Refine TAXII results using query string filter parameters.
Filter STIX objects in your TAXII requests to retrieve exactly the data you need.
All filters are query string parameters and can be combined for precise control.
Available Filters
The filters you can use include both those required by the TAXII specification and additional filters specific to Pulsedive.
Standard TAXII Filters
These filters are required by the TAXII specification:
Filter
Type
Description
Example
limit
Positive integer
Number of objects to return in response. Default varies by collection. Pulsedive has a maximum server limit of 1000.
100
next
String
Pagination token from previous response. To learn more about pagination, visit Pagination.
2024-01-15%2010:30:45|12345
added_after
Timestamp
Filter by STIX objects added after the specified date and time. Supports STIX timestamps (YYYY-MM-DDTHH:MM:SS.MMMZ) and Pulsedive format (YYYY-MM-DD HH:MM:SS).
2024-01-15T11:45:30.000Z
match[id]
String
Filter by specific STIX object ID(s). Supports comma-separated list.
indicator--12345678-1234-5678-9012-123456789012
match[spec_version]
String
Filter by STIX specification version(s). Supports comma-separated list.
2.1
match[type]
String
Filter by STIX object type(s). Supports comma-separated list. For STIX Domain Objects, visit the STIX specification.
indicator
match[version]
String
Filter by STIX object version(s). Supports comma-separated list. Options include: first, last, all, timestamps in either STIX (YYYY-MM-DDTHH:MM:SS.MMMZ) or Pulsedive (YYYY-MM-DD HH:MM:SS) format. Pulsedive doesn’t have object versions, so the first, last, and all keywords will all return the latest object version.
first 2024-01-15T11:45:30.000Z 2024-01-15 11:24:30
Pulsedive-Specific Filters
Pulsedive provides these additional filters:
Filter
Type
Description
Example
match[seen]
Timestamp
Filter by last seen timestamp(s). Supports comma-separated list. Supports STIX-spec timestamps (YYYY-MM-DDTHH:MM:SS.MMMZ) and Pulsedive’s timestamp format (YYYY-MM-DD HH:MM:SS)
2024-01-15T11:45:30.000Z 2024-01-15 11:24:30
match[risk]
String
Filter by risk score. Options: unknown, none, very low, low, medium, high, critical. Supports comma-separated list.
Use collection ID 981c4916-ebb2-4567-aece-54ae970c4230 (test collection) for safe experimentation.
Basic Filtering
# Get high-risk domains from the last 30 dayscurl "https://pulsedive.com/taxii2/api/collections/a5cffbfe-c0ff-4842-a235-cb3a7a040a37/objects/ \ ?key=<YOUR_API_KEY> \ &accept=application/taxii+json;version=2.1 \ &match[risk]=high \ &match[itype]=domain \ &limit=100 \ &pretty=1"
Multiple Risk Levels
# Get high and critical risk indicatorscurl "https://pulsedive.com/taxii2/api/collections/a5cffbfe-c0ff-4842-a235-cb3a7a040a37/objects/ \ ?key=<YOUR_API_KEY> \ &accept=application/taxii+json;version=2.1 \ &match[risk]=high,critical \ &limit=50 \ &pretty=1"
Time-Based Filtering
# Get indicators added after January 1, 2024curl "https://pulsedive.com/taxii2/api/collections/a5cffbfe-c0ff-4842-a235-cb3a7a040a37/objects/ \ ?key=<YOUR_API_KEY> \ &accept=application/taxii+json;version=2.1 \ &added_after=2024-01-01T00:00:00.000Z \ &pretty=1"
Active vs Retired Indicators
# Get only active (non-retired) indicatorscurl "https://pulsedive.com/taxii2/api/collections/a5cffbfe-c0ff-4842-a235-cb3a7a040a37/objects/ \ ?key=<YOUR_API_KEY> \ &accept=application/taxii+json;version=2.1 \ &match[retired]=false \ &pretty=1"
Combining Filters
When you use multiple filters:
Multiple values in a single filter use OR logic (e.g., match[risk]=high,critical returns highORcritical risk)
Multiple different filters use AND logic (e.g., match[risk]=high&match[itype]=domain returns high risk ANDdomain type)
Example: Multiple Filters
This request combines risk levels, indicator types, and status:
# Get active, high-risk domains and URLs from the test collectioncurl "https://pulsedive.com/taxii2/api/collections/981c4916-ebb2-4567-aece-54ae970c4230/objects/ \ ?key=<YOUR_API_KEY> \ &accept=application/taxii+json;version=2.1 \ &match[risk]=high,critical \ &match[itype]=domain,url \ &match[retired]=false \ &limit=10 \ &pretty=1"
This query returns indicators that match:
(high risk ORcritical risk) AND
(domain type ORurl type) AND
(not retired)
Was this page helpful?
