or yes/no (common truthy values: 1, true, yes).
• If a type is explicitly requested and you lack module/permission access, the API returns 403 instead of a silent empty list.

Result ordering

• Most categories sort by updated_at descending with created_at/id fallbacks (see per-category sort in the table below).
• Knowledge base results sort by relevance for queries and by last_updated for recent mode.

Categories, filters, and defaults

Command knowledge base coverage

Command knowledge base results appear in global search when the Command module is licensed and you have the permission command.read.kb.
Knowledge base search scores matches as follows (highest to lowest): id, title, tags, then body text.

Help Center and Command KB search

• Help Center search filters both built-in help articles and Command KB articles.
• Help Center matches on title, description, and tags; topic filters are exposed via the tag query param.
• Command KB search matches on title, id, slug, tags, and excerpt.
• Command KB supports category chips (based on the slug prefix) plus sorting by Updated or Title.

Access requirements

Global search requires the view_search or view_dashboard permission. Each category also enforces module licensing plus the permissions listed above.

Advanced search runs AQL against a single dataset at a time and is available in the Search page (Advanced toggle) and the Report Builder.

Access and availability

• Permission required: advanced_search.
• Admins can enable/disable and set limits in Settings -> Aurora -> Integrations -> Advanced Search.
• If allowed_sources is set, only sources explicitly marked true are available.
• AQL queries are queued by default; the UI shows queued/processing/completed status.

Filter syntax

Use explicit boolean operators (AND, OR, NOT) and parentheses for grouping.

Additional filter notes:

• Fieldless terms search across the dataset's searchable fields.
• Use quotes for values with spaces (e.g., owner:"Jane Doe").
• field:null matches null values. field:* matches any non-null value.
• Boolean fields accept true/false or 1/0.

Pipeline commands

Pipeline commands are appended with | and run in order after the base filters.

Pipeline notes:

• search and where apply after eval (post-filtering the returned rows).
• stats switches the output to KPI/breakdown mode and ignores fields, eval, and where.

Result modes

• table: default mode. Returns rows and columns metadata.
• kpi: stats count or aggregate without by. Returns metrics.value.
• breakdown: stats ... by <field>. Returns rows of { label, value } plus meta.group_by.
• All modes include meta with source, mode, query, limit, and execution_ms.

Examples

status:open AND severity:high | sort -updated_at | limit 25
owner:"Jane Doe" AND score>=7 | fields id,title,status,score,updated_at
framework_code:ISO27001 | stats count by category
title:"Access Review" | eval priority=if(score>=8,"High","Medium") | where priority:High

Settings and limits (defaults)

Each AQL source exposes the fields listed below. Fieldless terms use the dataset's searchable fields.

Risks (risks)

Module: risk_register
Any of: view_risks, manage_risks, edit_risks
Mode: sql
Table: risks
Org column: organization_id

Default filter: status NOT IN ('closed','accepted','deleted')
Default sort: updated_at desc
Searchable fields: title, description, category, owner
Default fields: id, title, status, score, owner, due_date, updated_at

Vendors (vendors)

Module: continuous_compliance
Any of: view_vendors, view_compliance, manage_compliance
Mode: sql
Table: vendors
Org column: organization_id

Default filter: status != 'deleted'
Default sort: updated_at desc
Searchable fields: name, category, subcategory, description, risk_rating
Default fields: id, name, status, risk_rating, category, next_review_date, updated_at

Evidence (evidence)

Module: continuous_compliance
Any of: view_evidence, upload_evidence, export_evidence, view_evidence_raw
Mode: sql
Table: evidence_items
Org column: organization_id

Default filter: status != 'archived'
Default sort: updated_at desc
Searchable fields: title, category, description, filename
Default fields: id, title, category, status, valid_until, updated_at

Evidence requests (evidence_requests)

Module: continuous_compliance
Any of: view_evidence, upload_evidence, export_evidence, view_evidence_raw
Mode: sql
Table: evidence_requests
Org column: organization_id

Default filter: status IN ('open','in_progress')
Default sort: due_date asc
Searchable fields: title, category, framework_code, control_code
Default fields: id, title, status, due_date, updated_at

Policies (policies)

Module: continuous_compliance
Any of: view_policies, acknowledge_policies, approve_policies
Mode: sql
Table: organization_policies
Org column: organization_id

