Manage and Run Queries

Updated
  • Updated on Aug 7, 2025
  • Published on Jan 16, 2025
  • 2 minute(s) read
Prev Next

Locate, Run, and Filter Queries

Locate and run a saved query

Web Scanner allows you to access and run previously saved or recent queries.

  1. From the home page, select Web Data, and then select Web Scanner.

  2. Select My Searches.

  3. Click the Saved tab to view all saved queries.

  4. Select the Recent tab to view recently executed queries.

  5. In the Search saved queries box, type the name of the query you are searching for.

Run a query

  1. Click the desired query from the list to execute it.

  2. Results will appear in a collapsible Results table.

Apply filters to a query

You can refine the saved queries using filters to find specific queries quickly.

  1. In the My Searches section, click Filter & Sorting to access and apply filters.

  2. Configure your desired filters and click Apply.

Use the following table to understand the filters available in your saved queries to help you identify a specific saved query:

Filter

Description

Filter by tag

Type the name of the tag to filter saved queries by.

Filter by type

From the dropdown menu, select whether the query type is Shared or Private.

Sorting

Select how your saved queries are presented.

Type

Select if your query type is either:  Shared: Available to other users in the organization. Private: Available only to yourself.

Alphabetic

Select how your saved queries are presented alphabetically:  Ascending: Arranged from A-Z.  
Descending: Arranged from Z-A.

Creation date

Select how your saved queries are presented by age:  Newest: Start with your most recently saved queries. Oldest: Start with your oldest saved queries.

Construct and Execute Queries

Web Scanner supports query construction using two methods: Command Line (using SPQL syntax) or Constructor (a UI-based query builder). Queries can target specific data sources, such as webscan or torscan, and use field names to define search parameters.

Command Line Query Example

To scan for IPs hosted in Japan within the last 7 days:

scan_date > now-7d AND tld = jp

Breakdown

  • scan_date: Field name for the scan date.

  • >: Operator meaning “is greater than”

  • now-7d: Value for the last 7 days.

  • AND: Separator linking conditions.

  • tld: Field name for the top-level domain.

  • =: Operator meaning “is equal to”

  • jp: Value for Japan.

Constructor Query Example

The same query can be built using the Constructor feature:

  1. Navigate to Explore Scan Data > Web Scanner.

  2. Select the Constructor option.

  3. Add expressions:

    1. Expression 1: Field = scan_date, Operator = >, Value = now-7d.

    2. Expression 2: Field = tld, Operator = =, Value = jp.

    3. Link expressions with the AND separator.

  4. Execute the query to retrieve results.

Query Multiple Data Sources

To search across multiple data sources, specify them in square brackets.

domain = "payments*" AND datasource = [webscan, torscan]

This query searches for domains starting with “payments” in both the webscan and torscan data sources.

Save Queries

To save a query for future use:

  1. After constructing a query (via Command Line or Constructor), click Save in the UI.

  2. Assign a name and choose the query type (Shared or Private).

  3. Optionally, add tags for easier filtering later.

For more details on data sources and field names, refer to the Understand Field Names article.