Feedback:

tsquery

Use the tsquery operator to search ThreatStream observable or threat model data.

Syntax

|tsquery type=<type> search='<search>' [aggs=<aggs>] [histogram=<boolean>]

type=<type>

Specify a search type:

  • ioc: Search ThreatStream observables.

  • threatmodel: Search ThreatStream threat model entities.
search=<search>

Specify a ThreatStream search expression as you would in the ThreatStream advanced search bar. For information about ThreatStream search expressions, refer to the following ThreatStream online help topics:
aggs=<aggs>

Specify a ThreatStream observable or threat model field to aggregate.

histogram=<boolean>

Specify true to return aggregated data as time series data. If not specified, the implicit default is false.

Usage

You can use the tsquery operator to perform a ThreatStream observables search or threat model search. Returning aggregated data for time series charts is optional. If you specify the histogram=true option, you must also specify an aggs argument.

Examples

Example 1: Query indicators of compromise with active status and tags matching search criteria.

Copy 
<lookuptable>|tsquery type=ioc search='(status = "active") AND (tag contains test) AND created_ts>30d' aggs='itype'

Example 2: Query threat models of type tipreport and aggregate by feed identifier.

Copy 
<lookuptable>|tsquery type=threatmodel search='(model_type=tipreport)' aggs='feed_id'

Example 3: Query threat models with specified criteria and aggregate results.

Copy 
<lookuptable>|tsquery type=threatmodel search='(model_type=

Example 4: Queries the threat intelligence IOC store for active IOCs tagged with test that were created within the last 20 days, enriching the OCSF pipeline with matching threat indicator results.

Copy 
ocsf | tsquery type=ioc search= '(status = "active") AND (tag contains test) AND created_ts > 20d'