Navigate | Search#
Searching in EclecticIQ Intelligence Center returns Entities and Observables from the data that has been ingested.
When searching Entities or Observables, you can use:
AI-powered search to turn a natural language question into a machine-readable query.
Search queries to get (relational) results.
Permissions for search#
Search results are filtered and made available based on the current user’s set of rights and permissions.
This means that users who have different access rights, and who run identical search queries on the same Intelligence Center instance, can receive different search results.
If a user runs a search query that returns matches including objects that the current user doesn’t have access to, they receive a notification message:
Some matches may be excluded due to access restrictions.
Search results include matches that the current user can access, based on:
The selected Allowed sources in the group configuration of the group(s) the user belongs to.
The TLP access level for the specified allowed sources in the group configuration of the group(s) the user belongs to.
The Permissions granted to the role assigned to the user.
Limitations#
Searches can only return up to 10,000 results. If your search should return more than 10,000 results, refine your search.
Synching your search database#
See Elasticsearch: Sync the search database for more information about synching your search database.