Search for enrichment observables
Besides full text search, you can use Boolean operators and wildcards.
You can combine these filtering options to create more refined searches.
Use Boolean operators to combine multiple quick filters, and to create a more complex search query.
Example:
enrichment_extracts.kind:domain AND enrichment_extracts.meta.classification:high
|
Field |
Type |
Description |
Example |
|
enrichment_extracts.id |
String |
The alphanumeric ID string that uniquely identifies the enrichment observable. |
01h12x45-01q2-1234-od01-123456h78h90 |
|
enrichment_extracts.kind |
String |
The enrichment observable data type. |
domain |
|
enrichment_extracts.meta.blacklisted |
Boolean |
An observable is blacklisted when it is included in the results returned by an ignore extraction rule. Allowed values:
|
true |
|
enrichment_extracts.meta.classification |
String |
This value is defined in Rules by selecting one of the available options under Action and Confidence. Allowed classification metadata values:
|
good |
|
enrichment_extracts.meta.confidence |
String |
This value is defined in Rules by selecting the appropriate option under Action and Confidence. The selected action must be Mark as malicious for the Confidence drop-down list to become available. Allowed confidence metadata values:
|
high |
|
enrichment_extracts.value |
String |
The actual value of the enrichment observable, based on the enrichment observable data type. |
doom.dismay.biz |