How do you search for UDM events in Google SecOps?

Searching UDM events means entering a query on the SIEM Search page using YARA-L 2.0-based syntax, where a basic search expression consists of a UDM field, an operator, and a value to match against, with autocomplete suggesting valid field names as you type.

metadata.event_type = "NETWORK_CONNECTION" AND
target.ip = "203.0.113.5"

Beyond simple field-value expressions, UDM search supports the same structured, statistical query capabilities used in detection rules — grouping and ordering results, filtering on computed outcomes, and using aggregate functions — letting an analyst run something closer to an ad hoc analytical query (like counting authentication failures per user over a time window) rather than only retrieving raw matching events one by one.

Search results distinguish between raw UDM events (individual normalized log entries) and alerts (either from rule detections with alerting enabled, or alerts ingested via SOAR connectors and webhooks), and results can be explored alongside the original raw log for a given event when deeper investigation into the source data is needed.