Filter entities by TLP#
Filter entities by Traffic Light Protocol (TLP) color code to retrieve information based on how sensitive it is and who it can be shared with.
Using TLP as a search or filter mechanism returns only exact TLP color matches:
Setting a TLP filter or quick filter to
GREEN
returns only entities whose TLP value is “green”.A search for
meta.tlp_color:AMBER
returns only entities whose TLP value is “amber”.Entities with no TLP color value only show up in search or in filtered results if you enter
NONE
as filter or search term.
Search entities by TLP color#
Searching for Amber+Strict
In EclecticIQ, the tlp color amber+strict
is stored as AMBER_STRICT
in the backend.
If you want your query to return entities whose tlp is
amber+strict, include
meta.tlp_color:(AMBER_STRICT)
.
In the search field, enter
meta.tlp_color:()
with between the brackets either:A single TLP color name in uppercase characters.
Multiple TLP color names in uppercase characters separated with the boolean operator “OR”.
Example
meta.tlp_color:(GREEN)
: returns entities whose TLP color is “green”.meta.tlp_color:(CLEAR OR WHITE)
: returns entities whose TLP color value is either “clear” or “white”.meta.tlp_color:(AMBER OR AMBER_STRICT OR RED )
: returns entities whose TLP color value is either “amber”, “amber+strict”, or “red”.(Optional) Add additional search terms.