Intellifind

Selecting the Intellifind module on the navigation panel in Intelligence Hub will direct you to the Intelligence Hub > Intellifind module on the Threat Command platform.

Rapid7 continuously monitors the clear, deep, and dark web inspecting thousands of sources and tens of millions of web pages with proprietary crawlers.

While the Threat Command and Threat Intelligence IOCs (indicators of compromise) provide tactical intelligence, IntelliFind search gives you operational intelligence.

Use the IntelliFind search module to:

• Search company-specific assets and mentions (matching results) across the entire intelligence surface.
• Perform complex searches to find relevant findings and relevant context.
  • For example, you can search for a result that contains both a specific threat and your company name.
• Proactively track threat actors and view their activity.
• Automate searches via Threat Command RESTful APIs.
• Use IntelliAlert to automatically trigger alerts when results match specific query criteria.

Access to IntelliFind is limited to users with a subscription to the Intelligence Hub module.

To search with IntelliFind:

1. Navigate to the IntelliFind tab.
2. Type a search term in the Search bar and press enter on your keyboard.

By default, the IntelliFind search page shows mentions from all sources, from the past 12 months, with the most recent shown first. You can Export IntelliFind Results to CSV.

You can view results from specific sources and filter according to the report date, matching assets, and tags. When using the top row filter buttons, a mention must match ALL of the filters to be displayed. Within each filter, a mention can match ANY of the selected criteria.

The information included in each mention, if known, is described in this table.

Results with identical content and source type are grouped together under the latest mention. To view these results, click View Similar Mentions.

When a matched result is part of a thread, either as an original post or as a comment about a post, all of the thread posts and comments are grouped together in the Threads tab. To see those, click View Thread.

When an alert has been triggered for a result, its severity and alert type is indicated in the display. To see the alert in the Alerts page, click Go To Alert.

When multiple alerts have been triggered for the same source URL, you can see them all in the Alerts page by clicking View Related Alerts.

You can elevate a result to an alert by clicking Create Alert. You can also use IntelliAlert to automatically trigger alerts when results match specific query criteria.

You can save search queries and pinpoint search results by using search options.

The Mentions graph shows the number of mentions from all sources over the time range of the report. Mentions are a very strong sign of a potential threat and therefore are useful for monitoring trends. You can click on a peak to show all results in the designated time frame.

For additional filter and query options, see Filter and search IntelliFind results.

Export IntelliFind Results to CSV

You can export IntelliFind mentions to a downloadable CSV file. All results (limit 200) that match the current search query and filters will be downloaded.

To export results to a CSV:

1. From the IntelliFind tab, search for IntelliFind mentions.
2. (Optional) You can filter the page to limit the mentions that are exported.
3. Click Export CSV.
   The Export page displays the query details and the current filters.
4. (Optional) You can select columns to be included in the CSV:
   1. Click Column Options (by default, all columns are selected).
   2. Select or clear columns.
   3. Create column order by dragging columns up or down.
5. Click Download.
   The CSV report is downloaded to the default download location.

Filter and search IntelliFind results

Filter IntelliFind results

You can filter the results by the source of mention, report date, and dark web source. You can also filter by results in a time frame indicated by peak points in the Mentions graph.

To filter Intellifind results:

1. Use IntelliFind to search for a term.
2. From the results page, apply filters, as follows:

Search options

The following table describes the various ways to create more effective searches, from either the landing page or the search page:

Advanced search operators

Type any of these operators to find an exact match. The operators (only) are case-sensitive.

Save and edit search queries

You can use the Query Manager to save, use, and manage search queries. When you save a search query, you can easily reuse, edit, name, or delete that query. Saved queries include all the search terms.

A maximum of 200 queries can be saved, per account. In the Query Manager, the latest updated query is shown first.

Each line shows a saved query, its details, whether (and how many) alerts are being generated from the query, the name of the user who made the most recent changes, and when the query was last updated.

Product for Sale query

Querying for product for sale will return results, as follows:

• Hacking forum posts with the product for sale tag.
• By enabling alert triggering for this query, future IntelliFind results that contain an indication of a product being offered for sale and a match to the company's name or brand name will be elevated to alerts.

Automatic alert creation is described in IntelliAlert.

To save a search query:

1. From the IntelliFind search page or landing page, type a search query, then press enter on the keyboard.
   The searched mentions are displayed.
2. Click Save query.
   The Save query dialog displays the search query terms and selected filters.
3. Type a unique name for the query.
   Names are case-sensitive.
4. Click Save query.

To search with a saved query:

1. Open the Query Manager, in either of these ways:
   • If no IntelliFind page is open, choose Threat Command > Intellifind, then click Query Manager.
   • If an IntelliFind page is open, click Query Manager.
2. Select a saved query, then click the magnifiying glass icon. You can find a saved query by searching by name or by query terms.

To edit or delete a saved query:

1. Open the Query Manager, in either of these ways:
   • If no IntelliFind page is open, navigate to Intellifind, then click Query Manager.
   • If an IntelliFind page is open, click Query Manager.
2. Select a saved query.
   You can find a saved query by searching by name or query terms.
3. Perform any of the following:
   • Click the magnifiyng glass to change the query search terms or alert triggering settings, and to search for the new terms. Press enter on your keyboard to search.
   • Click the pencil to edit a query name or the alert triggering options.
   • Click the trash can to delete a saved query.

IntelliAlert

You can cause automatic alert triggering for mentions that match specific search criteria. If the search query returns more than 200 average daily mentions, this option is disabled. You can add additional tags to the default query name tag. Queries that automatically trigger alerts are displayed as such in the Query Manager, together with the count of how many alerts they generated.

The IntelliAlert feature is available for users with a subscription to both Threat Command and Intelligence Hub.

Limitations

The following limitations apply to automatic alert triggering with IntelliAlert:

• Per account, you can select up to 100 queries to trigger alerts.
• Per query, a maximum of 100 alerts can be triggered every 24 hours.
• Alert triggering takes place on each selected query once an hour.

To trigger alerts automatically:

1. Create or edit a search, as described in the previous sections.
2. Before saving the search, select Create alerts from query.
3. Set the create alerts from query options:
   1. Set the maximum number of alerts, up to 100, to be triggered in 24 hours (default: 10).
   2. Set the severity for the alerts (default: medium).
   3. Add additional tags to the created alerts.
4. Save the query.

Mentions that match the specific criteria will create new alerts.

You can edit the alert triggering settings, as described in the Save and edit search queries section.