Basic Search & Search Results

ThreatConnect 101  

Basic Search & Search Results

This video details how to utilize the search feature within the threat platform to locate relevant intelligence effectively.  

Guide: Basic Search & Search Results

Search is how you'll interact with ThreatConnect every day, whether you're checking a suspicious IP, looking up a CVE, or finding every report on a threat actor. This guide walks through the global search bar, how to read your results, and how to filter them down.

Key Steps:

1. Click the search bar at the top of any screen and enter a search term; for example, a specific CVE ID.
2. Review the preview list of closest matches. For a CVE search, the matching vulnerability (Group) object typically appears at the top.
3. Click into the preview to expand details without leaving the results page, or click the pop-out icon to open the full details page.
4. Click “View All Results” to open the global search results view and review the available columns: Why it matched, Object type, Name, Owner, Tags, Threat Assess Score (for indicators), and Date Added / Last Modified.
5. Hide any columns you don't need to reduce visual clutter. For example, remove Threat Assess Score or Tags if they're not relevant to your current task.
6. Use the object type filter to narrow results. For example, filter down to just Groups, then further to just Vulnerabilities, to remove noise like unrelated tags or events.
7. Use the Filters option for more granular control: filter by date added/modified, by why an item matched, and (for indicators) by Threat Assess Score range.
8. Toggle Exact Match on to remove partial matches and return only objects that match your search term precisely. It's a good habit to start with Exact Match on, especially for CVEs, IPs, or actor names - it saves you from filtering down step by step afterward.
9. From any result row, use the available quick actions: preview the object, pop out to its full details page, pivot into the Threat Graph, or create a report tied to that object.

Good to know:

• Global search casts a wide net, it searches object names, tags, attributes, and even text inside uploaded documents (including PDFs). If a result surprises you, that's usually why.
• The “Why it matched” column is easy to miss but is the fastest way to diagnose an unexpected result.
• Search results can include tag objects themselves, not just objects tagged with your search term. Use the object type filter to remove tag objects if they're cluttering your results.
• If results ever look incomplete, double-check your owner/source filter.