Sensors Search Parameters
The API has endpoints for querying our data in which you can use free text search together with one or more of the following filters:
Search by IP address or CIDR.
e.g ip:"192.168.1.1/24" or ip:192.168.1.1
Search by target port number.
Search in the payloads for a specific string
Search using ISO2 Country Codes.
Search using country names.
Search using city names.
Search by ASN.
Search by AS name.
Search by tags.
Search by timestamp.
e.g. created_at:[2018-09-01 TO 2018-10-01] created_at:2018-09-01
Search by RDNS.
Search by RDNS root.
Search by HTTP path.
Search by HTTP method.
Search by SSH identification string.
Free Text: not specifying a field will search on the full records, which can include other information not stated above.
Conditionals: the following conditionals are available: NOT, AND, OR. Must be UPPERCASE. You can also use the minus sign (-) as a replacement for the NOT conditional.
String fields caveat: if the string is expected to have spaces or some kind of punctuation in the middle, instead of querying field:value try instead field.keyword:"value". The first one will search for any occurrence of any of the words in value, while the second one will search for an exact match of the string.
Field existence or omission: you can search for records that have a specific field by using _exists_:field. Conversely, for records missing a field it would be NOT _exists_:field.