Search Syntax for Attack Surface Management

The Attack Surface Management (ASM) search syntax operates under a few simple rules:

• Queries of different keywords are AND'd

  💡

  For example: acme.com port_tcp:80
  Read this as "any Entity with acme.com in the name AND port 80 TCP open"

• Queries of the same keyword are OR'd

  💡

  For example: acme.com port_tcp:80 port_tcp:443
  Read this as "any Entity with acme.com in the name AND (port 80 TCP OR port 443 TCP open)"

• For negative queries, use ! (NOT) before the search parameter, or search term

  💡

  For example: type:!uri
  Read this as "any type but NOT uri"

  ℹ️

  The ! (NOT) works in Issues, Entities, and Technologies but does not work with

  • Specific date filters like last_seen_after, last_seen_before, and first_seen_after
  • Collection filters

• The default search field (when no keyword is specified) is the item's "name" (for each of Entity, Issue, and Technology search)

Search Keywords

When searching on the Issues, Entities, and Technologies pages, you can create sophisticated queries using the keyword search, in addition to regular text searches. Accepted search terms together with their applicability on the Issues, Entities, and Technologies pages are defined below.