Most operators can be combined using basic logic operators to better filter/refine the results. Triage supports the following logic:
family:emotet OR family:trickbot
family:smokeloader AND family:zloader
score: 10 AND NOT family
|Search based on the hash of a sample using one of the supported operators:
Note: in the web UI it is not necessary to define an operator for hash lookups. However it is recommended to define it manually in API requests.
|Search based on the family tag assigned by Triage after analysis
|Search for analyses with a specific behaviour tag applied (see "Available Tags" below for more details)
|Filter for Android or Linux analyses. Uses the tag operator like above.
|Extracted C2 Data
|Search for URLs/domains/IPs dumped by Triage configuration extractors. Multiple fields supported:
Note: defining the operator is not required by Triage but is recommended where possible when using the API to reduce chance of misidentification in an automated setup.
|Search based on cryptocurrency wallet addresses dumped by Triage configuration extractors (e.g. from ransomnotes)
|Date and/or Time of Analysis
|Filter analyses based on the time/date at which behavioural analysis was completed. Note that if a sample does not have any behavioural tasks - e.g. because it is an unsupported file type, or was only submitted to the static phase, then the task does not count as complete and will not be returned as part of these results.
Dates and times are supported in the yyyy-mm-dd HH:MM:SS format. Operators can be used together to define periods of time.
Below is a list of all the currently available tags used in Triage signatures. They can be used in search queries with the