You can use the Search bar at the top of the TruSTAR Web App to find Intel Reports and Indicators that contain a specified term.
You can use the Filter feature to apply Enclave, date, tags and Indicator filters when searching.
Search return all results that have a complete match with the term you specified. The count of results returned is displayed directly below the Search bar.
- Click the IOCs count to display the Indicators that contain the search term.
- Click the Reports count to display the Intel Reports that contain the search term.
Searching with Wildcards
You can use the wildcard character * at the start or end of the search term to find partial matches. For example, if you want to search for all variants on a domain name, you can add a * after the main part of the domain. For example, you can use the term "acme.*" to find all occurrences of Acme URLs, regardless of whether they end in .com or .biz or another domain.
Using Long Search Terms
When searching reports, search terms containing more than 20 characters will be treated as a wildcard search (i.e longsearchterm*). For example, if you use this search term when searching reports:
then TruSTAR will search for that entire term.
If the search term is less than 20 characters, TruSTAR will conduct a partial search and return matches for any reports that contain that smaller term.
Best practice for report searching, then, is to keep searches under 20 characters or use a combination of characters and wildcards that are less than 20 characters in total. Using the above example, the more efficient search term might be
Please note that for report searching the syntax in which the term appears in the report body is how they are indexed. So if brackets are wrapped around the observable (i.e <longsearchterm>) then the wildcard search (i.e longsearchterm*) will not produce the desired result. Alternatively, searching with the correct syntax (i.e <longsearchterm*) will produce the expected report search results.
You can use operators like AND, OR, NOT and precedence as part of the match criteria.
Enter /tsquery followed by the search string you want to use, then press the Enter key to start the search.
Search For Reports that...
Contain a specific word in the Intel Report title
Have all specified terms (AND operator)
/tsquery keyword1 + keyword2
Have at least one of the specified terms (OR operator)
/tsquery keyword1 | keyword2
Exclude the specified keyword
/tsquery keyword1 +- keyword2
Have multiple keywords, using multiple operands and apply precedence logic to the results
/tsquery keyword1 + ( keyword2 | keyword 3)
Contain a specific word in the report body
/tsquery body: <keyword1>