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Pulsedive Docs","description":"Official API documentation for Pulsedive threat intelligence platform. Retrieve enriched indicator data, look up threats and feeds, scan IOCs for analysis, query the Pulsedive database, automate workflows, and consume intelligence via STIX 2.1/TAXII 2.1.","colors":{"primary":"#006699","light":"#3094c2","dark":"#48484a"},"logo":{"light":"https://mintcdn.com/pulsedive-c1f2dc75/wqIZEZUDjJ7GpUNG/logo/light.svg?fit=max\u0026auto=format\u0026n=wqIZEZUDjJ7GpUNG\u0026q=85\u0026s=ac00596f4af367b4774bbbe11f25780b","dark":"https://mintcdn.com/pulsedive-c1f2dc75/wqIZEZUDjJ7GpUNG/logo/dark.svg?fit=max\u0026auto=format\u0026n=wqIZEZUDjJ7GpUNG\u0026q=85\u0026s=4d774d537d7f0acb9769b10a83303ee5","href":"https://docs.pulsedive.com/"},"favicon":"https://mintcdn.com/pulsedive-c1f2dc75/hzMrNLBiNyVTFvFh/favicon.png?fit=max\u0026auto=format\u0026n=hzMrNLBiNyVTFvFh\u0026q=85\u0026s=58beaafde9216c70ac30523d861c636d","api":{"examples":{"prefill":true,"autogenerate":false},"mdx":{"server":"https://pulsedive.com"}},"appearance":{"default":"dark"},"background":{"decoration":"grid","color":{"light":"#f2f2f2"}},"navbar":{"links":[{"href":"https://pulsedive.com/contact","label":"Contact Us"}],"primary":{"type":"button","label":"Sign Up","href":"https://pulsedive.com/register"}},"footer":{"socials":{"x":"https://twitter.com/pulsedive","linkedin":"https://linkedin.com/company/pulsedive","discord":"https://pulsedive.com/discord"}},"fonts":{"heading":{"family":"Montserrat"},"body":{"family":"Varela Round"}},"integrations":{"plausible":{"domain":"docs.pulsedive.com"}},"contextual":{"options":["copy","chatgpt","claude","mcp","cursor","vscode"],"display":"header"},"styling":{"latex":false},"navigation":{"global":{"anchors":[{"anchor":"About Us","icon":"users","href":"https://pulsedive.com/about/company"},{"anchor":"Community","icon":"discord","href":"https://pulsedive.com/discord"},{"anchor":"Blog","icon":"newspaper","href":"https://blog.pulsedive.com"}]},"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"pulsedive-c1f2dc75","hasAudioNarration":false,"actualSubdomain":"pulsedive-c1f2dc75","customDomains":["docs.pulsedive.com"],"gitSource":{"type":"github","owner":"pulsedive","repo":"docs","deployBranch":"main","contentDirectory":"","isPrivate":true,"mountPath":"","label":""},"feedback":{"thumbs":true,"agentFeedback":true},"entitlements":{"AI_CHAT":{"status":"DISABLED"}},"buildId":"6af5a71eb51d0e31167acfc7","clientVersion":"0.0.4143","searchFilterCounts":[{"language":"default","tag":"API Reference","count":27},{"language":"default","tag":"Integrations","count":26},{"language":"default","tag":"STIX/TAXII Reference","count":12},{"language":"default","tag":"SIEM \u0026 SOAR","count":11},{"language":"default","tag":"Get Started","count":10},{"language":"default","tag":"Getting Started","count":9},{"language":"default","tag":"Troubleshoot","count":8},{"language":"default","tag":"Data Model","count":7},{"language":"default","tag":"Bulk Export","count":6},{"language":"default","tag":"Investigation Tools","count":6}]},"assistantConfig":{},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-rbac-roles","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":true},"customCss":[{"filePath":"assets/stylesheets/style.css","content":".api-section-heading button[aria-haspopup=\"menu\"]:not([disabled]){border:1px solid #3094c2!important;background-color:rgba(48, 148, 194, 0.15)!important;padding:0.5rem 0.75rem!important;border-radius:6px!important;border-left-width:2px!important;border-right-width:2px!important}.api-section-heading button[aria-haspopup=\"menu\"]:not([disabled]) svg{width:0.75rem!important;height:0.75rem!important}.api-section-heading .flex.items-center.gap-x-3{gap:0.5rem!important}.api-section-heading .relative.flex.items-center{padding-left:0!important;padding-right:0!important}a code{text-decoration:none!important;border-bottom:none!important}.mt-6:nth-of-type(n+2){border-top:1px solid #374151!important;padding-top:1.5rem!important}li#\\/api\\/indicator\\/get-by-value a::after{content:\"\";display:inline-block;width:12px;height:12px;margin-left:6px;background-color:#808080;mask-image:url(https://d3gk2c5xim1je2.cloudfront.net/v7.1.0/solid/star.svg);mask-repeat:no-repeat;mask-position:center}li#\\/api\\/scan\\/add