Each intel hit creates a synthetic event with the class of “intel_hit”. To find all events that are intel hits, run the Search TQL query class=intel_hit and select specific dates in the Search box.
To further refine the intel_hits that the search returns:
Type. To see the number of hits that are based on commodity and curated intelligence, use the query:
class=intel_hit | groupby type.Intelscore. To see the number of intel hits with an intelligence score (that is, low, medium, high, or critical) use the query:
class=intel_hit | groupby intelscoreMalware family. To show how many intel hits are from a specific intel malware family, use the query:
class=intel_hit | groupby <"intelmalwarefamily">
Example
The following query searches for all events that are intel_hits and then filters those results to only those events that have 192.168.* (where * is a regular expression) for the srcipv4 field.
class=intel_hit srcipv4:"192.168/16"