Execute a Web Search

This guide explains how to create, execute, edit, and save queries in Web Search using either the Simple Search tab’s user-friendly graphical interface or the Advanced Search tab’s Search and Query Language (SPQL) command-line syntax. Simple Search is ideal for users unfamiliar with SPQL, while Advanced Search is suited for technical users seeking precise query control.

Simple Search: Use the graphical interface

Simple Search offers the same functionality as Advanced Search but uses an intuitive UI, combining a Field name, Operator, and Value into an Expression, chained with AND logic. This is perfect for users new to SPQL syntax.

1. From the left navigation menu, select  Explore Scan Data > Web Search.

2. Select the Simple Search tab.

3. Click New.

4. Build an expression:

   1. Field name: Select a field (e.g., domain, ip) from the dropdown or type to search.

   2. Operator: Choose an operator (e.g., =, !=) from the dropdown, relevant to the field.

   3. Value: Enter a value (e.g., crypto* for domains starting with crypto).

5. (Optional) Specify a Sort Order by selecting a field from the dropdown (e.g., scan_date for newest first).

6. To add another condition, click Add New to create a new Expression linked with AND.

7. (Optional) Click Reset to clear all parameters.

8. Click Search to execute the query.

Example

• Expression 1: domain = crypto*

• Expression 2: tld = onion (linked with AND)

• Sort order: scan_date (descending)

• Result: Finds .onion domains starting with crypto, sorted by most recent scan.

Edit a simple search

1. After the query runs, results appear below the Expression boxes, with parameters populated.

2. Modify the Field name, Operator, or Value in the Expression boxes as needed.

3. Click Search to re-run the query with updated parameters.

Save a simple search

1. Enter valid parameters in the Expression boxes.

2. Click Save in the top right.

3. Enter a Name and (optionally) a Description.

4. Click Save to store the query for future use.

Advanced Search: Use SPQL syntax

Advanced Search utilizes SPQL command-line syntax, which is ideal for technical users who are comfortable crafting precise queries to target specific data.

Understand SPQL syntax

SPQL queries combine Field names, Operators, and Values, often linked with logical separators like AND or OR. For example:

domain = crypto* AND tld = onion

• Field name: domain (the data category, e.g., final domain after redirects).

• Operator: = (equals, or use !=, >, <, etc.).

• Value: crypto* (a wildcard search for domains starting with "crypto").

• Separator: AND (links conditions).

• Second condition: tld = onion (targets .onion domains).

For detailed SPQL syntax, refer to SPQL Documentation.

Create an Advanced Search

1. From the left navigation menu, select Explore Scan Data > Web Scanner.

2. Select the Advanced Search tab.

3. Click New.

4. Enter a query using SPQL syntax, including spaces between elements (e.g., domain = crypto* AND tld = onion).

5. Optional) Specify a Sort order by selecting a field from the dropdown or typing it (e.g., scan_date).

6. (Optional) Click Reset to clear all parameters.

7. Press Enter or click the blue arrow icon to execute the query.

Example

• Query: scan_date > now-7d AND tld = jp

• Sort order: scan_date (descending)

• Result: Finds domains with Japan’s top-level domain (.jp) scanned in the last 7 days, sorted by most recent.

Edit an Advanced Search

1. After the query runs, parameters collapse, and results appear below.

2. Click the Web Scanner Search Form button to expand the query input.

3. Edit the SPQL query as needed.

4. Press Enter or click the blue arrow icon to re-run the query.

Save an Advanced Search

1. Enter valid SPQL parameters in the query box.

2. Click Save in the top right.

3. Enter a Name and (optionally) a Description.

4. Click Save to store the query for future use.