Skip to content

How to Find an Observable#

This topic provides step-by-step instructions for searching an observable in TheHive.

Observables are discrete pieces of technical evidence related to incidents. They can represent stateful properties, such as an MD5 hash or an IP address. They can also represent measurable events, such as the creation of a registry key or the execution of a file.

Method 1: Observables tab in cases and alerts descriptions#

Use this method if you know the case or alert containing the observable you're looking for and if you need to perform actions on one or more observables simultaneously.

  1. Open a case or an alert, and select the Observables tab.

    Observables tab

  2. Apply filters using any of these options individually or in combination:

    • Turn on the Filters toggle and enter one or more filters.

      Filters toggle

    • Select a value from a field to use it as a filter criterion.

      Select

  3. Based on your inputs, a list of results appears.

You can view up to 300 results per page and navigate through them using Previous and Next.

Method 2: Global Search feature#

Use this method if you’re unsure where to find the observable you’re looking for or if you need to conduct advanced searches for one or more observables without requiring simultaneous actions.

  1. Go to the Global Search view from the sidebar menu.

    Global Search feature sidebar menu

  2. Select the Observables item on the Search scope pane.

    Global Search Observables item

    All elements

    Select the All elements item for a comprehensive tool-wide overview that includes all entity types, such as cases, alerts, observables, jobs, tasks, and task logs. Use this option to analyze cross-linked information or to conduct a detailed investigation.

  3. Enter the keywords you want to search for in the search box displayed by default.

    Wildcard character

    You can use the wildcard character * to broaden your searches since version 5.4.7.

    The wildcard character acts as a placeholder that matches zero or more characters, helping you find variations of a term or incomplete information.

    Examples of use cases:
    - Email domains: Entering *@gmail.com will return entities containing the gmail.com domain.
    - IP subnets: Entering 192.168.*.* will return entities with IP addresses in the 192.168.x.x subnet.
    - URLs: Entering https://malwaredomain.com/* will return entities hosted under the malwaredomain.com directory.

    Other advanced search options, such as Boolean and phrase searches, are not currently supported.

  4. If you need additional filters, apply one or more filters by selecting Add new filter.

    These filters refine your search results and act as an equivalent to the AND operator in Boolean search.

    Warning

    Filters are required for the following fields to ensure the search engine accurately interprets values:
    - Fields with specific date formats
    - Custom fields

  5. Based on your inputs, a list of results appears.

You can view up to 300 results per page and navigate through them using Previous and Next.

Next steps#