Search by destinations

Search for entities and observables published through an outgoing feed based on the feed name, type, or ID.

About destinations

When you publish Intelligence Center content through outgoing feeds, you make the published content available to their intended recipients. The intended recipients are the targets, the destinations, of the published content.

You can search the Intelligence Center to retrieve information based on its intended destination. You can specify the name, type, or UUID of an outgoing feed in the search query, and use it to retrieve data published through that feed.

Search by destinations

To search by destination, specify the outgoing feed whose content you want to look up.
You can search for an outgoing feed by specifying the feed name, the feed type, or the feed ID.

Search by destination name

The name corresponds to the current value of the Feed name field for the specified outgoing feed.

To search Intelligence Center content by destination name:

  1. In the side navigation bar click the search icon .

  2. In the search input field, enter destinations.name:"${name of the outgoing feed}"

  3. Press ENTER on your keyboard.

Example:

destinations.name:"Vogon-sponsored APT groups"

If you rename an outgoing feed, all entities published through the feed before renaming it do not update their destination.name field accordingly.

To search for all the entities published through such a feed – so before and after renaming the feed – build an OR search query where you specify the previous and the current outgoing feed names.

Example:

  1. An outgoing feed is named "The Main Street Singers".

  2. It runs and it publishes content – entities and observables.

  3. The feed is renamed to "The New Main Street Singers".

  4. To search for all the entities published through such a feed, build the following search query:
    destinations.name:"The Main Street Singers" OR destinations.name:"The New Main Street Singers"

Search by destination type

The type corresponds to the current value of the Transport type field for the specified outgoing feed.

To search Intelligence Center content by destination type:

  1. In the side navigation bar click the search icon .

  2. In the search input field, enter destinations.type:"${transport type of the outgoing feed}"

  3. Press ENTER on your keyboard.

Example:

destinations.type:"HTTP download"

Search by destination ID

The ID corresponds to the unique UUID value that is automatically assigned to the specified outgoing feed upon creation.

To search Intelligence Center content by destination ID:

  1. In the side navigation bar click the search icon .

  2. In the search input field, enter destinations.id:${UUID of the outgoing feed}

  3. Press ENTER on your keyboard.

Example:

destinations.id:42

Retrieve a feed ID

Each Intelligence Center feed is automatically assigned a UUID upon creation.
This UUID, or ID for short, uniquely identifies a feed in the Intelligence Center.

To retrieve an outgoing feed ID:

  1. In the left navigation bar, select Data configuration images/download/attachments/82474796/robot.svg-x24.png > Outgoing feeds.

  2. In the Outgoing feeds overview, click anywhere in the row corresponding to the outgoing feed whose ID you want to retrieve.

  3. In the web browser address bar, the URL of the active Intelligence Center view is similar to the following example:
    https://${platform_host_name}/main/configuration/outgoing-feeds?detail=42
    In the URL, the detail URL parameter holds the feed ID.
    In the example, the ID value is 42.