Searching Intelligence Requirements

Overview

The Search screen in ThreatConnect® provides a single location to search and browse your data. You can search all object types in your ThreatConnect dataset using keywords or phrases, or you can browse threat intelligence data by object type and filter those data to a usable and relevant subset based on details like name/summary, object subtype, owner, and metadata such as Tags, Security Labels, and Attributes.

On the Search: Intelligence Requirements screen, you can search and filter all Intelligence Requirements (IRs) in your Organization using basic search queries or using advanced search queries written in ThreatConnect Query Language (TQL). You can also create IRs, delete IRs individually, and further investigate IRs that are of interest to you.

Before You Start

User Roles

• To view and search IRs in an Organization, your user account can have any Organization role.
• To delete IRs in an Organization, your user account must have an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer.

Viewing All Intelligence Requirements

When you first open the Search: Intelligence Requirements screen, it displays a table listing all IRs in your Organization. You can access the Search: Intelligence Requirements screen by selecting Intelligence Requirements from the Search & Create dropdown on the top navigation bar or by selecting the Intelligence Requirements filter in the left sidebar of the Search screen.

To open an IR’s Details screen and view more details about the IR, click the IR’s requirement.

Hint

You can adjust the columns displayed in the table on the Search: Intelligence Requirements screen by clicking Select columnsin the upper right, selecting the columns to display, and clicking Apply.

Searching and Filtering Intelligence Requirements

On the Search: Intelligence Requirements screen, you can search and filter IRs in your Organization by running the following types of searches:

• Basic search
• Advanced search
• Search using a saved query

To remove all filters and search criteria applied on the Search: Intelligence Requirements screen, click Clear all filters & searchin the upper right.

Running Basic Searches

A basic search lets you search IRs using the search bar and Filtersmenu on the Search: Intelligence Requirements screen. Follow these steps to run a basic search of IRs on the Search: Intelligence Requirements screen:

1. From the Search & Create dropdown on the top navigation bar, select Intelligence Requirements.
2. Configure a basic search query by doing the following:
   • Enter text into the search bar to search IRs by requirement or ID. To run a contains search , leave the Exact Match checkbox cleared. To run an exact match search, select the Exact Match checkbox.
   • Use the Filtersmenu to filter IRs by subtype and metadata.

As you configure a basic search query, the results table updates automatically based on the current search criteria.

Searching by Requirement or ID

When searching IRs by requirement or ID on the Search: Intelligence Requirements screen, you can run two types of searches: contains and exact match.

Contains Search

A contains search lets you filter IRs based on whether their requirement or ID contains the text entered into the search bar on the Search: Intelligence Requirements screen. Use a contains search when you want to filter your dataset to find IRs that relate to a common keyword or phrase. Table 1 describes the search result behavior of a contains search for oil and gas.

To run a contains search on the Search: Intelligence Requirements screen, enter text into the search bar and leave the Exact Match checkbox cleared.

Exact Match Search

An exact match search lets you filter IRs based on whether their requirement or ID is an exact match to the text entered into the search bar on the Search: Intelligence Requirements screen. Use an exact match search when you want to search a large dataset for a specific object, as this type of search yields a more targeted set of search results. Table 2 describes the search result behavior of an exact match search for oil and gas.

To run an exact match search on the Search: Intelligence Requirements screen, enter text into the search bar and select the Exact Match checkbox to the right of the search bar or surround the phrase in straight quotes.

Filtering Intelligence Requirements

The Search: Intelligence Requirements screen includes the Filtersmenu that lets you filter IRs by subtype and IR metadata when running basic searches. After selecting and configuring filters, click Apply. IRs may be filtered by the following metadata:

• Subtype
• Category
• Date Added
• Last Modified

Running Advanced Searches

An advanced search lets you search and filter IRs using a query written in ThreatConnect Query Language (TQL). Advanced searches enable you to perform highly targeted searches of IRs using criteria that cannot be defined when running basic searches.

Follow these steps to run an advanced search of IRs on the Search: Intelligence Requirements screen:

1. From the Search & Create dropdown on the top navigation bar, select Intelligence Requirements.
2. Turn on the Advanced Search toggle above the search bar.
3. Enter a TQL query into the search bar. If you configured a basic search query before turning on the Advanced Search toggle, the query will be converted into a TQL query and populated in the search bar automatically.
   Hint

   You can use the TQL Generator to translate plain-English prompts into TQL queries.
4. Click Searchto the right of the search bar, or press Enter on your keyboard, to run your search.
   Note

   If a TQL query is invalid, you can hover over the validator on the left side of the search bar to view the corresponding error message.
   Note

   If you run an advanced search using a query that matches a saved query, the saved query will be selected in the Select Saved Query… dropdown automatically.

Running Searches Using Saved Queries

When using the basic or advanced search features on the Search: Intelligence Requirements screen, you can run a search using a saved query. Follow these steps to use a saved query to search IRs on the Search: Intelligence Requirements screen:

1. From the Search & Create dropdown on the top navigation bar, select Intelligence Requirements.
2. From the Select Saved Query… dropdown in the upper right, select a saved query to run.

After you select a saved query, the Advanced Search toggle turns on and a search using the selected query runs automatically.

Sorting Intelligence Requirements

You can sort IRs by any of the table columns except for the Tags column. By default, IRs are sorted by the Last Modified column in descending order.

Intelligence Requirement Options

An IR’s ⋯ menu provides the following options for managing the IR:

• Follow or Unfollow: Follow or unfollow the IR.
• Delete: Delete the IR from your Organization. This option is available only if your user account has permission to delete IRs in the IR’s owner.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20075-10 v.01.A