Search Filters (Legacy)

Overview

When searching your ThreatConnect^® data from the Search drawer, you can use filters to limit the amount of data included in the search results.

Before You Start

User Roles

• To filter search results from an Organization, your user account can have any Organization role.
• To filter search results from a Community or Source, your user account can have any Community role except Banned for that Community or Source.

Filter Search Results

The Filters section at the top of the Search drawer (Figure 1) lets you limit search results by owner, type, and location of match.

Filtering Results by Owner

Use the OWNERS selector to select the owners to include data from in the search results. As you update the selections in the OWNERS selector, the search results will update automatically to reflect your selections. In addition, the value in parentheses on the OWNERS selector will change to show the number of owners selected (or ALL if all owners are selected).

Selecting Organizations

For non–Super Users, the OWNERS selector includes a View <Organization name> toggle that they can use to specify whether to display data from their Organization in the search results.

For Super Users, the OWNERS selector displays all of the Organizations on the ThreatConnect instance in the My Orgs section. Here, Super Users can do the following:

• Select Organizations individually;
• Select all Organizations by selecting the checkbox to the left of the Filter orgs search bar;
• Deselect all selected Organizations by clearing the checkbox to the left of the Filter orgs search bar;
• Select an individual Organization and deselect any other selected owners by hovering over the Organization and clickingonly; and
• Filter Organizations with the Filter orgs search bar, which is helpful when Super Users want to select or deselect a particular set of Organizations.

Selecting Sources

The OWNERS selector displays all of your Sources in the Intel Sources section. Here, you can do the following:

• Select Sources individually;
• Select all Sources by selecting the checkbox to the left of the Filter sources search bar;
• Deselect all selected Sources by clearing the checkbox to the left of the Filter sources search bar;
• Select an individual Source and deselect any other selected owners by hovering over the Source and clickingonly;
• Filter Sources with the Filter sources search bar, which is helpful when you want to select or deselect a particular set of Sources; and
• Open the Feed Explorer by clicking Feed Explorer.

Selecting Communities

The OWNERS selector displays all of your Communities in the My Communities section. Here, you can do the following:

• Select Communities individually;
• Select all Communities by selecting the checkbox to the left of the Filter communities search bar;
• Deselect all selected Communities by clearing the checkbox to the left of the Filter communities search bar;
• Select an individual Community and deselect any other selected owners by hovering over the Community and clickingonly; and

Filter Communities with the Filter communities search bar, which is helpful when you want to select or deselect a particular set of Communities.

Filtering Results by Type

Use the TYPES selector to select the object types (Indicator, Group, Tag, Victim, or Case) to include in the search results. As you update the selections in the TYPES selector, the search results will update automatically to reflect your selections. In addition, the value in parentheses on the TYPES selector will change to show the number of types selected (or ALL if all types are selected).

Limiting Results to Local Matches Only

Turn on the Local Matches Only toggle to include only data known to your owners in the search results. If you turn off the Local Matches Only toggle, the legacy search engine will return objects that may not yet exist in your owners, but do match a pattern for an Indicator type that you could then add to one of your owners.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20075-03 v.07.A