Comma-separated list of fields to sort on. Prefix a field with the minus "-" sign if you intend to apply descending sorting to it

Comma-separated list of attributes to be returned. Nested attributes are separated by dots - e.g. data.title

Filter by entity internal UUID

Filter by entity type

Filter by STIX ID

Filter by title

Filter by description

Filter by test mechanism type

Filter by producer identity

Filter by producer roles

Filter by entity alias

Filter by entity half-life

Filter by source(s)

Filter by incoming feed ID/URL

Filter by outgoing feed IDs/URLs

Filter by entity source reliability

Filter by tags

Filter by taxonomy node IDs/URLs

To filter out all unresolved entities, the correct filter is filter[!meta.is_unresolved_idref]=true.

Filter by TLP color

Filter by MITRE attack IDs/URLs. The filter also targets the parents. So if an entity is classified with a technique, filtering on the parent tactic is going to include such entity.

Filter by MITRE attack IDs/URLs. The filter also targets the explicitly classified ATT&CK. So if an entity is classified with a technique, filtering on the parent tactic is NOT going to include such entity.

Filter by dataset IDs/URLs. When multiple datasets are provided, if all of them are non-relational datasets, there is a single search query executed on the server, combining all filters. But, in case of multiple datasets that include at least a relational dataset, a union query is run on the server. A union query handles combination of both entity queries and entity-relational queries. The fetching from the contained queries is done sequentially by the given order of queries in the list... E.g. if queries=[q_1, q_2,..., q_m], union query will first iterate over result set of q_1, then over results of q_2, and finally over results of q_m. Due to this simplistic approach, there are some limitations of union query fetching mechanism

• results are sorted per each individual contained query, and not per the union query; - there might be duplicated items in result, because they occur in multiple contained queries.

Filter by observable IDs/URLs

Full-text or faceted search with logic operators like AND and OR. The value examples follow.

• "IoT Malware"
• data.title:malware OR data.description:APT17
• attached_files: *

The language of the search queries is Lucene and the capability is the same as the one in Intelligence Center UI. Read more in its documentation.