SPQL syntax rules

Silent Push Query Language (SPQL) uses a simple, intuitive syntax to query Silent Push scan data. This article explains the core syntax components: field names, operators, and values.

Syntax structure

Components: Queries combine three elements, separated by spaces:
- Field names: Input parameters from supported SPQL fields (e.g., favicon_md5 for a website’s favicon MD5 hash). Field names provide a complete list.
- Operators: Define the relationship between field names and values (e.g., = for exact match, ~= for regular expression match).
- Values: Data associated with a field name (e.g., silentpush.com for the domain field).
Connectors: Use AND to combine conditions. The OR operator is not supported, but lists in square brackets, e.g., (ip = [1.2.3.0/24, 5.6.7.0/24]), act as an OR condition for a single field.

Example

favicon_murmur3 = 309020573 AND domain = paypal.com

This queries for favicon murmur3 hash 309020573 on domains containing paypal.com.

Operators

Operator	Function
`=`	Exact match
`!=`	Is not equal to
`>=`	Greater than or equal to
`<=`	Less than or equal to
`>`	Greater than
`<`	Less than
`~=`	Regular expression match
`!~=`	Regular expression mismatch

Values

Must match the field’s datatype (e.g., string, boolean).
String values support wildcards * for partial matches.
Values with spaces must be enclosed in double quotes (e.g., "DDoS not configured").
Regular expressions must be enclosed in forward slashes, e.g., /^silent[a-z].+\.io$/, and match the entire field content. Only RE2 expressions are supported, with implied ^ and $ anchors if not specified.

Notes: See SPQL query examples for practical applications. Regular expressions require full matches unless explicitly modified.