a::after{content:\"\";display:inline-block;width:12px;height:12px;margin-left:6px;background-color:#808080;mask-image:url(https://d3gk2c5xim1je2.cloudfront.net/v7.1.0/solid/star.svg);mask-repeat:no-repeat;mask-position:center}li#\\/api\\/explore\\/search a::after{content:\"\";display:inline-block;width:12px;height:12px;margin-left:6px;background-color:#808080;mask-image:url(https://d3gk2c5xim1je2.cloudfront.net/v7.1.0/solid/star.svg);mask-repeat:no-repeat;mask-position:center}[data-component-part=\"tabs-list\"]{flex-wrap:wrap!important;overflow:visible!important;gap:0.5rem!important;padding-bottom:1rem!important}[data-component-part=\"tab-button\"]{white-space:normal!important;max-width:none!important}.tab-container[class*=\"border-gray-100\"] [data-component-part=\"tabs-list\"]{justify-content:flex-start!important;width:auto!important;padding-bottom:1.5rem!important}.tab-container[class*=\"border-gray-100\"] [data-component-part=\"tab-button\"]{flex:0 1 auto!important}.tab-container[class*=\"border-gray-100\"] [data-component-part=\"tab-button\"][data-active=\"true\"]{padding:0.5rem 1rem!important;border:1px solid #3094c2!important;border-radius:20px!important;border-left-width:2px!important;border-right-width:2px!important}.tab-container[class*=\"border-gray-100\"] [data-component-part=\"tab-button\"][data-active=\"false\"]{background-color:rgba(48, 148, 194, 0.15)!important;color:#48484a;padding:0.5rem 1rem!important;border:1px solid #48484a!important;border-radius:20px!important;border-left-width:2px!important;border-right-width:2px!important}p{-moz-hyphens:none!important;-ms-hyphens:none!important;-webkit-hyphens:none!important;hyphens:none!important}.border-gray-100{border-color:#3094c2b4!important}.dark .border-gray-800{border-color:#3094c27c!important}.prose-sm.mt-6{border-color:rgba(48, 148, 194, 0.3)!important}.dark .prose-sm.mt-6{border-color:#3094c254!important}.tab-container[class*=\"border-gray-100\"] ul[data-component-part=\"tabs-list\"]{border-bottom-color:#3094C2!important;padding-bottom:10px!important}.dark .tab-container[class*=\"border-gray-100\"] ul[data-component-part=\"tabs-list\"]{border-bottom-color:rgba(48, 148, 194, 0.5)!important}.mt-4.rounded-xl.border>div.-mt-2{margin-top:0.5rem!important}.field{border-color:#e5e7eb!important}.dark .field{border-color:rgba(31, 41, 55, 0.5)!important}"},{"filePath":"assets/stylesheets/tabs.css","content":".pd-pill-tabs>.tabs.tab-container>ul[data-component-part=\"tabs-list\"]{border-bottom:none;flex-wrap:wrap;gap:8px;margin-bottom:0.375rem!important}.pd-pill-tabs>.tabs.tab-container>ul[data-component-part=\"tabs-list\"]>li{list-style:none}.pd-pill-tabs>.tabs.tab-container>ul[data-component-part=\"tabs-list\"]>li [data-component-part=\"tab-button\"]{border:1px solid #B9C2CC;border-radius:6px;padding:6px 14px!important;margin-bottom:0!important;font-weight:500}.pd-pill-tabs>.tabs.tab-container>ul[data-component-part=\"tabs-list\"]>li [data-component-part=\"tab-button\"][data-active=\"true\"]{background:#006699;border-color:#006699;color:#FFFFFF}.dark .pd-pill-tabs>.tabs.tab-container>ul[data-component-part=\"tabs-list\"]>li [data-component-part=\"tab-button\"]{border-color:#4B5563;color:#FFFFFF}.pd-pill-tabs>.tabs.tab-container>div>[data-component-part=\"tab-content\"]{border:1px solid #CBD5E1;border-radius:12px;padding:1.25rem 1.5rem;margin-top:0.75rem}.dark .pd-pill-tabs>.tabs.tab-container>div>[data-component-part=\"tab-content\"]{border-color:#475569!important}.pd-pill-tabs [data-component-part=\"tab-button\"]:focus-visible{outline:2px solid #3094c2;outline-offset:2px}"},{"filePath":"assets/stylesheets/icons.css","content":".wide-logo [data-component-part=\"card-icon\"],.wide-logo [data-component-part=\"card-icon\"] img{width:auto;height:22px}html:not(.dark) .white-logo [data-component-part=\"card-icon\"] img{filter:invert(1)}"}],"page":{"pagePath":"taxii/filtering","slug":"/taxii/filtering","pageMetadata":{"title":"Filtering","description":"Refine TAXII results using query string filter parameters.","href":"/taxii/filtering"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Refine TAXII results using query string filter parameters.