Further Filtering: Type-Specific Search & Introduction to TQL

ThreatConnect 101  

Further Filtering: Type-Specific Search & Intro to TQL

This video outlines advanced filtering and search capabilities within the platform, focusing on object-based searches and the use of the ThreatConnect Query Language (TQL).

Guide: Further Filtering - Type-Specific Search & Intro to TQL

Global search is broad by design, but when you already know what kind of object you're looking for, the type-specific search pages (Groups, Indicators, and more) are faster and more precise. This guide also introduces TQL (ThreatConnect Query Language), which powers all advanced searching in the platform.

Key Steps:

1. On the left sidebar, choose a type-specific search page: Groups, Indicators, Intelligence Requirements, Tags, Victim Assets, or Victims.
2. Note the key difference from global search: type-specific pages search directly on the object's name/summary field, rather than across all metadata. Use them when you already know the name of what you're looking for (for example, “APT28” or a specific CVE ID), or when you want to browse a category or build a filter-heavy query.
3. Try searching for a CVE under Groups. It should find the vulnerability object directly by name.
4. Try searching for a keyword like “Iran". This surfaces any report or object with that word in its name, which is especially useful for finding intelligence reports.
5. Use Exact Match and the additional filters available here: filter by tag, by security label, or by custom attribute values.
6. Search for an actor name (for example, “APT28”) and filter down to the Intrusion Set type to find the actor's unified threat profile. Open it and note the association count, this tells you how many groups, indicators, and other objects are tied to that actor.
7. Toggle the Advanced Search to see the TQL query that was automatically built from the filters you just applied. TQL is structured around object types and their properties, and it can traverse associations. For example, finding every report associated with a specific intrusion set.
8. Modify the query to search for objects associated with the actor, rather than the actor object itself. For example: find every object where the type is “Report” AND that report has an associated group where the group's name equals “APT28” and its type is “Intrusion Set.”
9. Run the query and review the results count. This narrows a broad set of associated objects (in one example, 1,100+ groups) down to just the intelligence reports you actually want (651 results).
10. Save the query for later. Saved queries can be reused directly from the search screen and can also be added to dashboard cards (see Guide 7).

Good to know:

• Don't try to use one search type for everything: global search is a broad keyword search across all metadata (including documents); type-specific search is a name-based search within one category. Both have their place.
• TQL field names are case-sensitive. This is a common source of errors if you're editing queries directly.
• Association-based queries (using constructs like hasGroup) are the most powerful part of TQL, but they can feel complex at first. Take them slowly.
• Saved queries are only for the user who saved them. They aren't automatically available to your whole team. If your team wants to share queries, align on how to do that.