Indicator search syntax

This section lists types of indicators that you can search for and the syntax for them.

URLs

You can search for domain names and specific URLs by using the following syntax:

• Second-level domain names

  example.com

• Domain names of third and lower levels

  www.example.com

• URLs

  http://www.example.com/index.html

Hashes

You can search for hashes by using the following syntax:

• MD5

  1A79A4D60DE6718E8E5B326E338AE533

• SHA1

  C3499C2729730A7F807EFB8676A92DCB6F8A3F8F

• SHA256

  50D858E0985ECC7F60418AAF0CC5AB587F42C2570A884095A9E8CCACD0F6545C

IP addresses

You can search for IPv4 addresses by using the following syntax:

198.51.100.0

Searching for IP addresses represented in Classless Inter-Domain Routing (CIDR) notation is not supported.

Page top