---
title: "Running Advanced Searches With TQL | ThreatConnect"
slug: "running-advanced-searches-with-tql"
description: "This article describes how to run advanced searches using TQL queries, save TQL queries, and manage saved TQL queries."
tags: ["Viewing Data"]
updated: 2025-12-21T16:27:19Z
published: 2025-12-21T16:27:19Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Running Advanced Searches With TQL

## Overview

When [searching by object type](https://knowledge.threatconnect.com/docs/searching-by-object-type) on the [**Search**screen](https://knowledge.threatconnect.com/docs/searching-in-threatconnect)****or viewing data on the [**Legacy Browse**screen](https://knowledge.threatconnect.com/docs/the-browse-screen), you can use the advanced search feature to perform highly targeted searches of your threat intelligence data with [structured queries written in ThreatConnect® Query Language (TQL)](https://knowledge.threatconnect.com/docs/constructing-query-expressions). Advanced searches let you search and filter your data based on criteria that cannot be defined in basic searches.

After you create a TQL query to use in an advanced search, you can save the query. Saving a query allows you to run the query and view its results at a later time, visualize the query’s results in a [Query card](https://knowledge.threatconnect.com/docs/adding-query-cards-to-dashboards) added to a custom [dashboard](https://knowledge.threatconnect.com/docs/dashboards), and use the query to [create associations between the query's results and a Group or an Intelligence Requirement (IR)](https://knowledge.threatconnect.com/docs/the-associations-tab#tql-queries).

## Before You Start

### User Roles

- To run advanced searches using TQL queries, your user account can have any [Organization role](https://knowledge.threatconnect.com/docs/organization-roles).
- To save TQL queries and delete saved TQL queries, your user account can have any Organization role.
- To search for Groups, Indicators, IRs, Tags, Victims, and Victim Assets in an Organization, your user account can have any Organization role.
- To search for Groups, Indicators, Tags, Victims, and Victim Assets in a Community or Source, your user account can have any [Community role](https://knowledge.threatconnect.com/docs/community-roles) except Banned for that Community or Source.

## Running Advanced Searches

You can run advanced searches on the object-specific **Search**screens and the **Legacy Browse**screen. For instruction on running an advanced search on an object-specific **Search**screen, see the following steps:

1. From the **Search & Create**dropdown on the top navigation bar, select an object type (**Groups**, **Indicators**, **Intelligence Requirements**, **Tags**, **Victim Assets**, or **Victims**).
2. Turn on the **Advanced Search**toggle above the search bar.
3. Enter a [TQL query](https://knowledge.threatconnect.com/docs/constructing-query-expressions) into the search bar. If you configured a basic search query before turning on the **Advanced Search**toggle, the query will be converted into a TQL query and populated in the search bar automatically.NoteIf you configured Attribute filters in a basic search query, the converted advanced search query will use the Attribute Type’s name in the `attribute` parameter by default (e.g., `attributeAdversary_Type`). However, if the Attribute Type’s name contains characters other than letters, numbers, and spaces, the advanced search query will use the Attribute Type’s ID number instead of its name in the `attribute` parameter (e.g., `attribute123`). For more information on the `attribute` parameter, see the [“Query for Attributes” section in *Constructing Query Expressions*](https://knowledge.threatconnect.com/docs/constructing-query-expressions#query-for-attributes).HintYou can use the [TQL Generator](https://knowledge.threatconnect.com/docs/tql-generator) to translate plain-English prompts into TQL queries.
4. Click **Search![Search drawer icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Search%20drawer%20icon.png)**to the right of the search bar, or press **Enter**on your keyboard, to run your search.NoteIf a TQL query is invalid, you can hover over the validator on the left side of the search bar to view the corresponding error message.NoteIf you run an advanced search using a query that matches a [saved query](https://knowledge.threatconnect.com/docs/saved-search-queries), the saved query will be selected in the **Select Saved Query…**dropdown automatically.

