Advanced Search
Use advanced search to find specific threats, articles, entities, and IOCs across the entire ThreatCluster database.
ThreatCluster indexes thousands of cybersecurity articles daily. Advanced Search lets you pinpoint exactly the threats, entities, and IOCs you care about.
Global Search Bar
The search bar in the top navbar is the fastest way to find something. Start typing and results appear in a dropdown grouped by clusters, articles, and entities. Click any result to jump straight to it.
Cluster AI Mode
Click the sparkle icon in the search bar to toggle Cluster AI mode. Instead of keyword matching, you can ask natural language questions:
- "What ransomware groups targeted healthcare in the last month?"
- "Show me clusters related to zero-day exploits in Microsoft Exchange"
Cluster AI interprets your question, searches across clusters and entities, and returns relevant results with a summary.
Advanced Search Page
Navigate to /search for full-page search with granular controls. The Advanced Search page gives you:
- A larger results area with tabbed views
- Filter panels that persist as you refine your query
- The ability to combine multiple filters in a single search
Filtering Results
Use the filter panel on the Advanced Search page to narrow results by:
- Entity type -- Focus on threat actors, malware families, CVEs, organizations, or other entity categories.
- Date range -- Restrict results to a specific time window (last 24 hours, last 7 days, custom range).
- Threat score -- Filter by minimum threat score to surface only high-severity clusters.
- Category -- Limit results to specific threat categories such as ransomware, phishing, data breach, or vulnerability disclosure.
Filters stack together, so you can search for "Cobalt Strike" filtered to threat score 70+ in the last 30 days.
Search Operators
Refine keyword searches with operators:
| Operator | Example | What it does |
|---|---|---|
| Quotes | "BlackCat ransomware" |
Exact phrase match |
| Field prefix | title:ransomware |
Search within cluster titles only |
| Field prefix | source:BleepingComputer |
Filter by source name |
| Field prefix | entity:Lazarus |
Search within extracted entities |
| Field prefix | content:Cobalt Strike |
Search within article body text |
Searching for IOCs
ThreatCluster extracts indicators of compromise from articles automatically. You can search for:
- IP addresses -- e.g.,
ip:192.168.1.1or just paste the IP directly - Domains -- e.g.,
domain:malicious-site.com - File hashes -- SHA-256, SHA-1, or MD5 hashes. Use
hash:prefix or paste the hash directly.
When an IOC matches, you see every cluster and article where it appeared, giving you immediate context on how the indicator relates to broader campaigns.
Search Results Tabs
Results on the Advanced Search page are organized into three tabs:
- Clusters -- Grouped threat intelligence clusters with threat scores, entity counts, and article counts. This is usually the best starting point.
- Articles -- Individual articles matching your query, with source, date, and the cluster they belong to.
- Entities -- Extracted entities (threat actors, malware, CVEs, etc.) that match your search terms. Click an entity to see its full profile page.
Creating Alerts from Searches
If you find yourself running the same search regularly, consider setting up an Alert Rule with the same keywords and filters. Alert rules automatically notify you when new clusters match your criteria.
Go to Settings > Alert Rules to create one, or see the Alert Rules guide for details.