# Filters

Filters are `field:value` clauses inside the `q` parameter. Combine them freely with free-text terms and boolean operators - see [Query Syntax](cyber-api-query-syntax).

## Site & network

| Filter | Example | Meaning |
| --- | --- | --- |
| `site.domain:` | `site.domain:example.onion` | Posts from a domain |
| `site.type:` | `site.type:chat` | Type of the source site |
| `site.country:` | `site.country:US` | Site country |
| `site.category:` | `site.category:*` | Category of the site |
| `extended.network:` | `extended.network:telegram` | Source network: `telegram`, `openweb`, `tor`, `public_chat`, `discord` |
| `extended.file_type:` | `extended.file_type:html` | Type of the crawled file |

## Content

| Filter | Example | Meaning |
| --- | --- | --- |
| `title:` | `title:ransomware` | Term in the post title |
| `text:` | `text:"initial access"` | Term in the post body |
| `author:` | `author:admin` | Post author |
| `language:` | `language:english` | Post language (full name, case-insensitive) |
| `published:` | `published:>1751630400000` | Publish time (Unix milliseconds) |
| `crawled:` | `crawled:>1751630400000` | Crawl time (Unix milliseconds) |
| `is_first:` | `is_first:true` | Only the first post of each thread |

## Thread

Bare forms are accepted - `replies_count:>10` is read as `thread.replies_count:>10`.

| Filter | Example | Meaning |
| --- | --- | --- |
| `thread.site_section:` | `thread.site_section:markets` | Section of the site |
| `thread.section_title:` | `thread.section_title:carding` | Title of the section |
| `thread.replies_count:` | `thread.replies_count:>10` | Replies in the thread |
| `thread.participants_count:` | `thread.participants_count:>5` | Distinct participants |
| `thread.spam_score:` | `thread.spam_score:<0.5` | Spam score of the thread |

## Enriched entities

Entity `value` fields hold what was extracted from the post.

| Filter | Example |
| --- | --- |
| `enriched.category:` | `enriched.category:*` (any classified post) |
| `enriched.person.value:` | `enriched.person.value:"john doe"` |
| `enriched.organization.value:` | `enriched.organization.value:binance` |
| `enriched.location.value:` | `enriched.location.value:paris` |
| `enriched.email.value:` | `enriched.email.value:admin@example.com` |
| `enriched.domain.value:` | `enriched.domain.value:example.com` |
| `enriched.phone.value:` | `enriched.phone.value:15551234567` |
| `enriched.credit_card.value:` | `enriched.credit_card.value:411111*` |
| `enriched.ssn.value:` | `enriched.ssn.value:*` |
| `enriched.wallet_id.value:` | `enriched.wallet_id.value:bc1q*` |
| `enriched.cve.value:` | `enriched.cve.value:"CVE-2024-3400"` |
| `enriched.cyber_risk.value:` | `enriched.cyber_risk.value:>7` (also `.site_risk`, `.content_risk`) |

## Links & files

| Filter | Meaning |
| --- | --- |
| `extended.external_link:` | Links found in the post |
| `extended.external_image:` | Image links found in the post |
| `extended.external_video:` | Video links found in the post |
| `extended.file_link:` | File links found in the post |

## Filter with URL parameters

Any filter can also be sent as its own query parameter for exact matching (`&language=english`), or negated with an `exclude_` prefix (`&exclude_site.type=chat`). Values sent this way must match exactly - ranges and wildcards belong in `q`.