Datastore filtering help

Files can be filtered thanks to simple queries. The query schema is : target_element:search_value AND target_element2:search_value2.
There is no OR condition and searching without target does not work.

The following target elements can be used to filter :

  • name: Name of the file
  • id: ID of the file
  • uuid: UUID of the file
  • storage_name: Name of the file on the FS
  • tag: Tag of the file
  • description: Description of the file
  • is_ioc : Set to any value to filter files which are IOCs
  • is_evidence: Set to any value to filter files which are evidences
  • has_password: Set to any value to filter files which have passwords
  • sha256: SHA256 to filter files with
Example of filter : name: .exe AND is_ioc: true