Intelligence Search

The Intelligence Search page provides a unified search experience across all historical observables, threat models, and feed data. You can receive AI-generated natural language explanations of how observables relate to threat motivations and threat models — turning raw search results into actionable context.

The search box on the Intelligence Search page queries all available observables and threat model entities in a single search. Search queries are not case sensitive and results are returned regardless of case.

Fields Queried in Intelligence Searches

Universal search queries observable values for observables and Aliases, Descriptions, Names, and Tags for threat model entities.

Below is an example of search results for the query Criminal.

(Click the image to enlarge it.)

Entered keyword that returned the results below.

Metadata that includes earliest created and last modified date, source, country of origin, severity, confidence, and status.

Anomali AI-generated executive summary for the query search results.

Intelligence associated with the results returned: observables, threat models, and investigations. You can click any of the listed items to drill down into their details.

Associated intelligence: Threat models associated with the intelligence returned in search results.

Observable Trend: Select the time range for the observable trend. Available options include: 7 days, 30 days, and 90 days.