Filter Results with TQL¶
When retrieving Case objects, including Artifacts, Artifact types, Cases, Notes, Tasks, Workflow Events, and Workflow Templates, results can be filtered by including
?tql= in the query parameter followed by a query written in ThreatConnect Query Language (TQL).
For example, the following query will return all Cases created between April 1 and 30, 2021:
GET /v3/cases/?tql=dateAdded >= "2021-04-01" and dateAdded < "2021-04-30"
To view a list of available options to set in the
?tql= query parameter for each Case object, use the following query: