Search syntax
Start in Search with a domain, an IP address or a keyword. Use explicit fields when you want to control what matches. The same field expressions work in the dataset pages and their API requests.
Start with an example
| Goal | Dataset | Query |
|---|---|---|
| Explore a domain across records | Unified search | example.com |
| Find services on a domain and its subdomains | Hosts | (host:example.com OR host:*.example.com) |
| Restrict those services to HTTPS | Hosts | (host:example.com OR host:*.example.com) AND port:443 |
| Find IPv4 DNS answers | DNS | host:*.example.com AND type:A |
| Find names pointing to an IP | DNS | value:192.0.2.1 |
| Find certificate names | Certificates | san:*.example.com |
| Find a domain registration | WHOIS | domain:example.com |
| Find a registration organization | WHOIS | registrant_organization:"Example Company" |
| Find a technology on a scoped set of hosts | Hosts | host:*.example.com AND technologies:nginx* |
The examples use reserved names and addresses. Replace them with your investigation target; an empty example result is not a service error.
Fields and values
Write field:value. Quote values containing spaces or punctuation that belongs to the value, for example title:"Customer Portal" or headers:"Content-Type: text/html". Use ordinary straight quotes, not typographic quotes copied from a document.
Field names depend on the dataset. A DNS answer uses value; a host's observed address uses resolution; a certificate name uses san; WHOIS uses domain. See Hosts, DNS, Certificates and WHOIS for their fields.
Combine and exclude
Use uppercase AND, OR and NOT, with parentheses to make the grouping explicit:
host:*.example.com AND (port:80 OR port:443) AND NOT status_code:404
(host:example.com OR host:*.example.com) AND NOT technologies:Cloudflare
NOT excludes a matching condition. It does not establish that a missing or unobserved attribute is absent from the live service.
Wildcards
* matches a sequence of characters on supported text fields. host:*.example.com targets subdomains; add host:example.com explicitly when you also need the apex. A suffix such as *example.com can match names outside that domain, so it is a poor substitute for a scoped domain query.
Prefer a concrete name or suffix over a leading wildcard across the entire index. Numeric fields such as ports are best queried as numbers, not wildcard text.
Numeric comparisons and dates
Use <, <=, > and >= on fields that support comparisons:
host:*.example.com AND port>=8000 AND port<9000
For observation dates, use the interface's Observed selector. It applies to indexed observations, not a live availability check. A certificate's validity dates and a domain's registration dates describe different events; do not interpret them as the time Profundis last saw the asset.
What changes in unified search?
A bare domain or IP can be interpreted into appropriate queries for multiple datasets. The heading shows the interpretation; Search everywhere broadens it when offered.
Focus on a domain and exclude names
Available on staging, in unified Search, its API and organization research:
"example.com" -dev -www.example.com
"example.com"matches the domain and its subdomains. It does not includenotexample.com,example.com.other.net, or records that only mention the domain in a title or header.-devexcludes every name containingdev, includingdev-api.example.comanddevelopment.example.com, without regard to case. A title containing “developer” does not exclude a record whose name matches.-www.example.comexcludes that exact name.www2.example.comandapi.www.example.comremain eligible.
These conditions apply to host/DNS names, certificate SAN/common names and WHOIS domains. An excluded name removes the matching record; for a certificate, any matching SAN or common name excludes the certificate. DNS answers, certificate issuers and WHOIS nameservers do not expand the domain scope.
Other quoted text, such as "customer portal", remains a literal phrase search. Quoted domains keep their scope even with broad=true; remove the quotes for a broad text search. Existing NOT word still excludes matches across the allowed text fields. Use NOT field:value for field filters, rather than -field:value. Negative numbers and internal hyphens remain ordinary inputs. Dataset-specific search endpoints retain their field syntax.
With explicit fields, Profundis selects the datasets that support the expression. It does not join rows from different datasets. For example, type:A AND san:*.example.com combines a DNS-only field with a certificate field and has no common dataset. Run two searches, then follow their observed connections.
An unknown field produces an error with suggestions where available. Fix it rather than broadening the query blindly. See Unified search.
Search from a result
Use a result value's available search/refine actions to add a condition. The Find text on this page field only filters already loaded rows; it does not search the full index. The facet rail is based on the search response and should not be read as a complete inventory.
Why is my query rejected or incomplete?
| Symptom | Check |
|---|---|
| Invalid syntax | Balanced parentheses, straight quotes, uppercase operators and a value after each field |
| Unknown field | Dataset field reference; host, domain, san and value are not interchangeable |
| Conflicting fields | Split the expression into searches supported by a common dataset |
| Filter or depth limit | Your current plan and the limit shown by the interface |
| Slow or partial results | Start with a domain/IP scope, reduce broad wildcards and inspect the partial-results notice |
| Locked data | Authentication and dataset entitlement; creating an account does not unlock every paid field |
Search syntax is not the same as a regular expression in an advanced alert rule. Use the alert editor's query validation and Test lab when creating a monitor.