Work with Web Search results

This guide covers how to view, customize, expand, export, and analyze results from Web Search queries, including pivoting on domains/IPs and adding results to feeds.

Search results

When you execute a query in Web Search (via Constructor or Command Line), results are displayed in a collapsible Results table. The default columns include:

Column	Description
`Origin_URL`	The first URL that was scanned
`ssl.issuer.organization`	The organization that issued the SSL/TLS certificate for the website, if applicable.
`header.server`	The web server software or platform identified in the HTTP response headers (e.g., Apache, Nginx).
`favicon_icons`	The URL or details of the favicon (favorite icon) associated with the website, typically displayed in browser tabs or bookmarks.
`html_body_ssdeep`	A fuzzy hash of the HTML body content, used for comparing similarity between web pages.
`htmltitle`	The title of the web page as defined in the HTML `title` tag.
`response`	The HTML response code received from the web server
`scan_date`	Timestamp of when a scan was performed
`ip`	The IP address of the server hosting the scanned URL.
`url`	The final URL that was scanned

Expand and refine queries

You can expand individual results to view additional field names and incorporate them into your query:

In the Results table, click Expand on the far right of a result row.
A list of field names for that result will appear (e.g., ssl.expired, geoip.country_name).
Left-click any blue-colored field name text and select an operator (e.g., = or !=) to add it to your query.
The field name is appended to your current query, which can be re-run with the new parameters.

Customize result displays

To modify which data types are displayed in the Results table:

Click the vertical line icon next to Basic Raw Data in the table header.
Use checkboxes to include or exclude specific field names (e.g., show only Domain and IP).
The table updates to reflect your selections.

Copy, export, and view raw data

Web Search provides options to utilize the result data:

Copy to clipboard

Click Copy in the top left of the Results table to copy all visible results.
Alternatively, use checkboxes to select specific rows and copy only the selected ones.

Export data

Click the Download icon to export the results as a CSV or JSON file.
Choose to export all visible results or only selected rows.

View raw data

Click Basic Raw Data to view the raw data behind all results.
Copy the raw data to the clipboard for further analysis.

Pivot

For any indictors in your results, use Silent Push’s Standard Pivot Control.

Add results to Feeds

To save results for further analysis or sharing:

Left-click a domain or IP in the Results table.
Select Add to Feed/Collection.
Choose:
1. Existing: Add to an existing feed or collection.
2. New: Create a new feed or collection.
Confirm to save the selected data.