Back to Documentation

Soltra Edge Search

With Soltra Edge, you now have the ability to accelerate your workflow with additions of tags and full-tech search!

Soltra Edge contains a full-text search capability that replaces the object catalog from previous versions. Searches can include full-text keywords and key/value terms. The new search capability provides results at human-interactive speed and scales to millions of indicators stored in the database. Search results can be bookmarked in the browser and shared with other users using the URL.

FYI - Search keys are case sensitive!


  • type:obs works
  • TYPE:OBS, Type:obs, type:OBS does not work


Multiple key:values are ANDed together. OR is not supported.

Uses for Search

  • Free text
    • Typing anything into search and looking for the text typed in any object in your database


Note: Search will not return results if values are used containing the following characters (: and /).

If your search value is for example you can search the following:

  1. https
  3. alotmorebad
  4. .com


  • ns: (namespace)
    • key is case sensitive but value is not



  • tlp:(NONE, WHITE, GREEN, AMBER, RED, white, green, amber, red)
    • key is case sensitive but value is not
    • QueryError('TLP must be one of %s')



  • type:{act, cam, coa, inc, ind, obs, pkg, tgt, ttp} (key and value are case sensitive)
  • subtype:{fileobjecttype, domain-watchlist, host-characteristics, ip-watchlist, imsi-watchlist, mutexobjecttype, compromised-pki-certificate, malicious-e-mail, artifactobjecttype, malware-artifacts, anonymization, emailmessageobjecttype, uriobjecttype,file-hash-watchlist, addressobjecttype, c2, windowsregistrykeyobjecttype, domainnameobjecttype, hostnameobjecttype, exfiltration, socketaddressobjecttype, url-watchlist,login-name, imei-watchlist}
    • key is case sensitive and value is not
    • QueryError('Subtype "%s" not found.')



  • day:{(0)d}
    • day:06 == day:6
    • key is case sensitive



  • month:{(0)m}
    • month:06 == month:6
    • key is case sensitive




  • year:{(0)yyyy}
    • key is case sensitive



  • upload:{upload id}
    • Use in the /uploads/ page



This upload ID is found by accessing the "User Uploads" area of the "Upload: page in Soltra Edge.





For more information, join the conversation in the Soltra Edge Forums at