For instruction on running an advanced search on the **Legacy Browse**screen, see the following steps:

1. From the **Search & Create**dropdown on the top navigation bar, select **Legacy Browse**.
2. Click **Advanced**at the upper-right corner.
3. From the dropdown next to the search bar, select the type of object to search for.
4. Enter a TQL query into the search bar. If you configured a [“contains”](https://knowledge.threatconnect.com/docs/the-browse-screen#running-a-contains-search)****or [“exact match”](https://knowledge.threatconnect.com/docs/the-browse-screen#running-an-exact-match-search) search before clicking **Advanced**, the query will be [converted into a TQL query](https://threatconnect.com/blog/threatconnect-query-language-tql-for-people-who-dont-code/)and populated in the search bar automatically.HintUse the [TQL Generator](https://knowledge.threatconnect.com/docs/tql-generator) to translate plain-English prompts into TQL queries. Also, a list of commonly used TQL queries and a link to a complete list of [TQL operators and parameters](https://knowledge.threatconnect.com/docs/tql-operators-and-parameters) are available in the **ThreatConnect Query Language (TQL)**sidebar on the **Legacy Browse**screen.
5. Click **Search**![Search drawer icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Search%20drawer%20icon.png)to the right of the search bar, or press **Enter**on your keyboard, to run your search.NoteIf you are searching for IRs or Tags and your TQL query is invalid, you can hover over the validator on the left side of the search bar to view the corresponding error message.
6. (Optional) Use the **[](https://knowledge.threatconnect.com/docs/my-intel-sources)**[](https://knowledge.threatconnect.com/docs/my-intel-sources)[**My Intel Sources**selector](https://knowledge.threatconnect.com/docs/my-intel-sources)[](https://knowledge.threatconnect.com/docs/my-intel-sources)**[](https://knowledge.threatconnect.com/docs/my-intel-sources)** at the upper left to select the owners whose data you want to include in the results table.

## Saving TQL Queries

You can save TQL queries on the object-specific **Search**screens and the **Legacy Browse**screen. For instruction on saving a TQL query on an object-specific **Search**screen, see the [“Saving Queries” section of *Saved Search Queries*](https://knowledge.threatconnect.com/docs/saved-search-queries#saving-queries).

For instruction on saving a TQL query on the **Legacy Browse**screen, see the following steps:

1. From the **Search & Create**dropdown on the top navigation bar, select **Legacy Browse**.
2. Click **Advanced**at the upper-right corner.
3. Enter a TQL query into the search bar.
4. From the **⋯** menu at the upper-right corner, select **Save Current Query…**.
5. On the **Save Current Query…**drawer, enter a name for the query, and then click **SAVE**.

NoteThe queries you save belong only to your user account and are not shared with any other user accounts.

## Running Advanced Searches Using Saved TQL Queries

You can run advanced searches using saved TQL queries on the object-specific **Search**screens and the **Legacy Browse**screen. For instruction on running an advanced search using a saved TQL query on an object-specific **Search**screen, see the [“Running Searches Using Saved Queries” section of *Saved Search Queries*](https://knowledge.threatconnect.com/docs/saved-search-queries#running-searches-using-saved-queries).

For instruction on running an advanced search using a saved TQL query on the **Legacy Browse**screen, see the following steps:

1. From the **Search & Create**dropdown on the top navigation bar, select **Legacy Browse**.
2. From the **⋯**menu at the upper-right corner, select **View Queries**.
3. On the **View Queries**drawer, click a saved query’s name to immediately run an advanced search using the query.

## Deleting Saved TQL Queries

You can delete saved TQL queries on the object-specific **Search**screens and the **Legacy Browse**screen. For instruction on deleting a saved TQL query on an object-specific **Search**screen, see the [“Deleting Saved Queries” section of *Saved Search Queries*](https://knowledge.threatconnect.com/docs/saved-search-queries#deleting-saved-queries).

For instruction on deleting a saved TQL query on the **Legacy Browse**screen, see the following steps:

1. From the **Search & Create**dropdown on the top navigation bar, select **Legacy Browse**.
2. From the **⋯**menu at the upper-right corner, select **View Queries**.
3. On the **View Queries**drawer, click **Delete**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Trash%20icon_Black.png)in a saved query’s row.
4. On the **Confirm Delete**window, click **YES**.

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.*

20052-02 v.20.A