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={a:`a`,code:`code`,li:`li`,p:`p`,pre:`pre`,span:`span`,strong:`strong`,tbody:`tbody`,td:`td`,th:`th`,thead:`thead`,tr:`tr`,ul:`ul`,..._provideComponents(),...props.components},{CodeBlock,Heading,Table,Tip,Warning}=_components;if(!CodeBlock)_missingMdxReference(`CodeBlock`,true);if(!Heading)_missingMdxReference(`Heading`,true);if(!Table)_missingMdxReference(`Table`,true);if(!Tip)_missingMdxReference(`Tip`,true);if(!Warning)_missingMdxReference(`Warning`,true);return _jsxs(_Fragment,{children:[_jsx(_components.p,{children:`Filter STIX objects in your TAXII requests to retrieve exactly the data you need.\nAll filters are query string parameters and can be combined for precise control.`}),`\n`,_jsx(Heading,{level:`2`,id:`available-filters`,children:`Available Filters`}),`\n`,_jsx(_components.p,{children:`The filters you can use include both those required by the TAXII specification and additional filters specific to Pulsedive.`}),`\n`,_jsx(Heading,{level:`3`,id:`standard-taxii-filters`,children:`Standard TAXII Filters`}),`\n`,_jsx(_components.p,{children:`These filters are required by the TAXII specification:`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Filter`}),_jsx(_components.th,{children:`Type`}),_jsx(_components.th,{children:`Description`}),_jsx(_components.th,{children:`Example`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`limit`})}),_jsx(_components.td,{children:`Positive integer`}),_jsx(_components.td,{children:`Number of objects to return in response. Default varies by collection. Pulsedive has a maximum server limit of 1000.`}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`100`})})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`next`})}),_jsx(_components.td,{children:`String`}),_jsxs(_components.td,{children:[`Pagination token from previous response. To learn more about pagination, visit `,_jsx(_components.a,{href:`/taxii/pagination/`,children:`Pagination`}),`.`]}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`2024-01-15%2010:30:45|12345`})})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`added_after`})}),_jsx(_components.td,{children:`Timestamp`}),_jsxs(_components.td,{children:[`Filter by STIX objects added after the specified date and time.`,_jsx(`br`,{}),`Supports STIX timestamps (`,_jsx(_components.code,{children:`YYYY-MM-DDTHH:MM:SS.MMMZ`}),`) and Pulsedive format (`,_jsx(_components.code,{children:`YYYY-MM-DD HH:MM:SS`}),`).`]}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`2024-01-15T11:45:30.000Z`})})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`match[id]`})}),_jsx(_components.td,{children:`String`}),_jsx(_components.td,{children:`Filter by specific STIX object ID(s). Supports comma-separated list.`}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`indicator--12345678-1234-5678-9012-123456789012`})})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`match[spec_version]`})}),_jsx(_components.td,{children:`String`}),_jsx(_components.td,{children:`Filter by STIX specification version(s). Supports comma-separated list.`}),_jsx(_components.td,{\"data-numeric\":`true`,children:_jsx(_components.code,{children:`2.1`})})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`match[type]`})}),_jsx(_components.td,{children:`String`}),_jsx(_components.td,{children:`Filter by STIX object type(s). Supports comma-separated list. For STIX Domain Objects, visit the STIX specification.`}),_jsx(_components.td,{children:_jsx(_components.code,{children:`indicator`})})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`match[version]`})}),_jsx(_components.td,{children:`String`}),_jsxs(_components.td,{children:[`Filter by STIX object version(s). Supports comma-separated list.`,_jsx(`br`,{}),`Options include: `,_jsx(_components.code,{children:`first`}),`, `,_jsx(_components.code,{children:`last`}),`, `,_jsx(_components.code,{children:`all`}),`, timestamps in either STIX (`,_jsx(_components.code,{children:`YYYY-MM-DDTHH:MM:SS.MMMZ`}),`) or Pulsedive (`,_jsx(_components.code,{children:`YYYY-MM-DD HH:MM:SS`}),`) format.`,_jsx(`br`,{}),`Pulsedive doesn’t have object versions, so the `,_jsx(_components.code,{children:`first`}),`, `,_jsx(_components.code,{children:`last`}),`, and `,_jsx(_components.code,{children:`all`}),` keywords will all return the latest object version.