SPQL Syntax Rules

Updated
  • Updated on Aug 21, 2025
  • Published on Oct 4, 2023
  • 1 minute(s) read
Prev Next

SPQL (Silent Push Query Language) uses a simple, intuitive syntax to query Silent Push scan data. This article explains the core syntax components: field names, operators, and values.

Syntax Structure

  • Components: Queries combine three elements, separated by spaces:

    • Field Names: Input parameters from supported SPQL fields (e.g., favicon_md5 for a website’s favicon MD5 hash). See Understand Field Names for a complete list.

    • Operators: Define the relationship between field names and values (e.g., = for exact match, ~= for regular expression match).

    • Values: Data associated with a field name (e.g., silentpush.com for the domain field).

  • Connectors: Use AND to combine conditions. The OR operator is not supported, but lists in square brackets, e.g., (ip = [1.2.3.0/24, 5.6.7.0/24]), act as an OR condition for a single field.

Example

favicon_murmur3 = 309020573 AND domain = paypal.com

This queries for favicon murmur3 hash 309020573 on domains containing paypal.com.

Operators

Operator

Function

=

Exact match

!=

Is not equal to

>=

Greater than or equal to

<=

Less than or equal to

>

Greater than

<

Less than

~=

Regular expression match

!~=

Regular expression mismatch

Values

  • Must match the field’s datatype (e.g., string, boolean).

  • String values support wildcards * for partial matches.

  • Values with spaces must be enclosed in double quotes (e.g., "DDoS not configured").

  • Regular expressions must be enclosed in forward slashes, e.g., /^silent[a-z].+\.io$/, and match the entire field content. Only RE2 expressions are supported, with implied ^ and $ anchors if not specified.

Notes: See SPQL Query Examples for practical applications. Regular expressions require full matches unless explicitly modified.