List-based fields
'List-based' search fields allow you to leverage imported lists such as a Digest, Fuzzy Hash, Shingle, or Word list to find matches that contain any or all of the elements within the specified list.
For more information about creating, importing, and working with Word Lists, Shingle Lists, Digest Lists, and Fuzzy Hash Lists, see Configure List types for repetitive processes in the Nuix Workstation User Guide.
Note: The name of the lists are case-sensitive.
This section details all 'List-based' fields in alphabetic order, with working examples of each.
digest-list | fuzzy-hash-list | shingle-list | word-list
digest-list
Use the digest-list field to search for items whose MD5 digest exactly matches a digest in the named list. This effectively is the equivalent of using a digest list filter.
You most frequently use digest lists to eliminate duplicate data from previously processed or reviewed evidence. This is typically done by using the NOT option in front of the digest-list field to ensure only the return of unique content.
Examples:
| Query string |
Results |
| Matches items whose hashes are present in the digest list named "Known Software Files". |
|
| -digest-list:"Known Software Files" |
Matches items whose hashes are not present in the digest list named "Known Software Files". |
fuzzy-hash-list
Use the fuzzy-hash-list field to search for items matching the fuzzy hashes in the named list. This effectively is the equivalent of using a fuzzy hash list filter. You can, optionally, provide a score between 0 and 100 (inclusive), or a range of acceptable scores.
Examples:
| Query string |
Results |
| fuzzy-hash-list:"MyFuzzyHashes" |
Matches items whose fuzzy hash values are an exact match with the fuzzy hashes in "MyFuzzyHashes". |
| Matches items whose fuzzy hash values score at least 75 against at least one fuzzy hash in "MyFuzzyHashes". |
|
| fuzzy-hash-list:"MyFuzzyHashes;[75 TO 95]" |
Matches items whose fuzzy hash values score between 75 and 95 (inclusive) against at least one fuzzy hash in "MyFuzzyHashes". |
shingle-list
Use the shingle-list field to search for items having at least one shingle contained in the named shingle list, effectively equivalent to using a shingle list filter to find a similar document.
Examples:
| Query string |
Results |
| shingle-list:"MyFiles" |
Matches items with at least one shingle present in the shingle list named "MyFiles". |
| shingle-list:"MyFiles;0.9" |
Matches items with at least one shingle present in the shingle list named "MyFiles", overriding the default resemblance threshold of 0.5 with 0.9. |
word-list
Use the word-list field to search for items containing any of the words or phrases in the given word list file. This effectively is the equivalent of using a word list filter. Example:
| Query string |
Results |
| Matches items whose words are present in the word list named "Fraud". |