Default filter: -
Default sort: updated_at desc
Searchable fields: name, status
Default fields: id, name, status, review_date, updated_at

Remediation items (remediations)

Module: continuous_compliance
Any of: view_remediation, manage_remediation
Mode: sql
Table: remediation_items
Org column: organization_id

Default filter: status NOT IN ('completed','verified','closed','deleted')
Default sort: updated_at desc
Searchable fields: title, description, severity, priority, status
Default fields: id, title, status, priority, assigned_to, due_date, updated_at

Incidents (incidents)

Module: incident_response
Any of: view_incidents, manage_incidents
Mode: sql
Table: incidents
Org column: organization_id

Default filter: status != 'closed'
Default sort: updated_at desc
Searchable fields: title, incident_number, severity, status, event_type
Default fields: id, incident_number, title, status, severity, reported_at, updated_at

Assessments (assessments)

Module: continuous_compliance
Any of: view_assessments, manage_assessments, edit_assessments, edit_assigned_assessments
Mode: sql
Table: assessments
Org column: organization_id

Default filter: status NOT IN ('deleted','completed','archived')
Default sort: updated_at desc
Searchable fields: type, assessment_type, status
Default fields: id, type, status, assessment_type, created_at, updated_at

Support tickets (tickets)

Module: tickets
Any of: view_tickets, manage_tickets
Mode: sql
Table: tickets
Org column: organization_id

Default filter: status NOT IN ('closed','deleted')
Default sort: updated_at desc
Searchable fields: subject, status, priority, category
Default fields: id, ticket_number, subject, status, priority, updated_at

Compliance controls (compliance_controls)

Module: continuous_compliance
Any of: view_compliance, manage_compliance, view_frameworks, view_tests, view_standards
Mode: sql
Table: compliance_controls

Default filter: -
Default sort: framework_code asc
Searchable fields: framework_code, control_code, title, category
Default fields: framework_code, control_code, title, category

Aurora controls (aurora_controls)

Module: continuous_compliance
Any of: view_compliance, manage_compliance, view_frameworks, view_tests, view_standards
Mode: memory

Default filter: -
Default sort: -
Searchable fields: control_key, title, description, domain, family, tags
Default fields: control_key, title, domain, family, severity_default

Compliance frameworks (frameworks)

Module: continuous_compliance
Any of: view_frameworks, view_tests, view_standards, view_compliance, manage_compliance
Mode: memory

Default filter: -
Default sort: -
Searchable fields: framework_key, code, name, publisher, type, status, tags, industries, jurisdictions
Default fields: framework_key, code, name, version, publisher, status, requirements_count

Compliance tests (tests)

Module: continuous_compliance
Any of: view_tests, view_frameworks, view_standards, view_compliance, manage_compliance
Mode: memory

Default filter: -
Default sort: -
Searchable fields: id, title, description, severity, category, category_label, resource_type, assertion_types, event_triggers
Default fields: id, title, severity, category_label, resource_type, schedule_interval

Training modules (training_modules)

Module: practice
Any of: view_training, manage_training, assign_training
Mode: sql
Table: training_modules

Default filter: is_active = 1
Default sort: updated_at desc
Searchable fields: title, category, description
Default fields: id, title, category, duration_minutes, updated_at

User training (user_training)

Module: practice
Any of: view_training, manage_training, assign_training
Mode: sql
Table: user_training
Org column: organization_id

Default filter: -
Default sort: updated_at desc
Searchable fields: status
Default fields: id, user_id, module_id, status, completed_at, updated_at

Command devices (command_devices)

Module: command
Any of: command.read.devices, command.read.overview, command.read.coverage, command.read.telemetry
Mode: sql
Table: command_devices
Org column: organization_id

Default filter: -
Default sort: updated_at desc
Searchable fields: name, vendor, product, telemetry_status, data_quality_verdict
Default fields: id, name, telemetry_status, data_quality_verdict, updated_at

Command collectors (command_collectors)

Module: command
Any of: command.read.collectors, command.read.overview, command.read.integrations
Mode: sql
Table: command_collectors
Org column: organization_id

Default filter: -
Default sort: updated_at desc
Searchable fields: name, status, collector_type
Default fields: id, name, collector_type, status, updated_at

Command integrations (command_integrations)

Module: command
Any of: command.read.integrations, command.read.overview
Mode: sql
Table: command_integrations
Org column: organization_id

