Search for intel

The intel field is an array of intel-objects, meaning there could be multiple records for a given event. When a query is applied to an event with multiple intel records, the values for each field are flattened into individual arrays before the query logic is applied to the values.

The following table lists the fields contain in intel-objects:

Field	Type	Description	Example
confidence	String	The overall confidence rating of the intel source	high
feed	String	The name of the intel source	Sinkholes
indicator	String	The matched entity	131.253.18.12
indicator_type	String	The entity type	ip_address
is_malicious	Boolean	Indicates whether the indicator is believed to be malicious	false
meta	String	A JSON string of all metadata provided by the intel source	{"description":"Observed C2 Activity","references":["Fortinet FortiGuard Labs"]}
severity	String	The overall severity rating of the intel source	high
timestamp	Timestamp	The creation time of the intel record	2019-01-01T00:00:00.000Z