All search parameters have an "AND" relationship, except threats and feeds, which have an "OR" relationship. This allows you to drill down on indicators appearing in multiple feeds or seen with multiple threats. Should we change this?
Attributes are modifiable tags applied to indicators, such as ports, protocols, and query strings.
Properties are immutable key-value pairs derived from indicator enrichment. WHOIS, SSL certificate, location, and HTTP header data are all converted into properties.