Execute a simple Web Scanner search

This guide explains how to create and execute queries in Web Scanner using the Simple Search tab’s graphical user interface (UI). Simple searches offer the same functionality as advanced searches but use a user-friendly interface, combining a Field name, Operator, and Value into an Expression, which can be chained with AND logic. This is ideal for users unfamiliar with SPQL syntax.

Create a simple search

1. Navigate to Explore Scan Data > Web Scanner.

2. Select the Simple Search tab.

3. Click New.

4. Build an expression:

   1. Field name: Select a field (e.g., domain, ip) from the dropdown or type to search.

   2. Operator: Choose an operator (e.g., =, !=) from the dropdown, relevant to the field.

   3. Value: Enter a value (e.g., crypto* for domains starting with "crypto").

5. (Optional) Specify a Sort Order by selecting a field from the dropdown (e.g., scan_date for newest first).

6. To add another condition, click Add New to create a new Expression linked with AND.

7. (Optional) Click Reset to clear all parameters.

8. Click Search to execute the query.

Example:

• Expression 1: domain = crypto*

• Expression 2: tld = onion (linked with AND)

• Sort order: scan_date (descending)

• Result: Finds .onion domains starting with "crypto," sorted by most recent scan.

Edit a search

1. After the query runs, results appear below the Expression boxes, with parameters populated.

2. Modify the Field name, Operator, or Value in the Expression boxes as needed.

3. Click Search to re-run the query with updated parameters.

Save a search

1. Enter valid parameters in the Expression boxes.

2. Click Save in the top right.

3. Enter a Name and (optionally) a Description.

4. Click Save to store the query for future use.