Default filter: -
Default sort: updated_at desc
Searchable fields: display_name, integration_type, status
Default fields: id, display_name, integration_type, status, updated_at

Command knowledge base (knowledge_base)

Module: command
Any of: command.read.kb
Mode: memory

Default filter: -
Default sort: -
Searchable fields: id, title, slug, excerpt, tags, applicable_vendors, related_pages
Default fields: title, excerpt, tags, last_updated, slug

Message threads (message_threads)

Module: messages
Any of: view_messages, manage_messages
Mode: sql
Table: message_threads
Org column: organization_id

Default filter: -
Default sort: last_message_at desc
Searchable fields: subject, thread_type
Default fields: id, subject, thread_type, last_message_at, created_at

Aurora sessions (chat_sessions)

Module: talk_to_aurora
Any of: aurora.use
Mode: sql
Table: chat_sessions
Org column: organization_id

Default filter: created_by_viewer_id IS NULL
Default sort: updated_at desc
Searchable fields: title, scope_type
Default fields: id, title, scope_type, status, updated_at

Practice scenarios (practice_scenarios)

Module: practice
Any of: view_practice, manage_practice, facilitate_practice
Mode: sql
Table: practice_scenarios
Org column: organization_id

Default filter: -
Default sort: updated_at desc
Searchable fields: title, description, difficulty
Default fields: id, title, difficulty, status, updated_at

Practice sessions (practice_sessions)

Module: practice
Any of: view_practice, manage_practice, facilitate_practice
Mode: sql
Table: practice_sessions
Org column: organization_id

Default filter: -
Default sort: scheduled_start_at desc
Searchable fields: status, scenario_id
Default fields: id, scenario_id, status, scheduled_start_at, scheduled_end_at

Phishing campaigns (phish_campaigns)

Module: phishing
Any of: view_phishing, manage_phishing, launch_phishing
Mode: sql
Table: phish_campaigns
Org column: organization_id

Default filter: -
Default sort: created_at desc
Searchable fields: name, description, status
Default fields: id, name, status, start_at, end_at

Leaderboard stats (gamification_user_stats)

Module: leaderboard
Any of: view_gamification, manage_gamification
Mode: sql
Table: gamification_user_stats
Org column: organization_id

Default filter: -
Default sort: total_points desc
Searchable fields: -
Default fields: user_id, total_points, current_level, current_streak_days, longest_streak_days

Trust Center access requests (tc_access_requests)

Module: trust_center
Any of: trust_center:admin, trust_center:approve, trust_center:messages, trust_center:analytics_read, trust_center:legal_admin
Mode: sql
Table: tc_access_requests
Org column: organization_id

Default filter: -
Default sort: requested_at desc
Searchable fields: requester_email, requester_name, company, status
Default fields: id, requester_email, company, status, requested_at

Trust Center message threads (tc_message_threads)

Module: trust_center
Any of: trust_center:admin, trust_center:approve, trust_center:messages, trust_center:analytics_read, trust_center:legal_admin
Mode: sql
Table: tc_message_threads
Org column: organization_id

Default filter: -
Default sort: last_message_at desc
Searchable fields: subject, category, status, priority
Default fields: id, trust_center_id, subject, status, priority, last_message_at

These endpoints power the search UI:

GET /search.php?q=<query>&limit=<1-20>&type=<optional>&recent=<optional>
POST /advanced-search.php?action=enqueue { source, query, limit?, delay_seconds? }
GET /advanced-search.php?action=status&job_id=<id>
GET /advanced-search.php?action=sources
GET /advanced-search.php?action=catalog (admin only)
POST /advanced-search.php?action=execute { source, query, limit? }

Notes:

• recent=true returns the most recent items for a single type and requires type.
• Advanced search is rate-limited (30 requests per minute per user/org, when rate limiting is enabled).
• Queued AQL jobs respect max queue depth and may return QUEUE_BUSY when saturated.
• sources returns only licensed and permitted sources (and respects allowed_sources).
• catalog includes policy/licensing metadata and requires manage_settings.
• status returns cached results when available; completed jobs without cache return an expiry error.

• If you see 'Setup required' in Search, complete the Setup Guide and retry.
• If a category is missing, check module licensing and permissions.
• For compliance controls, search by control code (e.g., AURORA.AC.MFA) or framework code.
• If AQL returns 'Query requires at least one filter', add a base filter or disable the requirement in settings.