Control where "strict_text" is applied when searching about threatexchange

[jessek]

We haven't forgotten about this! I'm testing out a change now which would limit strict_text searches to the primary field (name, indicator, etc) for the type of data being searched.

[mgoffin]

That would be useful! If the change doesn't work, would it be breaking things too much to convert strict_text from a Boolean to a string which represents the field to apply strict searching on?

[jessek]

I'd like to keep strict_text as a boolean. We can change it's exact behavior, but what @mgoffin is proposing will be better in a different field. (text_field=description ?) A person may want to search another field with or without wildcards. (text="Jesse's best C2 server"&text_field=description&strict_text=1 vs. text="APT555"&field=description)

Regardless, the code to modify the behavior of strict_text has passed initial testing and is in the queue to be pushed next week. Using the example from above, I am now able to limit the data being returned s.t. that the text field must be in the indicator when strict_text is true.

I'm going to leave this open until the code is pushed and you can test it out. Let's revisit this next Wednesday and hopefully close this out.

[mgoffin]

@jessek I like your suggestion even better! 👍

[jessek]

Is the new strict text working for you?

[jessek]

I'm going to close this issue out now, but please reopen it if you have any issues.