Searching Tags

Overview

The Search screen in ThreatConnect® provides a single location to search and browse your data. You can search all object types in your ThreatConnect dataset using keywords or phrases, or you can browse threat intelligence data by object type and filter those data to a usable and relevant subset based on details like name/summary, object subtype, owner, and metadata such as Tags, Security Labels, and Attributes.

On the Search: Tags screen, you can search and filter all standard Tags in your ThreatConnect owners and ATT&CK^® Tags using basic search queries or using advanced search queries written in ThreatConnect Query Language (TQL), delete standard Tags individually, and further investigate Tags that are of interest to you.

Before You Start

User Roles

• To view and search standard Tags in an Organization and ATT&CK Tags, your user account can have any Organization role.
• To view and search standard Tags in a Community or Source, your user account can have any Community role except Banned for that Community or Source.
• To delete standard Tags in an Organization, your user account must have an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer.
• To delete standard Tags in a Community or Source, your user account must have a Community role of Editor or Director for that Community or Source.

Viewing All Tags

When you first open the Search: Tags screen, it displays a table listing all standard Tags in your ThreatConnect owners and ATT&CK Tags. You can access the Search: Tags screen by selecting Tags from the Search & Create dropdown on the top navigation bar or by selecting the Tags filter in the left sidebar of the Search screen.

To view more details about a Tag, do one of the following:

• Click the Tag’s table row, or click the Tag’s ⋯ menu and select View Details, to open the Tag’s Details drawer.
• Click the Tag’s name/summary to open the Tag’s Details screen.

Hint

You can adjust the columns displayed in the table on the Search: Tags screen by clicking Select columnsin the upper right, selecting the columns to display, and clicking Apply.

Searching and Filtering Tags

On the Search: Tags screen, you can search and filter standard Tags in your ThreatConnect owners and ATT&CK Tags by running the following types of searches:

• Basic search
• Advanced search
• Search using a saved query

To remove all filters and search criteria applied on the Search: Tags screen, click Clear all filters & searchin the upper right.

Running Basic Searches

A basic search lets you search Tags using the search bar and various filter options on the Search: Tags screen. Follow these steps to run a basic search of Tags on the Search: Tags screen:

1. From the Search & Create dropdown on the top navigation bar, select Tags.
2. Configure a basic search query by doing the following:
   • Enter text into the search bar to search standard and ATT&CK Tags by name/summary or ATT&CK Tags by technique ID. To run a contains search, leave the Exact Match checkbox cleared. To run an exact match search, select the Exact Match checkbox.
   • Use the Tag type dropdown, owner dropdown, and Filtersmenu to filter Tags by type, owner, and Tag metadata, respectively.

As you configure a basic search query, the results table updates automatically based on the current search criteria.

Searching by Name/Summary or Technique ID

When searching standard and ATT&CK Tags by name/summary or ATT&CK Tags by technique ID on the Search: Tags screen, you can run two types of searches: contains and exact match.

Contains Search

A contains search lets you filter Tags based on whether their name/summary contains the text entered into the search bar on the Search: Tags screen. It also lets you filter ATT&CK Tags based on whether their technique ID contains the text entered into the search bar on the Search: Tags screen.

Use a contains search when you want to filter your dataset to find Tags that relate to a common keyword or phrase or to find ATT&CK Tags associated with a specific technique ID. Table 1 describes the search result behavior of a contains search for helix kitten.

To run a contains search on the Search: Tags screen, enter text into the search bar and leave the Exact Match checkbox cleared.

Exact Match Search

An exact match search lets you filter Tags based on whether their name/summary is an exact match to the text entered into the search bar on the Search: Tags screen. It also lets you filter ATT&CK Tags based on whether their technique ID is an exact match to the text entered into the search bar on the Search: Tags screen.

Use an exact match search when you want to search a large dataset for a specific object, as this type of search yields a more targeted set of search results. Table 2 describes the search result behavior of an exact match search for helix kitten.

To run an exact match search on the Search: Tags screen, enter text into the search bar and select the Exact Match checkbox to the right of the search bar or surround the phrase in straight quotes.

Filtering Tags

The Search: Tags screen provides the following options for filtering Tags when running basic searches:

• The Tag type dropdown next to the Exact Match checkbox lets you filter Tags by one or more Tag types. Tags are filtered automatically as you select options from the dropdown.
• The owner dropdown next to the Filtersmenu lets you filter Tags by one or more owners. Tags are filtered automatically as you select options in the dropdown.
• The Filtersmenu lets you filter Tags by Tag metadata. At this time, the only Tag metadata you can filter Tags by is the last used date. After configuring the Last Used filter, click Apply.

Running Advanced Searches

An advanced search lets you search and filter Tags using a query written in ThreatConnect Query Language (TQL). Advanced searches enable you to perform highly targeted searches of Tags using criteria that cannot be defined when running basic searches.

Follow these steps to run an advanced search of Tags on the Search: Tags screen:

1. From the Search & Create dropdown on the top navigation bar, select Tags.
2. Turn on the Advanced Search toggle above the search bar.
3. Enter a TQL query into the search bar. If you configured a basic search query before turning on the Advanced Search toggle, the query will be converted into a TQL query and populated in the search bar automatically.
   Hint

   You can use the TQL Generator to translate plain-English prompts into TQL queries.
4. Click Searchto the right of the search bar, or press Enter on your keyboard, to run your search.
   Note

   If a TQL query is invalid, you can hover over the validator on the left side of the search bar to view the corresponding error message.
   Note

   If you run an advanced search using a query that matches a saved query, the saved query will be selected in the Select Saved Query… dropdown automatically.

Running Searches Using Saved Queries

When using the basic or advanced search features on the Search: Tags screen, you can run a search using a saved query. Follow these steps to use a saved query to search Tags on the Search: Tags screen:

1. From the Search & Create dropdown on the top navigation bar, select Tags.
2. From the Select Saved Query… dropdown in the upper right, select a saved query to run.

After you select a saved query, the Advanced Search toggle turns on and a search using the selected query runs automatically.

Sorting Tags

You can sort Tags by any of the table columns except for the Type and Synonymous Tags columns. By default, Tags are sorted by the Last Used column in descending order.

Tag Options

A Tag’s ⋯ menu provides the following options for managing and analyzing the Tag:

• Follow or Unfollow: Follow or unfollow the Tag.
• Threat Graph: Open Threat Graph to visualize, explore, and analyze the Tag’s associations (that is, the objects to which the Tag is applied).
• View Details: Open the Tag’s Details drawer.
  Hint

  You can also open the Tag’s Details drawer by clicking on its table row.
• Delete: (Standard Tags only) Delete the Tag from its owner. This option is available only if your user account has permission to delete Tags in the Tag’s owner.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

20075-11 v.01.A