OpenCTIInstall

Summary

Search observables by term, type, and filters

Inputs

• searchTerm — Full-text search term to match across observable values.
• observableTypes — Comma-separated list of observable types to filter results (e.g., IPv4-Addr,Domain-Name).
• limit — Maximum number of results to return; must be between 1 and 500.
• searchOptions.filterValue — Apply an exact match filter on the observable_value field.
• searchOptions.orderBy — Field used to sort results; options are created_at, entity_type, observable_value, updated_at (default created_at).
• searchOptions.orderMode — Sort direction; ascending or descending (default descending).

Output shape

list of observable objects

Results are paginated; default limit 50; may include pagination metadata.

Examples

Example 1: Search for all IPv4 addresses mentioning 'malware'.

searchTerm: 'malware', observableTypes: 'IPv4-Addr', limit: 100, searchOptions.filterValue: ''

Example 2: Retrieve the 20 most recent domain observables ordered by creation date descending.

searchTerm: '', observableTypes: 'Domain-Name', limit: 20, searchOptions.orderBy: 'created_at', searchOptions.orderMode: 'desc'

Example 3: Find observables exactly matching value '1.2.3.4'.

searchTerm: '', observableTypes: '', limit: 50, searchOptions.filterValue: '1.2.3.4'

Links

• n8n community nodes installation guide