Searching for Observables in ThreatStream
ThreatStream enables you to search for specific observables. There are three observable search types: Basic, Advanced, and Bulk.
Selecting a Search Type
Basic search is a full text keyword search. If multiple keywords are specified, they are ANDed together. Use Basic search when you are looking for a keyword such as tags, content in a threat bulletin, iType, and so on in any of the available fields.
Advanced search enables you to add additional meta data to your query and restrict the search to specific fields. Use Advanced search when searching for a specific value in a specific field.
Bulk search enables you to look for a large number of keywords. The keywords are ORed together. Bulk search works only for observable values.