Customize Your Intel Threat Feed Using the Threadlinqs Query Language (TLQL)

TLQL (Threadlinqs Query Language) is a compact, SPL-inspired query language built specifically for filtering threat intelligence. It powers the global search bar on intel.threadlinqs.com and the filter engine behind My Feeds. This guide is the canonical reference for every field, operator, and keyword TLQL supports.

TL;DR — TLQL lets you write expressions like
Threat.Severity = "CRITICAL" AND Category IN ("MALWARE", "SUPPLY_CHAIN") AND Threat.Detection.Count > 0 AND NOT Threat.MITRE = T1566
to instantly filter the platform's 500+ threats and save the result as a recurring feed.

Where TLQL Works

You can use TLQL in two places today:

1. Main feed search box — Click $ search in the threat feed header. Anything that contains an operator like =, IN, AND, or starts with | is parsed as TLQL; otherwise it falls back to plain keyword search.
2. My Feeds builder modal — When you create or edit a feed at /my-feeds, an auto-generated TLQL string appears below the structured filter controls. You can edit it directly to express logic the dropdowns can't (parenthesised OR groups, exclusions, comparisons).

The query you write in either place doesn't just narrow the threat list — it also drives every feed-view module you enable on the feed (IOCs, detections, CVEs, threat actors, tags, MITRE techniques, timeline, etc.). The modules aggregate data from the threats that match your TLQL. See TLQL and feed-view modules below for the per-module field mapping.

Grammar at a Glance

tlql// Optional pipe prefix (SPL-style, ignored by the parser)
| search <expression>

// expression = a tree of comparisons combined by AND / OR / NOT
<expression> := <term> ( (AND | OR) <term> )*
<term>       := NOT <term>  |  <primary>
<primary>    := "(" <expression> ")"
              |  <field> <op> <value>
              |  <field> IN "(" <value-list> ")"
              |  <field> NOT IN "(" <value-list> ")"
              |  "<bare-string>"

<op>         := =  !=  >  >=  <  <=  LIKE  CONTAINS
<value>      := "string"  |  number  |  identifier

Implicit AND is allowed between adjacent terms — these are equivalent:

tlqlSeverity = "HIGH" AND Category = "MALWARE"
Severity = "HIGH" Category = "MALWARE"

Operators

Logical Composition

Precedence: NOT binds tightest, then AND, then OR. Always use parentheses when mixing AND and OR — it makes intent explicit.

tlql// "Critical or High severity, but not patched"
(Severity = "CRITICAL" OR Severity = "HIGH") AND Status != "PATCHED"

// Same query, more concisely
Severity IN ("CRITICAL", "HIGH") AND Status != "PATCHED"

Bare Strings

A quoted string without a field on the left becomes a free-text match — it scans the threat's title, summary, description, tags, CVE list, threat actor name, and actor aliases. This is the easiest way to "track every mention of X":

tlql"ClickFix"                              // track every ClickFix variant or write-up
"ClickFix" AND Severity = "HIGH"        // narrow to high-severity ClickFix threats
"Cobalt Strike" OR "BloodHound"         // tool-mentions across description & tags

Field Reference

Every field is case-insensitive — Severity, severity, and SEVERITY are equivalent. Many fields have short aliases (e.g. Tag for Threat.Tag).

Threat metadata

Severity, category, and status

Attribution & targeting

Tags, identifiers, MITRE

Detections & IOCs

TLQL and Feed-View Modules

A saved feed renders matching threats through one or more modules. TLQL filters which threats feed every module, so any expression below scopes every section of the feed view simultaneously. The 11 modules currently available, and the TLQL fields you'd use to filter their data, are:

Toggle modules on or off when editing a feed at /my-feeds. Click any row inside a module to expand it inline — IOCs reveal a copy button + all source threats, detection rows reveal the full rule body, CVEs link to NVD, MITRE rows link to attack.mitre.org. The → TL-XXXX chip on each row jumps to the threat detail (back-button returns to your feed).

Worked Examples

Track every ClickFix variant or campaign

tlql"ClickFix"
// or, narrower:
"ClickFix" AND Severity IN ("CRITICAL", "HIGH")

Save this as a feed named ClickFix Tracker. Every time a new ClickFix-related threat is published, it shows up in your sidebar with an unread badge.

Every campaign attributed to a specific actor

tlqlActor CONTAINS "Lazarus" OR Actor CONTAINS "TraderTraitor"

NPM/Node supply-chain compromises with detections

tlqlThreat.Title IN ("NPM", "Node") AND Category IN ("SUPPLY_CHAIN") AND Threat.Detection.Count > 2 AND Severity IN ("HIGH", "CRITICAL") AND NOT Threat.MITRE = T1566 AND "TeamPCP"

This is the example from the launch post — read it left-to-right: "NPM or Node threats classified as supply chain with more than 2 detection rules, severity High or Critical, that do not use T1566 phishing, and somewhere mention TeamPCP".

