Searchable Fields Reference

This page lists all searchable fields available in the ThreatWinds Search API. Use these fields when constructing queries for Simple Search or Advanced Search.

Search Types

Type	Description
Full-text	Searches text content with relevance scoring. Supports partial matching and phrases.
Exact match	Searches for exact values only. Used for filtering, sorting, and aggregations.

Entity Fields

Top-level fields available on all entities:

Field	Description	Search Type
id	Unique identifier of the entity	Exact match
type	Entity type (e.g., “ip”, “domain”, “hash”)	Exact match
@timestamp	ISO 8601 timestamp of the entity first being created	Exact match
reputation	Current reputation score (-3 to 3)	Exact match
bestReputation	Highest reputation score ever recorded	Exact match
worstReputation	Lowest reputation score ever recorded	Exact match
accuracy	Accuracy score (0 to 3)	Exact match
lastSeen	ISO 8601 timestamp of the most recent update or sighting	Exact match
tags	Array of tags associated with the entity	Exact match
visibleBy	Array of visibility settings	Exact match
wellKnown	Whether the entity is a well-known entity	Exact match

Entity Attributes

Attributes are stored under the attributes object. Prefix each attribute with attributes. when querying (e.g., attributes.ip).

Attribute	Description	Search Type
attributes.adversary	Threat actor name	Full-text
attributes.airport-name	Airport name	Full-text
attributes.asn	Autonomous System Number	Exact match
attributes.aso	Autonomous System Organization	Full-text
attributes.authentihash	Authenticode executable signature hash	Full-text
attributes.bank-account-nr	Bank account number	Exact match
attributes.base64	Base64-encoded value	Full-text
attributes.bic	Bank identifier code (SWIFT-BIC)	Full-text
attributes.bin	Bank identification number	Exact match
attributes.breach	Security breach identifier	Exact match
attributes.breach-count	Number of items leaked in the breach	Exact match
attributes.breach-date	Date of breach occurrence	Exact match
attributes.breach-description	Description of the breach	Full-text
attributes.btc	Bitcoin address	Full-text
attributes.category	Classification category label	Full-text
attributes.cc-number	Credit card number	Exact match
attributes.cdhash	Apple Code Directory Hash	Full-text
attributes.certificate-fingerprint	SSL/TLS certificate fingerprint	Full-text
attributes.chrome-extension-id	Chrome extension ID	Full-text
attributes.cidr	Network segment (CIDR notation)	Exact match
attributes.city	City name	Full-text
attributes.command	Command instruction	Full-text
attributes.cookie	HTTP cookie value	Full-text
attributes.country	Country name	Full-text
attributes.cpe	Common Platform Enumeration identifier	Full-text
attributes.cve	Common Vulnerabilities and Exposures identifier	Full-text
attributes.dash	Dash cryptocurrency address	Full-text
attributes.date	Date value	Exact match
attributes.date-of-issue	Date of issue	Exact match
attributes.datetime	Datetime value	Exact match
attributes.dkim	DKIM public key	Full-text
attributes.dkim-signature	DKIM signature	Full-text
attributes.domain	Domain name	Full-text
attributes.email	Email message ID	Full-text
attributes.email-address	Email sender address	Full-text
attributes.email-body	Email message body text	Full-text
attributes.email-display-name	Email sender display name	Full-text
attributes.email-header	Email header value	Full-text
attributes.email-subject	Email subject line	Full-text
attributes.eppn	Persistent preferred name	Full-text
attributes.expiration-date	Expiration date	Exact match
attributes.facebook-profile	Facebook profile URL	Full-text
attributes.ffn	Frequent flyer number	Full-text
attributes.file	File identifier	Full-text
attributes.file-data	File or attachment URL	Full-text
attributes.filename	File or attachment name	Full-text
attributes.filename-pattern	Pattern matching filename	Full-text
attributes.flight	Flight number	Full-text
attributes.github-organization	GitHub organization URL	Full-text
attributes.github-repository	GitHub repository URL	Full-text
attributes.github-user	GitHub user profile URL	Full-text
attributes.group	Adversary group name	Full-text
