---
title: "IQ for Threat Defense Variables"
canonical: "https://docs.infoblox.com/space/DeploymentGuideTDwDDIforSplunkSOAR/1688600707/IQ%20for%20Threat%20Defense%20Variables"
format: markdown
---
### Parameters:

| Parameter | Description |
| --- | --- |
| **Status** | Filter Insights by their current status. Defaults to `ALL`; when `ALL` is selected, no status filter is sent to the API (string). |
| **Severity** | Filter Insights by severity level (LOW, MEDIUM, HIGH, CRITICAL). Defaults to `ALL`; when `ALL` is selected, no severity filter is sent to the API (string). |
| **Name** | Filter by the user-facing insight name (case-insensitive partial match) (string). |
| **Threat Properties** | Filter by comma-separated threat properties, e.g. `malware,phishing,ransomware` (string). |
| **Date Created** | Filter by the insight creation timestamp. Provide an RFC 3339 date-time value (e.g., `2025-12-19T07:01:56Z`); only insights created on that specific day are returned; this is a single-day filter, not a range from this date to now (string). |
| **Insight ID** | Return a specific insight by its unique display identifier (string). |
| **Indicators** | Filter by comma-separated threat indicators; matches insights whose indicators array contains any of the listed values (string). |
| **Assets** | Filter by comma-separated assets; matches insights whose assets array contains any of the listed values (string). |
| **User** | Filter by comma-separated users; matches insights whose users array contains any of the listed values (string). |

### Severity Mapping of IQ for TD Insights:

| **Priority Level** | **SOAR Container Severity** |
| --- | --- |
| CRITICAL | High |
| HIGH | High |
| MEDIUM | Medium |
| LOW | Low |

### **Container Creation**

Each IQ for TD Insight will create a separate container in Splunk SOAR with relevant metadata and artifacts containing the insight details.

### **Container Updates**

IQ for TD Insight containers and artifacts will not be updated after initial ingestion, even if the insight is updated in Infoblox.

### **Insight De-duplication**

Insights will be deduplicated based on the insight ID to prevent duplicate containers.