Trellix Helix index search capability lets you search events both as a starting point to find a potential compromise and to locate specific events associated with alerts. Trellix Helix index search can search billions of events in seconds.
For raw events, Trellix Helix can search for matching strings.
For parsed events that are normalized according to the Trellix Helix taxonomy, Trellix Helix can search for common data across all events from a variety of log sources. See the TQL Reference Guide for more information.