Back to Documentation

Soltra Edge Search

With Soltra Edge, you now have the ability to accelerate your workflow with additions of tags and full-tech search!

Soltra Edge contains a full-text search capability that replaces the object catalog from previous versions. Searches can include full-text keywords and key/value terms. The new search capability provides results at human-interactive speed and scales to millions of indicators stored in the database. Search results can be bookmarked in the browser and shared with other users using the URL.

FYI - Search is case sensitive!

Examples:

  • type:obs works
  • TYPE:OBS, Type:obs, type:OBS does not work

 

Multiple key:values are ANDed together. OR is not supported.

Uses for Search

  • Free text
    • Typing anything into search and looking for the text typed in any object in your database

 

  • ns: (namespace)
    • key is case sensitive but value is not

 

  • tlp:(NONE, WHITE, GREEN, AMBER, RED, white, green, amber, red)
    • key is case sensitive but value is not
    • QueryError('TLP must be one of %s')

 

  • type:{act, cam, coa, inc, ind, obs, pkg, tgt, ttp} (key and value are case sensitive)
  • subtype:{fileobjecttype, domain-watchlist, host-characteristics, ip-watchlist, imsi-watchlist, mutexobjecttype, compromised-pki-certificate, malicious-e-mail, artifactobjecttype, malware-artifacts, anonymization, emailmessageobjecttype, uriobjecttype,file-hash-watchlist, addressobjecttype, c2, windowsregistrykeyobjecttype, domainnameobjecttype, hostnameobjecttype, exfiltration, socketaddressobjecttype, url-watchlist,login-name, imei-watchlist}
    • key is case sensitive and value is not
    • QueryError('Subtype "%s" not found.')

 

  • day:{(0)d}
    • day:06 == day:6
    • key is case sensitive

 

  • month:{(0)m}
    • month:06 == month:6
    • key is case sensitive

 

 

  • year:{(0)yyyy}
    • key is case sensitive

 

  • upload:{upload id}
    • Use in the /uploads/ page

 

 

 

 

For more information, join the conversation in the Soltra Edge Forums at forums.soltra.com.