Running Advanced Searches With TQL

Overview

When searching by object type on the Search screen or viewing data on the Legacy Browse screen, you can use the advanced search feature to perform highly targeted searches of your threat intelligence data with structured queries written in ThreatConnect® Query Language (TQL). Advanced searches let you search and filter your data based on criteria that cannot be defined in basic searches.

After you create a TQL query to use in an advanced search, you can save the query. Saving a query allows you to run the query and view its results at a later time, visualize the query’s results in a Query card added to a custom dashboard, and use the query to create associations between the query's results and a Group or an Intelligence Requirement (IR).

Before You Start

User Roles

• To run advanced searches using TQL queries, your user account can have any Organization role.
• To save TQL queries and delete saved TQL queries, your user account can have any Organization role.
• To search for Groups, Indicators, IRs, Tags, Victims, and Victim Assets in an Organization, your user account can have any Organization role.
• To search for Groups, Indicators, Tags, Victims, and Victim Assets in a Community or Source, your user account can have any Community role except Banned for that Community or Source.

Running Advanced Searches

You can run advanced searches on the object-specific Search screens and the Legacy Browse screen. For instruction on running an advanced search on an object-specific Search screen, see the following steps:

1. From the Search & Create dropdown on the top navigation bar, select an object type (Groups, Indicators, Intelligence Requirements, Tags, Victim Assets, or Victims).
2. Turn on the Advanced Search toggle above the search bar.
3. Enter a TQL query into the search bar. If you configured a basic search query before turning on the Advanced Search toggle, the query will be converted into a TQL query and populated in the search bar automatically.
   Note

   If you configured Attribute filters in a basic search query, the converted advanced search query will use the Attribute Type’s name in the attribute parameter by default (e.g., attributeAdversary_Type). However, if the Attribute Type’s name contains characters other than letters, numbers, and spaces, the advanced search query will use the Attribute Type’s ID number instead of its name in the attribute parameter (e.g., attribute123). For more information on the attribute parameter, see the “Query for Attributes” section in Constructing Query Expressions.
   Hint

   You can use the TQL Generator to translate plain-English prompts into TQL queries.
4. Click Searchto the right of the search bar, or press Enter on your keyboard, to run your search.
   Note

   If a TQL query is invalid, you can hover over the validator on the left side of the search bar to view the corresponding error message.
   Note

   If you run an advanced search using a query that matches a saved query, the saved query will be selected in the Select Saved Query… dropdown automatically.

For instruction on running an advanced search on the Legacy Browse screen, see the following steps:

1. From the Search & Create dropdown on the top navigation bar, select Legacy Browse.
2. Click Advanced at the upper-right corner.
3. From the dropdown next to the search bar, select the type of object to search for.
4. Enter a TQL query into the search bar. If you configured a “contains” or “exact match” search before clicking Advanced, the query will be converted into a TQL query and populated in the search bar automatically.
   Hint

   Use the TQL Generator to translate plain-English prompts into TQL queries. Also, a list of commonly used TQL queries and a link to a complete list of TQL operators and parameters are available in the ThreatConnect Query Language (TQL) sidebar on the Legacy Browse screen.
5. Click Searchto the right of the search bar, or press Enter on your keyboard, to run your search.
   Note

   If you are searching for IRs or Tags and your TQL query is invalid, you can hover over the validator on the left side of the search bar to view the corresponding error message.
6. (Optional) Use the My Intel Sources selector at the upper left to select the owners whose data you want to include in the results table.

Saving TQL Queries

You can save TQL queries on the object-specific Search screens and the Legacy Browse screen. For instruction on saving a TQL query on an object-specific Search screen, see the “Saving Queries” section of Saved Search Queries.

For instruction on saving a TQL query on the Legacy Browse screen, see the following steps:

1. From the Search & Create dropdown on the top navigation bar, select Legacy Browse.
2. Click Advanced at the upper-right corner.
3. Enter a TQL query into the search bar.
4. From the ⋯ menu at the upper-right corner, select Save Current Query….
5. On the Save Current Query… drawer, enter a name for the query, and then click SAVE.

Running Advanced Searches Using Saved TQL Queries

You can run advanced searches using saved TQL queries on the object-specific Search screens and the Legacy Browse screen. For instruction on running an advanced search using a saved TQL query on an object-specific Search screen, see the “Running Searches Using Saved Queries” section of Saved Search Queries.

For instruction on running an advanced search using a saved TQL query on the Legacy Browse screen, see the following steps:

1. From the Search & Create dropdown on the top navigation bar, select Legacy Browse.
2. From the ⋯ menu at the upper-right corner, select View Queries.
3. On the View Queries drawer, click a saved query’s name to immediately run an advanced search using the query.

Deleting Saved TQL Queries

You can delete saved TQL queries on the object-specific Search screens and the Legacy Browse screen. For instruction on deleting a saved TQL query on an object-specific Search screen, see the “Deleting Saved Queries” section of Saved Search Queries.

For instruction on deleting a saved TQL query on the Legacy Browse screen, see the following steps:

1. From the Search & Create dropdown on the top navigation bar, select Legacy Browse.
2. From the ⋯ menu at the upper-right corner, select View Queries.
3. On the View Queries drawer, click Deletein a saved query’s row.
4. On the Confirm Delete window, click YES.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20052-02 v.20.A