Saved Query Optimization

MarcEsc — Mon, 09 Feb 2026 12:02:30 GMT

Hi!

We have a saved query for a client for their application. The goal is to generate alerts for the client regarding their application for any mentions/attacks on the deep+dark+surface. The question is, how can we optimize the search so that there should be less noise, currently it generates a lot of false positives.

Thank you!

Re: Saved Query Optimization

NoaPeleg — Wed, 11 Feb 2026 19:39:43 GMT

Hi Marc, thank you for your inquiry.

There are various parameters you can apply to reduce false positives and noise for most queries:

1. Ensure your query includes a textual string, where any 2 words or more are preceded by a + (plus) and are inside quotation marks. For example, if the app name is Fantastic Mobile, you should type +"Fantastic Mobile" in the free text field, otherwise you'll get all results for "Fantastic", "Mobile", and their combination, leading to a lot of false positives. To reduce further, you can use different operators to combine with other search terms such as "attack". Click the [i] next to the search field to view a list of available operators.

2. Filter by Source Category, and select the categories that best fit your query, such as App Store, Forum etc.

3. Filter by Source, if you'd like to limit the search to specific stores, forums etc. For example, type "apk" under Source to view suggested stores. Note: this can considerably limit results.

4. Filter by Assets: if the app is a configured asset, search for it. For example, if the asset is an apk name with format com.brand.appname, e.g., com.azure.authenticator, start typing "com." under Assets, and if it's configured, it displays. Select it. If it's not configured, type it in the search field instead in this format +"com.azure.authenticator"

5. Limit the timeframe under Created or Published if you'd only like to see items from the Last Week, Last Month etc.

If this still doesn't reduce false positives and you need further assistance with your query, kindly open a ticket with Check Point Support and select the Threat Intelligence Request to consult an ERM expert. In some cases the service might consume coins, and you will be advised accordingly.

Hope this helps.

Noa Peleg
Knowledge & Enablement Lead

topic Saved Query Optimization in External Risk Management

Saved Query Optimization

Re: Saved Query Optimization