Searches with a larger number of characters return more results compared to searches with fewer characters in TISC. - Support and Troubleshooting

Searches with a larger number of characters return more results compared to searches with fewer characters in TISC. .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Issue :

When performing searches in the Threat Intelligence Library within the Threat Intelligence Security Center (TISC) Workspace, queries with a greater number of characters tend to return more results than those with fewer characters.

Example:

1. RecordedFuture TAXII: Default ----> 74,075 records are returned. ----> It seems that system does not get the record from Indicator.

2. RecordedFuture TAXII: Default URL risk list ----> 217,682 records are returned.

Root Cause:

The search behaviour observed in the Threat Intelligence Library within the Threat Intelligence Security Center (TISC) Workspace, where longer search queries yield more results than shorter ones—is attributed to the underlying text indexing mechanism configured on the indicator table ( sn_sec_tisc_indicator ).

This mechanism is managed by the text index table ( ts_index_name ), which controls how terms are indexed and mapped for search operations. During the installation of the TISC application, a text index configuration was automatically generated for the indicator table. One key feature of this configuration is the "Auto Stop" setting, which is enabled by default.

When "Auto Stop" is active, the system tracks the frequency of terms across indexed records. If a term exceeds the configured auto threshold limit, it is automatically added to a stop list. Terms in the stop list are excluded from indexing and, therefore, from search results. This is done to enhance performance and reduce the impact of overly common or non-informative terms during searches.

This behaviour is especially noticeable in shorter search phrases, where a higher proportion of the input terms may consist of common words that have been filtered out by the stop list—resulting in fewer or no matches. Conversely, longer search queries tend to include a greater number of unique or less frequent terms, which are more likely to be indexed, leading to more comprehensive and relevant search results.

Resolution:

The actual resolution to the customer is that they need to delete the stop word records created for the words which they want to be considered in searching result. and it is advisable to disable the " Auto Stop " checkbox for specific tables/indexes to prevent stop words from being generated or setting the " Auto threshold " higher is the correct move.

Referece link: https://www.servicenow.com/docs/bundle/yokohama-platform-administration/page/administer/search-administration/task/t_ConfigureAnAutomaticStopWord.html https://www.servicenow.com/community/in-other-news/configuring-auto-stop-words-and-regenerate-text-indexes/ba-p/2266898