First Steps for All Users

Conduct a basic observable search

ThreatStream provides your organization with a multitude of threat intelligence data. Familiarizing yourself with the basic and advanced search functions on ThreatStream is an important first step in making all of that data work for you.

Basic search on ThreatStream is a full text search. Basic search is recommended when searching for a keyword in any of the available fields. You can perform a basic search from the search bar in the top navigation bar or the Observables page.

Start out by performing a basic search for your domain or organization name.

To read more about conducting basic searches, see Performing Basic Observable Searches.

Conduct an advanced observable search

Advanced search enables you to add additional metadata to your query and restrict the search to specific fields. Use Advanced search when searching for a specific value in a specific field.

A great way to familiarize yourself with performing advanced searches in ThreatStream is to conduct a structured search. This involves selecting filters from basic search and then switching to advanced search. The filters you selected will automatically populate the search bar as an advanced search query.

To read more about conducting advanced searches, see Performing Advanced Observable Searches.

Save an advanced search

You can save frequently used advanced search queries as filters. Saving filters enables you to perform common queries with the click of a button. Saved filters can be accessed from the Search filter menu on the advanced search bar.

To read more about saving advanced search queries, see Saving Observable Search Filters.

To read more about how search works in ThreatStream, see Searching Intelligence in ThreatStream.

The Overview Dashboard gives you an overview of the observables relevant to your organization in real time, displays any alerts that require your immediate action, and enables you to drill down on summaries for deeper analysis. To learn more about the ThreatStream Dashboard, read A Tour of the ThreatStream Overview Dashboard .

The Weekly Summary page contains weekly summaries regarding organization data and ThreatStream Integrator status. Reports are a great way to gauge data fidelity, the importing activities of organization users, the effectiveness of various data feeds, and more. To read more about the information provided by the Weekly Summary page, read Viewing Weekly Summaries for Your Organization.

Explore enables you to visualize relationships between observables that would be difficult to comprehend otherwise. You can pivot on observables without having to manually cross reference dozens of observable details pages.

To learn more about how to use Explore, read Analyzing Adversary Infrastructure with Explore.

Sandboxes provide a secluded environment to run Malware and review the results without compromising your primary systems. On ThreatStream, you can upload potentially compromised files or link to suspicious URLs.

To learn more about sandbox, read Analyzing Malware with the ThreatStream Sandbox.

Threat Bulletins are analyst-written articles that provide information about events. They consist of threat event summaries, tags associated with events (an alias by which the event may also be known), details of the event, any observables associated with the event, and more. As part of the Anomali Threat Model, there are many Threat Bulletins available for you to read from across the threat intelligence landscape. For more on accessing Threat Bulletins, see Accessing Threat Models.

Email subscriptions control which notifications you receive from ThreatStream and keep you up to date on the latest threat intelligence impacting your organization, including configured rules (formerly known as keyword alerts). For more on managing your email subscriptions, read Receiving Notifications from ThreatStream.

The Downloads page on ThreatStream is full of helpful resources including the ThreatStream Integrator installation guide, release notes, clients, integration information, browser extensions, the API reference guide, and more. To access the Downloads page, click Downloads within the help menu in the ThreatStream top navigation bar.

Anomali provides comprehensive technical documentation for ThreatStream. The ThreatStream online help center is context sensitive, so whenever you click Help in the top navigation bar you are shown the help article relevant to the current page you are on in ThreatStream.

To start from the online help landing page, see Welcome to the ThreatStream Help Center!

ThreatStream enables you to create your own unique user profile. After doing so, you can interact with the wider Anomali community including users outside of your organization. You can also Watch, Star, Like, and Share Threat Model entities and Sandbox Reports for the purposes of tracking, rating, and sharing intelligence with other users.

For more information, read Participating in the Anomali Community.