> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search Attributes

Returns a list of attributes.

> [!NOTE]
>
> External Documentation
>
> To learn more, visit the [MISP documentation](https://www.misp-project.org/openapi/#tag/Attributes/operation/restSearchAttributes).

## Basic Parameters

| Parameter | Description |
| - | - |
| Deleted | Whether to include soft-deleted attributes. If set to `True`, only deleted attributes will be returned. |
| Event Info | Quick event description. |
| Published | Was the attribute published. |
| UUID | The uuid of the attribute. |
| Value 1 | Search attribute by value. |

## Advanced Parameters

| Parameter | Description |
| - | - |
| Attack Galaxy | The attack galaxy. |
| Attribute Timestamp | The timestamp of the attribute. |
| Category | The category of the attribute. |
| Decaying Model | Specify the decaying model from which the decaying score should be calculated. |
| Enforce Warning List | Should the warning list be enforced. Adds blocked field for matching attributes. |
| Event ID | The unique identifier of an event. |
| Event Timestamp | The timestamp of the event. |
| Exclude Decayed | Should the decayed elements by excluded. |
| First Seen | First seen within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m). |
| From | Get the attributes starting from this time. `Note` : You can use time related filters. Examples: `7d`, timestamps, `[14d, 7d]`(For ranges) |
| Headerless | Removes header in the CSV export. |
| Include Context | Adds events context fields in the CSV export. |
| Include Correlations | Includes correlations. |
| Include Decay Score | Include all enabled decaying score. |
| Include Event Tags | Include tags of matching events in the response. |
| Include Event UUID | Include matching eventUuids in the response. |
| Include Full Model | Include all model information of matching events in the response. |
| Include Proposals | Include proposals of matching events in the response. |
| Include Sightings | Extend response with Sightings DB results if the module is enabled. |
| Include Warninglist Hits | Includes the warning lists hits. |
| Last | Events published within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m), ISO 8601 datetime format or timestamp. |
| Last Seen | Last seen within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m). |
| Limit | Limit the amount of pages shown. |
| Model Overrides | The model overrides. Example: <pre>`{  "lifetime": 3,  "decay_speed": 2.3,  "threshold": 30,  "default_base_score": 80,  "base_score_config": {     "estimative-language:confidence-in-analytic-judgment": 0.25,     "estimative-language:likelihood-probability": 0.25,     "phishing:psychological-acceptability": 0.25,     "phishing:state": 0.2  }}`</pre> |
| Object Relation | Filter by the attribute object relation value. |
| Organization ID | The unique identifier of the organization. |
| Page | The page number. |
| Publish Timestamp | The timestamp of publish. |
| Requested Attributes | List of properties that will be selected in the CSV export. |
| Score | An alias to override on-the-fly the threshold of the decaying model. |
| Sharing Group | Sharing group ID(s), either as single string or list of IDs. |
| Tags | Search by the tags of the attributes. |
| Threat Level ID | - |
| Timestamp | The timestamp. |
| To | Get the attributes until this time. `Note` : You can use time related filters. Examples: `7d`, timestamps, `[14d, 7d]`(For ranges) |
| To IDs | To IDs. |
| Type | The type of attribute. Visit `https://www.misp-project.org/openapi/#tag/Attributes/operation/restSearchAttributes` under the parameter `type` for the full list of types. |
| Value 2 | Search attribute by value. |
| Value 3 | Search attribute by value. |
| With Attachments | Extends the response with the base64 representation of the attachment, if there is one. |

## Example Output

```json theme={"dark"}
{
	"response": {
		"Attribute": [
			{
				"id": "<string>",
				"event_id": "<string>",
				"object_id": "<string>",
				"object_relation": "<string>",
				"category": "<string>",
				"type": "<string>",
				"to_ids": true,
				"uuid": "<string>",
				"timestamp": "<string>",
				"distribution": "<string>",
				"sharing_group_id": "<string>",
				"comment": "<string>",
				"deleted": false,
				"disable_correlation": false,
				"first_seen": null,
				"last_seen": null,
				"value": "<string>",
				"Event": {
					"org_id": "<string>",
					"distribution": "<string>",
					"publish_timestamp": "<string>",
					"id": "<string>",
					"info": "<string>",
					"orgc_id": "<string>",
					"uuid": "<string>"
				},
				"Object": {
					"id": "<string>",
					"distribution": "<string>",
					"sharing_group_id": "<string>"
				}
			},
			{
				"id": "<string>",
				"event_id": "<string>",
				"object_id": "<string>",
				"object_relation": "<string>",
				"category": "<string>",
				"type": "<string>",
				"to_ids": true,
				"uuid": "<string>",
				"timestamp": "<string>",
				"distribution": "<string>",
				"sharing_group_id": "<string>",
				"comment": "<string>",
				"deleted": false,
				"disable_correlation": false,
				"first_seen": null,
				"last_seen": null,
				"value": "<string>",
				"Event": {
					"org_id": "<string>",
					"distribution": "<string>",
					"publish_timestamp": "<string>",
					"id": "<string>",
					"info": "<string>",
					"orgc_id": "<string>",
					"uuid": "<string>"
				},
				"Object": {
					"id": "<string>",
					"distribution": "<string>",
					"sharing_group_id": "<string>"
				}
			}
		]
	}
}
```