Search syntax
Start in Search with a domain, an IP address or a keyword. Use explicit fields when you want to control what matches. The same field expressions work in the dataset pages and their API requests.
Start with an example
| Goal | Dataset | Query |
|---|---|---|
| Explore a domain across records | Unified search | example.com |
| Find services on a domain and its subdomains | Hosts | (host:example.com OR host:*.example.com) |
| Restrict those services to HTTPS | Hosts | (host:example.com OR host:*.example.com) AND port:443 |
| Find IPv4 DNS answers | DNS | host:*.example.com AND type:A |
| Find names pointing to an IP | DNS | value:192.0.2.1 |
| Find certificate names | Certificates | san:*.example.com |
| Find a domain registration | WHOIS | domain:example.com |
| Find a registration organization | WHOIS | registrant_organization:"Example Company" |
| Find a technology on a scoped set of hosts | Hosts | host:*.example.com AND technologies:nginx* |
The examples use reserved names and addresses. Replace them with your investigation target; an empty example result is not a service error.
Fields and values
Write field:value. Quote values containing spaces or punctuation that belongs to the value, for example title:"Customer Portal" or headers:"Content-Type: text/html". Use ordinary straight quotes, not typographic quotes copied from a document.
Field names depend on the dataset. A DNS answer uses value; a host's observed address uses resolution; a certificate name uses san; WHOIS uses domain. See Hosts, DNS, Certificates and WHOIS for their fields.
Combine and exclude
Use uppercase AND, OR and NOT, with parentheses to make the grouping explicit:
host:*.example.com AND (port:80 OR port:443) AND NOT status_code:404
(host:example.com OR host:*.example.com) AND NOT technologies:Cloudflare
NOT excludes a matching condition. It does not establish that a missing or unobserved attribute is absent from the live service.
Wildcards
* matches a sequence of characters on supported text fields. host:*.example.com targets subdomains; add host:example.com explicitly when you also need the apex. A suffix such as *example.com can match names outside that domain, so it is a poor substitute for a scoped domain query.
Prefer a concrete name or suffix over a leading wildcard across the entire index. Numeric fields such as ports are best queried as numbers, not wildcard text.
Numeric comparisons and dates
Use <, <=, > and >= on fields that support comparisons:
host:*.example.com AND port>=8000 AND port<9000
For observation dates, use the interface's Observed selector. It applies to indexed observations, not a live availability check. A certificate's validity dates and a domain's registration dates describe different events; do not interpret them as the time Profundis last saw the asset.
What changes in unified search?
A bare domain or IP can be interpreted into appropriate queries for multiple datasets. The heading shows the interpretation; Search everywhere broadens it when offered.
With explicit fields, Profundis selects the datasets that support the expression. It does not join rows from different datasets. For example, type:A AND san:*.example.com combines a DNS-only field with a certificate field and has no common dataset. Run two searches, then follow their observed connections.
An unknown field produces an error with suggestions where available. Fix it rather than broadening the query blindly. See Unified search.
Search from a result
Use a result value's available search/refine actions to add a condition. The Find text on this page field only filters already loaded rows; it does not search the full index. The facet rail is based on the search response and should not be read as a complete inventory.
Why is my query rejected or incomplete?
| Symptom | Check |
|---|---|
| Invalid syntax | Balanced parentheses, straight quotes, uppercase operators and a value after each field |
| Unknown field | Dataset field reference; host, domain, san and value are not interchangeable |
| Conflicting fields | Split the expression into searches supported by a common dataset |
| Filter or depth limit | Your current plan and the limit shown by the interface |
| Slow or partial results | Start with a domain/IP scope, reduce broad wildcards and inspect the partial-results notice |
| Locked data | Authentication and dataset entitlement; creating an account does not unlock every paid field |
Search syntax is not the same as a regular expression in an advanced alert rule. Use the alert editor's query validation and Test lab when creating a watch.