---
title: "ThreatConnect Query Language (TQL) | ThreatConnect"
slug: "threatconnect-query-language-tql"
description: "The article provides an overview of ThreatConnect Query Language (TQL) and highlights use cases for this feature."
status: "update"
updated: 2025-01-15T15:10:01Z
published: 2025-01-15T15:10:01Z
canonical: "knowledge.threatconnect.com/threatconnect-query-language-tql"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ThreatConnect Query Language (TQL)

## Overview

In ThreatConnect®, you can build structured queries with a SQL-like query language called ThreatConnect Query Language (TQL) to perform highly targeted searches of your data. A TQL query includes a parameter name, an operator, and a value or list of values, and you can combine multiple queries with parentheses and AND/OR logic.

Use cases for TQL in ThreatConnect include the following:

- Searching and filtering threat intelligence data with the advanced search feature on the **[](https://knowledge.threatconnect.com/docs/the-browse-screen)** [](https://knowledge.threatconnect.com/docs/the-browse-screen)[**Browse** screen](https://knowledge.threatconnect.com/docs/the-browse-screen) [](https://knowledge.threatconnect.com/docs/the-browse-screen)**[](https://knowledge.threatconnect.com/docs/the-browse-screen)**
- Visualizing data with Query cards in custom [dashboards](https://knowledge.threatconnect.com/docs/dashboards)
- [Creating associations between a Group and objects returned via a TQL query](https://knowledge.threatconnect.com/docs/the-associations-tab#tql-queries)
- Configuring query-based **[Chart](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report#chart)** and **[Table](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report#table)** sections in [reports](https://knowledge.threatconnect.com/docs/reports) and [report templates](https://knowledge.threatconnect.com/docs/report-templates)
- Selecting specific Groups to add as analysis layers to [standard ATT&CK® views](https://knowledge.threatconnect.com/docs/standard-attack-views) in the [ATT&CK Visualizer](https://knowledge.threatconnect.com/docs/attack-visualizer)
- Filtering data in responses returned from requests to the [ThreatConnect v3 API](https://threatconnect.readme.io/reference/filter-results-with-tql)

## In This Series

- [*Running Advanced Searches With TQL*](https://knowledge.threatconnect.com/docs/running-advanced-searches-with-tql): Learn how to run TQL queries on the **Browse** screen with the advanced search feature, save TQL queries, and manage saved TQL queries.
- *[Constructing Query Expressions](https://knowledge.threatconnect.com/docs/constructing-query-expressions)*: Learn how to construct TQL queries and view examples of TQL queries you can use in ThreatConnect.
- *[TQL Operators and Parameters](https://knowledge.threatconnect.com/docs/tql-operators-and-parameters)*: View all TQL operators and parameters currently available in ThreatConnect.
- *[TQL Generator](https://knowledge.threatconnect.com/docs/tql-generator)*: Learn about the TQL Generator, including how to generate TQL queries based on a prompt written in plain English and share feedback to help ThreatConnect improve the feature.

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.* *MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.*

20052-01 v.19.A

## Related

- [The Browse Screen](/the-browse-screen.md)
- [Dashboards](/dashboards.md)