attributes.hex	Hexadecimal value	Full-text
attributes.hostname	Hostname	Full-text
attributes.iban	International bank account number	Full-text
attributes.id-number	Identity document number	Full-text
attributes.ip	IP address	Exact match
attributes.issuer	Issuer name	Full-text
attributes.issuing-country	Issuing country name	Full-text
attributes.ja3-fingerprint	JA3 SSL/TLS client fingerprint	Full-text
attributes.jabber-id	Jabber/XMPP ID	Full-text
attributes.jarm-fingerprint	JARM SSL/TLS server fingerprint	Full-text
attributes.last-analysis	Time of last analysis	Exact match
attributes.latitude	GPS latitude coordinate	Exact match
attributes.link	External reference URL	Full-text
attributes.longitude	GPS longitude coordinate	Exact match
attributes.mac-address	Network interface MAC address	Exact match
attributes.malware	Malware name	Full-text
attributes.malware-family	Malware family name	Full-text
attributes.malware-sample	Malware sample URL	Full-text
attributes.malware-type	Malware type classification	Full-text
attributes.md5	128-bit message digest	Full-text
attributes.mime-type	MIME type identifier	Full-text
attributes.mobile-app-id	Mobile application ID	Full-text
attributes.os	Operating system name	Full-text
attributes.passport	Passport number	Full-text
attributes.path	File, folder, or HTTP request path	Full-text
attributes.pattern-in-file	Pattern found inside a file	Full-text
attributes.pattern-in-memory	Pattern found in memory	Full-text
attributes.pattern-in-traffic	Pattern found in network traffic	Full-text
attributes.payload	Message payload hash	Full-text
attributes.pgp-private-key	PGP private key	Full-text
attributes.pgp-public-key	PGP public key	Full-text
attributes.phone	Phone number	Full-text
attributes.pnr	Passenger name record (PNR) locator	Full-text
attributes.port	Network port	Full-text
attributes.postal-address	Postal address	Full-text
attributes.process	Running process name	Full-text
attributes.process-state	Process state	Full-text
attributes.profile-photo	Profile photo URL	Full-text
attributes.prtn	Premium-rate phone number	Full-text
attributes.redress-number	Redress Control Number	Full-text
attributes.regkey	Registry key path	Full-text
attributes.sha1	SHA-1 hash (160-bit)	Full-text
attributes.sha224	SHA-224 hash	Full-text
attributes.sha256	256-bit hash	Full-text
attributes.sha3-224	SHA3-224 hash	Full-text
attributes.sha3-256	256-bit hash	Full-text
attributes.sha384	SHA-384 hash	Full-text
attributes.sha3-512	SHA3-512 hash	Full-text
attributes.sha512	SHA-512 hash	Full-text
attributes.sha512-224	SHA512-224 hash	Full-text
attributes.sha512-256	SHA512-256 hash	Full-text
attributes.size-in-bytes	Size in bytes	Exact match
attributes.ssh-banner	SSH Hello Banner text	Full-text
attributes.ssh-fingerprint	SSH key fingerprint	Full-text
attributes.ssr	Special service request (SSR) code	Full-text
attributes.text	Free-form text value	Full-text
attributes.threat	Threat description	Full-text
attributes.tiktok-profile	TikTok user profile URL	Full-text
attributes.twitter-profile	Twitter/X user profile URL	Full-text
attributes.url	URL value	Full-text
attributes.username	Username	Full-text
attributes.value	Generic value (case-sensitive)	Full-text
attributes.visa	Visa number	Full-text
attributes.windows-scheduled-task	Windows scheduled task name	Full-text
attributes.windows-service-displayname	Windows service display name	Full-text
attributes.windows-service-name	Windows service name	Full-text
attributes.whois-registrant	Domain registrant name	Full-text
attributes.whois-registrar	Domain registrar name	Full-text
attributes.xmr	Monero cryptocurrency address	Full-text
attributes.accuracy-radius	GPS accuracy radius	Exact match
attributes.email-mime-boundary	MIME boundary in email	Full-text
attributes.email-thread-index	Email thread index	Exact match
attributes.email-x-mailer	Email X-Mailer header value	Full-text
attributes.password	Password value	Full-text
attributes.zip-code	Zip/postal code	Full-text

Related Documentation

Documentation	Description
Entity Retrieval	How to retrieve entity details
Entity Types	List of all entity types
Simple Search	How to perform simple searches
Advanced Search	How to perform advanced searches