`]}),_jsxs(_components.td,{\"data-numeric\":`true`,children:[_jsx(_components.code,{children:`first`}),_jsx(`br`,{}),_jsx(_components.code,{children:`2024-01-15T11:45:30.000Z`}),_jsx(`br`,{}),_jsx(_components.code,{children:`2024-01-15 11:24:30`})]})]})]})]}),`\n`,_jsx(Heading,{level:`3`,id:`pulsedive-specific-filters`,children:`Pulsedive-Specific Filters`}),`\n`,_jsx(_components.p,{children:`Pulsedive provides these additional filters:`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Filter`}),_jsx(_components.th,{children:`Type`}),_jsx(_components.th,{children:`Description`}),_jsx(_components.th,{children:`Example`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`match[seen]`})}),_jsx(_components.td,{children:`Timestamp`}),_jsxs(_components.td,{children:[`Filter by last seen timestamp(s). Supports comma-separated list.`,_jsx(`br`,{}),`Supports STIX-spec timestamps (`,_jsx(_components.code,{children:`YYYY-MM-DDTHH:MM:SS.MMMZ`}),`) and Pulsedive’s timestamp format (`,_jsx(_components.code,{children:`YYYY-MM-DD HH:MM:SS`}),`)`]}),_jsxs(_components.td,{\"data-numeric\":`true`,children:[_jsx(_components.code,{children:`2024-01-15T11:45:30.000Z`}),_jsx(`br`,{}),_jsx(_components.code,{children:`2024-01-15 11:24:30`})]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`match[risk]`})}),_jsx(_components.td,{children:`String`}),_jsxs(_components.td,{children:[`Filter by risk score. Options: `,_jsx(_components.code,{children:`unknown`}),`, `,_jsx(_components.code,{children:`none`}),`, `,_jsx(_components.code,{children:`very low`}),`, `,_jsx(_components.code,{children:`low`}),`, `,_jsx(_components.code,{children:`medium`}),`, `,_jsx(_components.code,{children:`high`}),`, `,_jsx(_components.code,{children:`critical`}),`. Supports comma-separated list.`]}),_jsx(_components.td,{children:_jsx(_components.code,{children:`low`})})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`match[itype]`})}),_jsx(_components.td,{children:`String`}),_jsxs(_components.td,{children:[`Filter by indicator type(s). Options include: `,_jsx(_components.code,{children:`ip`}),`, `,_jsx(_components.code,{children:`ipv6`}),`, `,_jsx(_components.code,{children:`domain`}),`, `,_jsx(_components.code,{children:`url`}),`. Supports comma-separated list.`]}),_jsx(_components.td,{children:_jsx(_components.code,{children:`ip`})})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`match[retired]`})}),_jsx(_components.td,{children:`Boolean`}),_jsxs(_components.td,{children:[`Filter by retired (`,_jsx(_components.code,{children:`true`}),`) or active (`,_jsx(_components.code,{children:`false`}),`) indicators.`]}),_jsx(_components.td,{children:_jsx(_components.code,{children:`true`})})]})]})]}),`\n`,_jsx(Heading,{level:`2`,id:`filter-examples`,children:`Filter Examples`}),`\n`,_jsx(_components.p,{children:`These are some sample requests.`}),`\n`,_jsx(Warning,{children:_jsxs(_components.p,{children:[`Sample requests won’t work without a valid API key.\nGet one by `,_jsx(_components.a,{href:`https://pulsedive.com/register`,children:`signing up for a free account`}),`.`]})}),`\n`,_jsx(Tip,{children:_jsxs(_components.p,{children:[`Use collection ID `,_jsx(_components.code,{children:`981c4916-ebb2-4567-aece-54ae970c4230`}),` (test collection) for safe experimentation.`]})}),`\n`,_jsx(Heading,{level:`3`,id:`basic-filtering`,children:`Basic Filtering`}),`\n`,_jsx(CodeBlock,{filename:``,numberOfLines:`8`,language:`shellscript`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`shellscript`,children:_jsxs(_components.code,{language:`shellscript`,numberOfLines:`8`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#6E7781`,\"--shiki-dark\":`#6A9955`},children:`# Get high-risk domains from the last 30 days`})}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#8250DF`,\"--shiki-dark\":`#DCDCAA`},children:`curl`}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \"https://pulsedive.com/taxii2/api/collections/a5cffbfe-c0ff-4842-a235-cb3a7a040a37/objects/ \\\\`})]}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` ?key=\u003cYOUR_API_KEY> \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026accept=application/taxii+json;version=2.1 \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026match[risk]=high \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026match[itype]=domain \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026limit=100 \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026pretty=1\"`})}),`\n`]})})}),`\n`,_jsx(Heading,{level:`3`,id:`multiple-risk-levels`,children:`Multiple