> ## Documentation Index > Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt > Use this file to discover all available pages before exploring further. # Search Attributes Returns a list of attributes. External Documentation To learn more, visit the [MISP documentation](https://www.misp-project.org/openapi/#tag/Attributes/operation/restSearchAttributes). ## Basic Parameters
| Parameter | Description | | ---------- | ------------------------------------------------------------------------------------------------------- | | Deleted | Whether to include soft-deleted attributes. If set to `True`, only deleted attributes will be returned. | | Event Info | Quick event description. | | Published | Was the attribute published. | | UUID | The uuid of the attribute. | | Value 1 | Search attribute by value. |
## Advanced Parameters
| Parameter | Description | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Attack Galaxy | The attack galaxy. | | Attribute Timestamp | The timestamp of the attribute. | | Category | The category of the attribute. | | Decaying Model | Specify the decaying model from which the decaying score should be calculated. | | Enforce Warning List | Should the warning list be enforced. Adds blocked field for matching attributes. | | Event ID | The unique identifier of an event. | | Event Timestamp | The timestamp of the event. | | Exclude Decayed | Should the decayed elements by excluded. | | First Seen | First seen within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m). | | From | Get the attributes starting from this time.
`Note` : You can use time related filters.
Examples: `7d`, timestamps, `[14d, 7d]`(For ranges) | | Headerless | Removes header in the CSV export. | | Include Context | Adds events context fields in the CSV export. | | Include Correlations | Includes correlations. | | Include Decay Score | Include all enabled decaying score. | | Include Event Tags | Include tags of matching events in the response. | | Include Event UUID | Include matching eventUuids in the response. | | Include Full Model | Include all model information of matching events in the response. | | Include Proposals | Include proposals of matching events in the response. | | Include Sightings | Extend response with Sightings DB results if the module is enabled. | | Include Warninglist Hits | Includes the warning lists hits. | | Last | Events published within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m), ISO 8601 datetime format or timestamp. | | Last Seen | Last seen within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m). | | Limit | Limit the amount of pages shown. | | Model Overrides | The model overrides.
Example:
\{
  "lifetime": 3,
  "decay\_speed": 2.3,
  "threshold": 30,
  "default\_base\_score": 80,
  "base\_score\_config": \{
     "estimative-language:confidence-in-analytic-judgment": 0.25,
     "estimative-language:likelihood-probability": 0.25,
     "phishing:psychological-acceptability": 0.25,
     "phishing:state": 0.2
  }
}
| | Object Relation | Filter by the attribute object relation value. | | Organization ID | The unique identifier of the organization. | | Page | The page number. | | Publish Timestamp | The timestamp of publish. | | Requested Attributes | List of properties that will be selected in the CSV export. | | Score | An alias to override on-the-fly the threshold of the decaying model. | | Sharing Group | Sharing group ID(s), either as single string or list of IDs. | | Tags | Search by the tags of the attributes. | | Threat Level ID | - | | Timestamp | The timestamp. | | To | Get the attributes until this time.
`Note` : You can use time related filters.
Examples: `7d`, timestamps, `[14d, 7d]`(For ranges) | | To IDs | To IDs. | | Type | The type of attribute.
Visit `https://www.misp-project.org/openapi/#tag/Attributes/operation/restSearchAttributes` under the parameter `type`
for the full list of types. | | Value 2 | Search attribute by value. | | Value 3 | Search attribute by value. | | With Attachments | Extends the response with the base64 representation of the attachment, if there is one. |
## Example Output ```json theme={"dark"} { "response": { "Attribute": [ { "id": "", "event_id": "", "object_id": "", "object_relation": "", "category": "", "type": "", "to_ids": true, "uuid": "", "timestamp": "", "distribution": "", "sharing_group_id": "", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": null, "last_seen": null, "value": "", "Event": { "org_id": "", "distribution": "", "publish_timestamp": "", "id": "", "info": "", "orgc_id": "", "uuid": "" }, "Object": { "id": "", "distribution": "", "sharing_group_id": "" } }, { "id": "", "event_id": "", "object_id": "", "object_relation": "", "category": "", "type": "", "to_ids": true, "uuid": "", "timestamp": "", "distribution": "", "sharing_group_id": "", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": null, "last_seen": null, "value": "", "Event": { "org_id": "", "distribution": "", "publish_timestamp": "", "id": "", "info": "", "orgc_id": "", "uuid": "" }, "Object": { "id": "", "distribution": "", "sharing_group_id": "" } } ] } } ``` ## Workflow Library Example [Search Attributes with Misp and Send Results Via Email](https://library.blinkops.com/workflows/search-attributes-with-misp-and-send-results-via-email)
Workflow Library Preview this Workflow on desktop