Filter entities by TLP#
Filter entities by Traffic Light Protocol (TLP) color code to retrieve information based on how sensitive it is, and on the appropriate recipients it can be shared with.
When TLP works as a search or as a filter mechanism, a TLP color
selection returns only exact matches.
For example:
Setting a TLP filter or quick filter to green matches only entities whose TLP value is green .
A search for
meta.tlp_color:AMBER
returns only entities whose TLP value is amber .
Entities with no TLP color value do not show up in search or in filtered results.
To search for entities flagged with a specific TLP color code:
In the search field, prepend the following JSON path to the TLP color code you want to use as a search criterion:
meta.tlp_color
:Enter one or more TLP color names in all uppercase characters. A pipe ( | ) character represent the Boolean operator
OR
.
Example
/* Searches for entities whose TLP color code is 'RED'. */
meta.tlp_color:RED
/* Searches for entities whose TLP color code is 'AMBER'. */
meta.tlp_color:AMBER
/* Searches for entities whose TLP color code is 'GREEN'. */
meta.tlp_color:GREEN
/* Searches for entities whose TLP color code is 'WHITE'. */
meta.tlp_color:WHITE
/* Searches for entities whose TLP color code is either 'WHITE' or 'GREEN'. */
meta.tlp_color:(WHITE | GREEN )
/* Searches for entities whose TLP color code is 'RED', 'WHITE', or 'AMBER'. */
meta.tlp_color:(RED | WHITE | AMBER)