Risk Levels`}),`\n`,_jsx(CodeBlock,{filename:``,numberOfLines:`7`,language:`shellscript`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`shellscript`,children:_jsxs(_components.code,{language:`shellscript`,numberOfLines:`7`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#6E7781`,\"--shiki-dark\":`#6A9955`},children:`# Get high and critical risk indicators`})}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#8250DF`,\"--shiki-dark\":`#DCDCAA`},children:`curl`}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \"https://pulsedive.com/taxii2/api/collections/a5cffbfe-c0ff-4842-a235-cb3a7a040a37/objects/ \\\\`})]}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` ?key=\u003cYOUR_API_KEY> \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026accept=application/taxii+json;version=2.1 \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026match[risk]=high,critical \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026limit=50 \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026pretty=1\"`})}),`\n`]})})}),`\n`,_jsx(Heading,{level:`3`,id:`time-based-filtering`,children:`Time-Based Filtering`}),`\n`,_jsx(CodeBlock,{filename:``,numberOfLines:`6`,language:`shellscript`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`shellscript`,children:_jsxs(_components.code,{language:`shellscript`,numberOfLines:`6`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#6E7781`,\"--shiki-dark\":`#6A9955`},children:`# Get indicators added after January 1, 2024`})}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#8250DF`,\"--shiki-dark\":`#DCDCAA`},children:`curl`}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \"https://pulsedive.com/taxii2/api/collections/a5cffbfe-c0ff-4842-a235-cb3a7a040a37/objects/ \\\\`})]}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` ?key=\u003cYOUR_API_KEY> \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026accept=application/taxii+json;version=2.1 \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026added_after=2024-01-01T00:00:00.000Z \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026pretty=1\"`})}),`\n`]})})}),`\n`,_jsx(Heading,{level:`3`,id:`active-vs-retired-indicators`,children:`Active vs Retired Indicators`}),`\n`,_jsx(CodeBlock,{filename:``,numberOfLines:`6`,language:`shellscript`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`shellscript`,children:_jsxs(_components.code,{language:`shellscript`,numberOfLines:`6`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#6E7781`,\"--shiki-dark\":`#6A9955`},children:`# Get only active (non-retired) indicators`})}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#8250DF`,\"--shiki-dark\":`#DCDCAA`},children:`curl`}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \"https://pulsedive.com/taxii2/api/collections/a5cffbfe-c0ff-4842-a235-cb3a7a040a37/objects/ \\\\`})]}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` ?key=\u003cYOUR_API_KEY> \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026accept=application/taxii+json;version=2.1 \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026match[retired]=false \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026pretty=1\"`})}),`\n`]})})}),`\n`,_jsx(Heading,{level:`2`,id:`combining-filters`,children:`Combining Filters`}),`\n`,_jsx(_components.p,{children:`When you use multiple filters:`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[`Multiple values in a single filter use `,_jsx(_components.strong,{children:`OR`}),` logic (e.g., `,_jsx(_components.code,{children:`match[risk]=high,critical`}),` returns `,_jsx(_components.code,{children:`high`}),` `,_jsx(_components.strong,{children:`OR`}),` `,_jsx(_components.code,{children:`critical`}),` risk)`]}),`\n`,_jsxs(_components.li,{children:[`Multiple different filters use `,_jsx(_components.strong,{children:`AND`}),` logic (e.g., `,_jsx(_components.code,{children:`match[risk]=high\u0026match[itype]=domain`}),` returns `,_jsx(_components.code,{children:`high`}),` risk `,_jsx(_components.strong,{children:`AND`}),` `,_jsx(_components.code,{children:`domain`}),` type)`]}),`\n`]}),`\n`,_jsx(Heading,{level:`3`,id:`example-multiple-filters`,children:`Example: Multiple Filters`}),`\n`,_jsx(_components.p,{children:`This request combines risk levels, indicator types, and