Search for entity types

The following query strings enable you to search for specific entity types.

Query string

Returns

data.type:campaign

All campaign entity types.

data.type:course-of-action

All course of action entity types.

data.type:exploit-target

All exploit target entity types.

data.type:eclecticiq-sighting

All sighting entity types.

data.type:incident

All incident entity types.

data.type:indicator

All indicator entity types.

data.type:report

All report entity types.

data.type:threat-actor

All threat actor entity types.

data.type:ttp

All TTP entity types.

Search result limitations

Search results are returned in paginated views. At the bottom of the search result view, you can see the total amount of matches, as well as the total amount of pages. You can select displaying 10, 20, 50, or 100 search results per page.

If a search run yields more than 10,000 results, only the first 10,000 are displayed. It is possible to browse only through the first 10,000 results, regardless of the total amount of matches and pages displayed at the bottom of the search result view.

This limitation is intentional: usually, such a search tends to be too generic, and not useful. In such cases, the best thing to do is to fine-tune the search to make it more specific, so that it returns fewer, more relevant, matches.

images/download/attachments/38961823/search-entities-limitation.png
If a search run yields more than 10000 results, only the first 10000 are displayed.