This article documents certificate-related and signals data sources in SPQL. These include Certificate Transparency data, related certificate intelligence models, and aggregated signals used for threat scoring and behavioral analysis across the platform.
Certificates & Signals
certs
Certificate transparency and related certificate data stored in ClickHouse. Supports filtering by issuer, subject, dates, fingerprints, serial numbers, and related metadata.
cert-cookies & cert-siblings
Related certificate intelligence models for cookie-based and sibling certificate relationships across domains.
signals
Aggregated signals across sources. Contains detailed indicator fields (including body analysis, geoip counts, SSL aggregates, and other behavioral signals) used for threat scoring and detection.