Active, weaponized, high-CVSS vulnerabilities in your stack

tlqlCategory = "VULNERABILITY"
AND Exploitability IN ("ACTIVE", "WEAPONIZED")
AND CVSS >= 8
AND (Threat.Title CONTAINS "Apache" OR Threat.Title CONTAINS "Tomcat" OR "log4j")

Newly disclosed Russian APT activity, this week

tlqlNationState = "Russia" AND Category IN ("APT", "THREAT_INTEL") AND CreatedDays < 7

Sigma-rule-covered ransomware

tlql"ransomware" AND Detection.Type = "sigma"

Anything affecting healthcare in EMEA without an active patch

tlqlSector = "healthcare" AND Region = "EMEA" AND Status != "PATCHED"

External write-ups + exploit code for threats with public PoCs — feeds the references module

tlqlExploitability = "POC_PUBLIC"

Enable the references + threats modules on the feed. Any GitHub, exploit-db, gist, or vendor write-up on a PoC threat surfaces in the references list grouped by host. Pair with the cves + affected_products modules to see CVSS / EPSS and which vendor versions are affected.

Critical CVEs with active exploitation — feeds the cves module

tlqlCategory = "VULNERABILITY" AND CVSS >= 9 AND Exploitability IN ("ACTIVE", "WEAPONIZED")

Enable the cves module on the feed. Each CVE row shows its CVSS band, EPSS%, and a CISA KEV badge when applicable; clicking opens an NVD link.

State-sponsored activity in the last 30 days — drives threat_actors, timeline, tags

tlqlNationState IN ("Russia", "China", "DPRK", "Iran") AND CreatedDays < 30

Pair with the threat_actors module to see deduped actor cards with motivation / nation-state pills, the timeline module for chronological events across all matches, and tags for the most common labels used across this slice.

Tips & Gotchas

• Strings should be quoted. Use double quotes for safety: "CRITICAL". Identifiers like T1566 work bare, but quoting everything is the safe habit.
• Wildcard * works only with LIKE. Title CONTAINS "click*" looks for the literal string click*. Use Title LIKE "click*" for wildcards.
• Beware of != with enums. Severity != "LOW" OR Severity != "MEDIUM" is always true (every severity is unequal to at least one). Use Severity NOT IN ("LOW", "MEDIUM") or NOT (Severity IN ("LOW", "MEDIUM")).
• The bare-string trick works on title, summary, description, tags, CVE, and actor name. Useful for "track every mention of X regardless of category."
• Combine with manual pins. When saved as a My Feed, you can still manually pin a threat that doesn't match, or exclude a false positive. The feed is auto-filter + manual override.
• Live preview. The builder modal at /my-feeds shows the current match count as you type. If it says 0 unexpectedly, your TLQL probably has a logic error.

How TLQL Maps to the Platform

Every TLQL query is parsed into an abstract syntax tree (AST) and evaluated against each threat object. The same parser runs in the browser (live search, modal preview) and on the Cloudflare Worker that powers feed notifications and the sidebar count badges — so what you see in the preview is exactly what the server uses to compute notifications when a new threat is published.

The TLQL engine lives at /scripts/tlql.js (frontend) and is mirrored inside the worker. Field accessors normalize values (uppercase severity/category enums, lowercase tags, JSON parsing for arrays), so you don't have to think about case or representation.

What TLQL Isn't (Yet)

TLQL is intentionally small. Some things not in scope:

• Joins or pipes like ... | stats count by Severity — that's planned but not shipping today.
• Regular expressions on arbitrary fields — use LIKE with * wildcards.
• Time arithmetic like now() - 7d — for "last 7 days," use CreatedDays < 7.
• Custom field aliases per user — the built-in aliases cover the common cases.

If you find yourself wanting one of these, tell us — we add fields and operators based on demand.

Quick Reference

tlql// Operators:  =  !=  > >=  <  <=  IN  NOT IN  CONTAINS  LIKE
// Logical:    AND  OR  NOT  (  )
// Strings:    "double-quoted"
// Wildcards:  LIKE "click*"   or   LIKE "%click%"
// Bare:       "ClickFix"    — matches title/summary/desc/tags/CVE/actor
// Optional:   | search ...  (Splunk-style prefix, ignored)

// Top-used fields
Threat.Severity        Threat.Category        Threat.Status
Threat.Title           Threat.Summary         Threat.Description
Threat.Actor           Threat.NationState     Threat.Motivation
Threat.Tag             Threat.CVE             Threat.CWE
Threat.MITRE           Threat.MITRE.Tactic
Threat.CVSS            Threat.Detection.Count Threat.IOC.Count
Threat.Sector          Threat.Region
Threat.Created         Threat.CreatedDays