ShadowTrackr

Log in >
RSS feed

New search syntax with autocomplete

31 December 2019
The last update of this year contains a bunch of bug fixes, server upgrades, better cloud tracking and renewed search and export options. Those last two are definitely worth discussing in more detail.

The search options have grown organically over time and ended up being messy. In the early days you could use grade:B to search for all TLS certificates with that grade (based on SSL Labs scores). Then came website security grades (based on Mozilla observatory scores) and grade: became ambiguous. The quick fix was splitting it in the rather ugly certgrade: and webgrade:. Since you could only search a few entities (certificates, hosts and websites) and fields, collisions were rare. It only happened with grade.

Now, as more entities and fields become searchable, collisions are more likely. To fix that, the search syntax is now redesigned based on Lucene search syntax. So, to search for all websites running on apache having a website security grade B you use:

website.grade:B AND website.software:apache

To search for all certificates with grade A that were issued by Comodo, you do:

certificate.grade:A AND certificate.issuer:Comodo

Much better right? And the search bar on every page now has autocomplete. It shows you which entities are searchable (currently: certificate, website, host, whois and dns) and which fields are available. It also autocompletes your known urls and ip addresses. You can use either the mouse or the up/down arrow keys and tab to complete your search text. Have a look a these search examples .

The other big change is in how we track things in the cloud. We see that more and more assets of our customers end up at big cloudproviders and CDNs. So far, we’d just list the name of the cloud instead of the ip. That was a bit incomplete to say the least, and now we track both the cloud and current ip. This allows for better scanning and better graphs, and opens up the way to new functionality.

Note that you might find some rediscovered cloud assets on your timeline. This is all part of the automatic migration and doesn’t cause any trouble. It can clutter your timeline though, so we’ll do our best to clean it up as much as possible. Still finding trouble? Please let us know and we’ll fix it for you.
Older posts >

Resources
API
Blog
Documentation
Integrations
Shodan
OpenCTI