Advanced Searching: Bulk IOC Search & Bulk Actions

ThreatConnect 101  

Advanced Searching: Bulk IOC Search & Bulk Actions

This video demonstrates advanced searching functionalities in ThreatConnect, specifically focusing on handling bulk indicators of compromise (IOCs) and leveraging complex queries. 

Guide: Advanced Searching: Bulk IOC Search & Bulk Actions

Real-world SOC and IR work often means checking dozens, hundreds, or even thousands of indicators at once. This guide covers ThreatConnect's bulk search and bulk action tools, which turn a manual triage task into a matter of seconds.

Key Steps:

1. From the global search page, click the Bulk Search toggle in the top left.
2. Upload a file (a CSV of indicator values) or paste your indicator list directly.
3. Review the results, which show every indicator from your list alongside its Threat Assess Score (if known), the IOC value, which owner/source already has it, and whether it's Known or Unknown to your instance.
4. Sort by Threat Assess Score (descending) to immediately surface your highest-priority indicators.
5. Filter to Unknown to see indicators your instance doesn't have yet. Select them and choose Add to Organization to bring them into the platform for further analysis and enrichment.
6. Switch back to All Results. Filter down to your highest-scored indicators if you want to focus on a specific subset.
7. Select the indicators you want to act on and apply a bulk action: Add Tags (to label all selected indicators at once, for example “high-priority” or an incident name) or Export (to hand the full list, including Threat Assess Scores, back to a requesting team with prioritization built in).
8. To close the loop on a full triage workflow:
   
   Receive an IOC list → bulk search it in ThreatConnect → identify known vs. unknown → add unknown indicators to your org → sort by Threat Assess Score → export the enriched list back to the requesting team

   
   

Good to know:

• Bulk search only works on indicators. It doesn't search groups, reports, or other object types.
• You can only tag indicators in sources where you have write access. If bulk tagging applies to fewer indicators than expected, check permissions.
• Indicators you add via bulk search land in your own organization's source. Check there if you can't find something you just added.
• Newly added indicators are “bare” until you add context. Tag them, rate them, or associate them with other objects so they're more than just numbers in a database.
• For very large exports, the UI may have volume limits; for bulk programmatic export, use the API instead.