--- title: "Searching Victim Assets | ThreatConnect" slug: "searching-victim-assets" description: "This article describes how to use the Search: Victim Assets screen to view, search, delete, and analyze Victim Assets in your ThreatConnect owners." tags: ["Viewing Data"] updated: 2026-01-10T19:58:15Z published: 2026-01-10T19:58:15Z canonical: "knowledge.threatconnect.com/searching-victim-assets" --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Searching Victim Assets ## Overview The [**Search** screen](https://knowledge.threatconnect.com/docs/searching-in-threatconnect) in ThreatConnect® provides a single location to search and browse your data. You can [search all object types](https://knowledge.threatconnect.com/docs/searching-all-object-types) in your ThreatConnect dataset using keywords or phrases, or you can browse threat intelligence data by object type and filter those data to a usable and relevant subset based on details like name/summary, object subtype, owner, and metadata such as Tags, Security Labels, and Attributes. On the **Search: Victim Assets**screen, you can search and filter all [Victim Assets](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#victim-assets) in your [ThreatConnect owners](https://knowledge.threatconnect.com/docs/ownership-in-threatconnect) using basic search queries or using advanced search queries written in [ThreatConnect Query Language (TQL)](https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql); delete Victim Assets individually or in bulk; and further investigate Victim Assets that are of interest to you. ## Before You Start ### User Roles - To view and search Victim Assets in an Organization, your user account can have any [Organization role](https://knowledge.threatconnect.com/docs/organization-roles). - To view and search Victim Assets in a Community or Source, your user account must have a [Community role](https://knowledge.threatconnect.com/docs/community-roles) of User, Commenter, Contributor, Editor, or Director for that Community or Source. - To delete Victim Assets in an Organization, your user account must have an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer. - To delete Victim Assets in a Community or Source, your user account must have a Community role of Editor or Director for that Community or Source. ## Viewing All Victim Assets When you first open the **Search: Victim Assets**screen, it displays a table listing all Victim Assets in your ThreatConnect owners. You can access the **Search: Victim Assets**screen by selecting **Victim Assets**from the **Search & Create**dropdown on the top navigation bar or by selecting the **Victim Assets**filter in the left sidebar of the **Search**screen. To view more details about a Victim Asset, do one of the following: - Click the Victim Asset’s table row, or click the Victim Asset’s [**Options ⋯**menu](/docs/searching-victim-assets#victim-asset-options) and select **View Details,**to open the Victim Asset’s [**Details**drawer](https://knowledge.threatconnect.com/docs/the-details-drawer). - Click the name of the Victim to which the Victim Asset belongs to open the Victim’s [**Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy), and then click the **Assets**tab on the Victim’s **Details**screen. HintYou can adjust the columns displayed in the table on the **Search: Victim Assets**screen by clicking **Select columns![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Select%20columns%20button.png)**in the upper right, selecting the columns to display, and clicking **Apply**. ## Searching and Filtering Victim Assets On the **Search: Victim Assets**screen, you can search and filter Victim Assets in your ThreatConnect owners by running the following types of searches: - [Basic search](/docs/searching-victim-assets#running-basic-searches) - [Advanced search](/docs/searching-victim-assets#running-advanced-searches) - [Search using a saved query](/docs/searching-victim-assets#running-searches-using-saved-queries) To remove all filters and search criteria applied on the **Search: Victim Assets**screen, click **Clear all filters & search![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Clear%20all%20filters%20&%20search%20button.png)**in the upper right. ### Running Basic Searches A basic search lets you search Victim Assets using the search bar and various filter options on the **Search: Victim Assets**screen. Follow these steps to run a basic search of Victim Assets on the **Search: Victim Assets**screen: 1. From the **Search & Create**dropdown on the top navigation bar, select **Victim Assets**. 2. Configure a basic search query by doing the following: - Enter text into the search bar to [search Victim Assets by name/summary](/docs/searching-victim-assets#searching-by-namesummary). To run a [contains search](/docs/searching-victim-assets#contains-search), leave the **Exact Match**checkbox cleared. To run an [exact match search](/docs/searching-victim-assets#exact-match-search), select the **Exact Match**checkbox. - Use the Victim Asset type dropdown and **Filters![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Filters%20button_Details%20screen.png)**menu to [filter Victim Assets](/docs/searching-victim-assets#filtering-victim-assets) by type and Victim Asset metadata, respectively. As you configure a basic search query, the results table updates automatically based on the current search criteria. #### Searching by Name/Summary When searching Victim Assets by name/summary on the **Search: Victim Assets**screen, you can run two types of searches: [contains](/docs/searching-victim-assets#contains-search) and [exact match](/docs/searching-victim-assets#exact-match-search). NoteName/summary searches are case insensitive. ##### Contains Search A contains search lets you filter Victim Assets based on whether their name/summary contains the text entered into the search bar on the **Search: Victim Assets**screen. Use a contains search when you want to filter your dataset to find Victim Assets that relate to a common keyword or phrase. Table 1 describes the search result behavior of a contains search for **jane.doe**. | Victim Asset Name/Summary | Returned as Result? | | --- | --- | | JANE.DOE | Yes, because the name/summary contains the entire term **jane.doe**. | | jane.doe@abcmail.com | Yes, because the name/summary contains the entire term **jane.doe**. | | janedoesblog.com | No. Although the name/summary contains **jane**and **doe**, they are not separated by a period. | | doe.jane | No. Although the name/summary