status:`}),`\n`,_jsx(CodeBlock,{filename:``,numberOfLines:`9`,language:`shellscript`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`shellscript`,children:_jsxs(_components.code,{language:`shellscript`,numberOfLines:`9`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#6E7781`,\"--shiki-dark\":`#6A9955`},children:`# Get active, high-risk domains and URLs from the test collection`})}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#8250DF`,\"--shiki-dark\":`#DCDCAA`},children:`curl`}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \"https://pulsedive.com/taxii2/api/collections/981c4916-ebb2-4567-aece-54ae970c4230/objects/ \\\\`})]}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` ?key=\u003cYOUR_API_KEY> \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026accept=application/taxii+json;version=2.1 \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026match[risk]=high,critical \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026match[itype]=domain,url \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026match[retired]=false \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026limit=10 \\\\`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` \u0026pretty=1\"`})}),`\n`]})})}),`\n`,_jsx(_components.p,{children:`This query returns indicators that match:`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[`(`,_jsx(_components.code,{children:`high`}),` risk `,_jsx(_components.strong,{children:`OR`}),` `,_jsx(_components.code,{children:`critical`}),` risk) `,_jsx(_components.strong,{children:`AND`})]}),`\n`,_jsxs(_components.li,{children:[`(`,_jsx(_components.code,{children:`domain`}),` type `,_jsx(_components.strong,{children:`OR`}),` `,_jsx(_components.code,{children:`url`}),` type) `,_jsx(_components.strong,{children:`AND`})]}),`\n`,_jsx(_components.li,{children:`(not retired)`}),`\n`]})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Filtering","description":"Refine TAXII results using query string filter parameters.","href":"/taxii/filtering"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[{"title":"Available Filters","slug":"available-filters","depth":2,"children":[{"title":"Standard TAXII Filters","slug":"standard-taxii-filters","depth":3,"children":[]},{"title":"Pulsedive-Specific Filters","slug":"pulsedive-specific-filters","depth":3,"children":[]}]},{"title":"Filter Examples","slug":"filter-examples","depth":2,"children":[{"title":"Basic Filtering","slug":"basic-filtering","depth":3,"children":[]},{"title":"Multiple Risk Levels","slug":"multiple-risk-levels","depth":3,"children":[]},{"title":"Time-Based Filtering","slug":"time-based-filtering","depth":3,"children":[]},{"title":"Active vs Retired Indicators","slug":"active-vs-retired-indicators","depth":3,"children":[]}]},{"title":"Combining Filters","slug":"combining-filters","depth":2,"children":[{"title":"Example: Multiple Filters","slug":"example-multiple-filters","depth":3,"children":[]}]}],"codeExamples":{}},"jsLinks":["/_mintlify/custom/pulsedive-c1f2dc75/3ff9b99e05a108f6/external-links.js"],"subdomain":"pulsedive-c1f2dc75","siteName":"Pulsedive Docs","title":"Filtering - Pulsedive Docs","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-11-12T09:32:23.173Z","originalFileLocation":"taxii/filtering.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"dark\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Refine TAXII results using query string filter parameters.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Pulsedive Docs\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/pulsedive-c1f2dc75/kAAsArm7Hu3B4EWw/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/pulsedive-c1f2dc75/kAAsArm7Hu3B4EWw/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/pulsedive-c1f2dc75/kAAsArm7Hu3B4EWw/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/pulsedive-c1f2dc75/kAAsArm7Hu3B4EWw/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/pulsedive-c1f2dc75/kAAsArm7Hu3B4EWw/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/pulsedive-c1f2dc75/kAAsArm7Hu3B4EWw/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/pulsedive-c1f2dc75/kAAsArm7Hu3B4EWw/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/pulsedive-c1f2dc75/kAAsArm7Hu3B4EWw/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/pulsedive-c1f2dc75/kAAsArm7Hu3B4EWw/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Filtering - Pulsedive Docs\">\u003cmeta data-mint-head property=\"og:description\" content=\"Refine TAXII results using query string filter parameters.