Search Operators

Advanced search on ThreatStream supports the search operators listed in the table below.

Operator Description
=

Searches for results that are identical to the value after the operator.

Note: The behavior of the = operator differs slightly when searching the tags field. See Tags Queries in Advanced Search for more information.

!= Searches for results that exclude the value after the operator.
contains

Searches for results that are composed partially or wholly of the value after the operator. Values specified after the contains operator must consist of 3 characters or more.

Note: The behavior of the contains operator differs slightly when searching the tags field. See Tags Queries in Advanced Search for more information.
startswith Searches for results that begin with the value after the operator.
endswith Searches for results that end with the value after the operator.
~

Searches for results that match the regular expression after the operator. Only valid for use in filter expressions that contain regular expressions.

Note: Avoid using regular expression operators in search queries. As an alternative, use the endswith, or startswith operators to search for specific phrase matches. If these alternative operators do not fulfill your use case, contact Anomali Support for assistance.

!~

Searches for results that do not match the regular expression after the operator. Only valid for use in filter expressions that contain regular expressions.

Note: Avoid using regular expression operators in search queries. As an alternative, use the endswith, or startswith operators to search for specific phrase matches. If these alternative operators do not fulfill your use case, contact Anomali Support for assistance.
insubnet Searches for results that fall within the subnetwork after the operator. See Subnet Queries in Advanced Search for more information.
!insubnet Searches for results that do not fall within the subnetwork after the operator. See Subnet Queries in Advanced Search for more information.
< Searches for results that are less than the numerical value or date after the operator. See the Data Types table for additional information about date data types.
<= Searches for results that are less than or equal to the numerical value or date after the operator. See the Data Types table for additional information about date data types.
> Searches for results that are greater than the numerical value or date after the operator. See the Data Types table for additional information about date data types.
>= Searches for results that are greater than or equal to the numerical value or date after the operator. See the Data Types table for additional information about date data types.
AND Searches for results that are included in both the filter expression before and the filter expression after the operator.
OR Searches for results that are included in either the filter expression before or the filter expression after the operator. Results included in both filter expressions are also returned.
NOT Searches for results that are excluded from the filter expression after the operator.

Each data type is compatible with certain search operators. The table below displays all of the valid operators and fields associated with each data type.

Data Type Valid Operators Field Names
String =, !=, contains, startswith, endswith, ~, !~, insubnet, !insubnet

status, type, itype, classification, value, severity, feed_group, ip, asn, country, org, tags, rdns, detail, maltype

Note:  

  • feed_group is a bulk collection of feeds and only supports the = and != operators.

  • The operators ~ and !~ can only be used with regular expressions. However, Anomali recommends the use of the startswith, and endswith operators instead of regular expressions.
Numeric =, !=, <, <=, >, >= confidence, stream_id, import_session_id, owner_id, trusted_circle_ids
Date =, !=, <, <=, >, >=

created_ts, modified_ts

Date can be specified as follows:

  • In this format: YYYY-MM-DDThh:mm:ss, where T denotes the start of the value for time. For example, 2014-10-02T20:44:35.
  • As a relative time unit, in this format: -<n><unit>, where n is a whole number and unit is w, d, h, m, s (for week, days, hour, minutes, and seconds, respectively). For example, 1d, 2w, 24h.
Note: When values such as 1d or 2w are specified, the search engine automatically interprets them as $NOW-<value> and searches for the appropriate time range. For example, created_ts >= 1d is interpreted as “created_ts >= $NOW-1d” and returns everything that has a timestamp greater than equal to NOW minus one day (that is, the time range is the last day). Conversely, created_ts <= 1d is interpreted as “created_ts<= $NOW-1d” and returns everything that has a timestamp less than NOW minus one day (that is, everything except the last day).
Boolean =, != is_public
Logical AND, OR, NOT

Joins together multiple expressions.

Example: confidence >= 90 AND itype = "apt_ip"