contains **jane**and **doe**and they are separated by a period, they are not in the same order as the term **jane.doe**. | To run a contains search on the **Search: Victim Assets**screen, enter text into the search bar and leave the **Exact Match**checkbox cleared. ##### Exact Match Search An exact match search lets you filter Victim Assets based on whether their name/summary is an exact match to the text entered into the search bar on the **Search: Victim Assets**screen. Use an exact match search when you want to search a large dataset for a specific object, as this type of search yields a more targeted set of search results. Table 2 describes the search result behavior of an exact match search for **jane.doe**. | Victim Asset Name/Summary | Returned as Result? | | --- | --- | | JANE.DOE | Yes, because the name/summary is an exact match to the term **jane.doe**. | | jane.doe@abcmail.com | No, because the name/summary is not an exact match to the term **jane.doe**. | | janedoesblog.com | No, because the name/summary is not an exact match to the term **jane.doe**. | | doe.jane | No. Although the name/summary contains **jane**and **doe**and they are separated by a period, they are not in the same order as the term **jane.doe**. | To run an exact match search on the **Search: Victim Assets**screen, enter text into the search bar and select the **Exact Match**checkbox to the right of the search bar or surround the phrase in straight quotes. ImportantThe search engine does not recognize smart quotes (`“”`). If you copied a search phrase from an application and pasted it into the search bar, replace all smart quotes with straight quotes (`"`) before running your search. #### Filtering Victim Assets The **Search: Victim Assets**screen provides the following options for filtering Victim Assets when running basic searches: - The Victim Asset type dropdown next to the **Exact Match**checkbox lets you filter Victim Assets by one or more Victim Asset types. Victim Assets are filtered automatically as you select options from the dropdown. - The **Filters**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Filters%20button_Details%20screen.png)menu lets you filter Victim Assets by Victim Asset metadata. After selecting and configuring filters, click **Apply**. Victim Assets may be filtered by the following metadata: - Victim - Asset (e.g., email address type, network account type, social network type) ### Running Advanced Searches An advanced search lets you search and filter Victim Assets using a query written in [ThreatConnect Query Language (TQL)](https://knowledge.threatconnect.com/docs/threatconnect-query-language-tql). Advanced searches enable you to perform highly targeted searches of Victim Assets using criteria that cannot be defined when running basic searches. Follow these steps to run an advanced search of Victim Assets on the **Search: Victim Assets**screen: 1. From the **Search & Create**dropdown on the top navigation bar, select **Victim Assets**. 2. Turn on the **Advanced Search**toggle above the search bar. 3. Enter a [TQL query](https://knowledge.threatconnect.com/docs/constructing-query-expressions) into the search bar. If you configured a basic search query before turning on the **Advanced Search**toggle, the query will be converted into a TQL query and populated in the search bar automatically.HintYou can use the [TQL Generator](https://knowledge.threatconnect.com/docs/tql-generator) to translate plain-English prompts into TQL queries. 4. Click **Search![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Search%20drawer%20icon.png)**to the right of the search bar, or press **Enter**on your keyboard, to run your search.NoteIf a TQL query is invalid, you can hover over the validator on the left side of the search bar to view the corresponding error message.NoteIf you run an advanced search using a query that matches a [saved query](https://knowledge.threatconnect.com/docs/saved-search-queries), the saved query will be selected in the **Select Saved Query…**dropdown automatically. ### Running Searches Using Saved Queries When using the basic or advanced search features on the **Search: Victim Assets**screen, you can run a search using a saved query. Follow these steps to use a saved query to search Victim Assets on the **Search: Victim Assets**screen: 1. From the **Search & Create**dropdown on the top navigation bar, select **Victim Assets**. 2. From the **Select Saved Query…**dropdown in the upper right, select a saved query to run. After you select a saved query, the **Advanced Search**toggle turns on and a search using the selected query runs automatically. HintTo save basic or advanced search queries, click **Save Query**in the upper right of the **Search: Victim Assets**screen. For more information, see [*Saved Search Queries*](https://knowledge.threatconnect.com/docs/saved-search-queries). ## Sorting Victim Assets You can sort Victim Assets by any of the table columns. By default, Victim Assets are sorted by the **Name/Summary**column in alphabetical order. ## Deleting Victim Assets in Bulk Follow these steps to delete a set of Victim Assets in bulk on the **Search: Victim Assets**screen: 1. From the **Search & Create**dropdown on the top navigation bar, select **Victim Assets**. 2. (Optional) Run a [basic](/docs/searching-victim-assets#running-basic-searches) or [advanced](/docs/searching-victim-assets#running-advanced-searches) search. 3. From the **Options** **⋯**menu in the upper-right corner, select **Delete Returned Objects…**. 4. On the **Delete Returned Objects**window, click **Delete** to delete all Victim Assets in the results table. If you are deleting more than 50 Victim Assets, you must enter “delete” (without quotation marks) into the **Confirm Deletion**field before you can click **Delete**.WarningAll Victim Assets in the results set will be deleted, not just the Victim Assets displayed on the current page of the results table. ## Victim Asset Options A Victim Asset’s **Options ⋯**menu provides the following options for managing and analyzing the Victim Asset: - **View Details**: Open the Victim Asset’s [**Details**drawer](https://knowledge.threatconnect.com/docs/the-details-drawer).HintYou can also open the Victim Asset’s **Details**drawer by clicking on its table row. - **Delete**: Delete the Victim Asset from its owner. This option is available only if your user account has permission to delete Victim Assets in the Victim Asset’s owner. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20075-12 v.02.A