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Pulsedive Docs\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.pulsedive.com/taxii/filtering\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://pulsedive-c1f2dc75.mintlify.site/_mintlify/api/og/v2?division=STIX%2FTAXII+2.1+Export\u0026amp;title=Filtering\u0026amp;description=Refine+TAXII+results+using+query+string+filter+parameters.\u0026amp;theme=0de5d41b0023f6b70df2973a\u0026amp;signature=4f06b9c2902eddd7072992da0da8491c7b4a9f463ae3589a7706839ace50fbeb\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Filtering - Pulsedive Docs\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Refine TAXII results using query string filter parameters.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://pulsedive-c1f2dc75.mintlify.site/_mintlify/api/og/v2?division=STIX%2FTAXII+2.1+Export\u0026amp;title=Filtering\u0026amp;description=Refine+TAXII+results+using+query+string+filter+parameters.\u0026amp;theme=0de5d41b0023f6b70df2973a\u0026amp;signature=4f06b9c2902eddd7072992da0da8491c7b4a9f463ae3589a7706839ace50fbeb\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/pulsedive-c1f2dc75/kAAsArm7Hu3B4EWw/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Pulsedive Docs\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#006699\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.pulsedive.com/taxii/filtering\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/taxii/filtering.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Pulsedive Docs\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"Pulsedive Docs\"},\"provider\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","agentPointerHref":"/taxii/filtering.md","siteName":"Pulsedive Docs","nav":{"global":{"anchors":[{"anchor":"About Us","icon":"users","href":"https://pulsedive.com/about/company"},{"anchor":"Community","icon":"discord","href":"https://pulsedive.com/discord"},{"anchor":"Blog","icon":"newspaper","href":"https://blog.pulsedive.com"}]},"tabs":[{"tab":"Get Started","pages":[{"title":"Get Started","href":""}]},{"tab":"API Reference","pages":[{"title":"API Reference","href":"/api/overview"}]},{"tab":"STIX/TAXII Reference","pages":[{"group":"STIX/TAXII 2.1 Export","pages":[{"title":"STIX/TAXII Reference","sidebarTitle":"Overview","href":"/taxii/overview"},{"title":"Quick Setup","href":"/taxii/quick-setup"},{"title":"Authentication","href":"/taxii/authentication"},{"title":"Versioning","description":"Content negotiation and version support for Pulsedive's TAXII 2.1 implementation.","href":"/taxii/versioning"},{"title":"Filtering","href":"/taxii/filtering"},{"title":"Pagination","description":"Retrieve large result sets efficiently using next token or timestamp-based pagination.","href":"/taxii/pagination"}]},{"group":"API Roots","pages":[{"title":"API Roots","sidebarTitle":"Overview","icon":"grid-2","href":"/taxii/api-root/overview"},{"title":"Get API Roots","deprecated":null,"version":null,"sidebarTitle":"Get","openapi":"/taxii/api.yaml get /taxii2","href":"/taxii/api-root/get"}]},{"group":"Collections","pages":[{"title":"Collections","sidebarTitle":"Overview","icon":"grid-2","href":"/taxii/collection/overview"},{"title":"Get Collections","deprecated":null,"version":null,"sidebarTitle":"Get","openapi":"/taxii/api.yaml get /taxii2/api/collections","href":"/taxii/collection/get"}]},{"group":"Objects","pages":[{"title":"Objects","sidebarTitle":"Overview","icon":"grid-2","href":"/taxii/object/overview"},{"title":"Get Objects","deprecated":null,"version":null,"sidebarTitle":"Get","openapi":"/taxii/api.yaml get /taxii2/api/collections/{collectionID}/objects","href":"/taxii/object/get"}]}]},{"tab":"Bulk Export","pages":[{"title":"Bulk Export","href":"/export/overview"}]},{"tab":"Integrations","pages":[{"title":"Integrations","href":"/integrations"}]},{"tab":"Libraries","pages":[{"title":"Libraries","href":"/libraries"}]},{"tab":"Troubleshoot","pages":[{"title":"Troubleshoot","href":"/troubleshoot"}]}]},"basePath":"","title":"Filtering - Pulsedive Docs","buildId":"dpl_Fyv1NbzwP68g2bEH2Roy98uY1zmE","deploymentId":"dpl_Fyv1NbzwP68g2bEH2Roy98uY1zmE","dynamics":[],"chunks":[]}
