---
title: "Advanced Searching: Bulk IOC Search & Bulk Actions"
slug: "advanced-searching-bulk-ioc-search-bulk-actions"
updated: 2026-07-14T19:05:13Z
published: 2026-07-14T19:05:13Z
canonical: "knowledge.threatconnect.com/advanced-searching-bulk-ioc-search-bulk-actions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Advanced Searching: Bulk IOC Search & Bulk Actions

## **ThreatConnect 101**

### **Advanced Searching: Bulk IOC Search & Bulk Actions**

*This video demonstrates advanced searching functionalities in ThreatConnect, specifically focusing on handling bulk indicators of compromise (IOCs) and leveraging complex queries.*

[ThreatConnect101: Advanced Searching Video](https://fast.wistia.net/embed/iframe/qj3gx4vyrg?web_component=true&seo=false&videoFoam=false)

### **Guide: Advanced Searching: Bulk IOC Search & Bulk Actions**

*Real-world SOC and IR work often means checking dozens, hundreds, or even thousands of indicators at once. This guide covers ThreatConnect's bulk search and bulk action tools, which turn a manual triage task into a matter of seconds.*

#### **Key Steps:**

1. From the global search page, **click the Bulk Search toggle** in the top left.
2. **Upload a file** (a CSV of indicator values) **or paste your indicator list** directly.
3. **Review the results**, which show every indicator from your list alongside its Threat Assess Score (if known), the IOC value, which owner/source already has it, and whether it's Known or Unknown to your instance.
4. **Sort by Threat Assess Score** (descending) to immediately surface your highest-priority indicators.
5. **Filter to Unknown** to see indicators your instance doesn't have yet. Select them and **choose Add to Organization** to bring them into the platform for further analysis and enrichment.
6. **Switch back to All Results.** Filter down to your highest-scored indicators if you want to focus on a specific subset.
7. **Select the indicators** you want to act on and apply a bulk action: **Add Tags** (to label all selected indicators at once, for example “high-priority” or an incident name) or **Export** (to hand the full list, including Threat Assess Scores, back to a requesting team with prioritization built in).
8. To close the loop on a full triage workflow:  
****Receive an IOC list → bulk search it in ThreatConnect → identify known vs. unknown → add unknown indicators to your org → sort by Threat Assess Score → export the enriched list back to the requesting team****

#### **Good to know:**

- **Bulk search only works on indicators.** It doesn't search groups, reports, or other object types.
- **You can only tag indicators in sources where you have write access**. If bulk tagging applies to fewer indicators than expected, check permissions.
- **Indicators you add via bulk search land in your own organization's source.** Check there if you can't find something you just added.
- **Newly added indicators are “bare” until you add context.** Tag them, rate them, or associate them with other objects so they're more than just numbers in a database.
- For very large exports, the UI may have volume limits; **for bulk programmatic export, use the API instead**.