Use the following filters to focus only on the data you need.
Escaping reserved charactersIf you need to use any of the characters which function as operators in your query itself (and not as operators), then you should escape them with a leading backslash. For instance, to search for external_links:https://www.linkedin.com*, you would need to write your query as external_links:https://www.linkedin.com*
The reserved characters are:
+ - = && || > < ! ( ) { } [ ] ^ " ~ * ? : \ /Failing to escape these special characters correctly could lead to a syntax error which prevents your query from running.
Parameter | Description | Example |
|---|---|---|
url | Filter by the URL of the post |
|
uuid | Filter by the unique Identifier of the document |
|
parent_uuid | Filter by unique Identifier of the parent document |
|
title | A textual Boolean query describing the keywords that should (or should not) appear in the post's title |
|
text | A textual Boolean query describing the keywords that should (or should not) appear in the text |
|
author | Return posts written by a specific author or actor | Find posts written by Thewiseguys: |
author_extended.display_name | Return posts written by the user identified by the display name. | Find posts written by "Pmalek": |
author_extended.user_id | Return posts written by the user identified by the unique identifier in the website or application. | Find posts written by user id: 112493 in domain bitcointalk.org: |
author_extended.user_link | Return posts written by the user identified by the user hyperlink in the website or application. | Find posts written by user link : |
author_extended.adversary_group | Return posts written by a certain adversary group. | Find posts written by Lockbit: |
language | The language of the post. The default is "any". | Find posts in French or Italian: |
published | A timestamp (in milliseconds) enabling you to filter items that were published before or after certain date/time. | Return posts from threads published after |
site.name | Filter posts based on the site name (in some cases there are multiple domains with the same name) |
|
site.domain | Limit the results to a specific site or sites. Search any replica domain and get all of the site's content. |
|
site.current_domain | Filter according to the specific domain used at the time the document was scanned |
|
site.type | Filter sites by their type. |
|
site.category | Filter posts based on their site category: |
|
thread.url | Filter by the thread url. Also partial results can be filtered using wild card. |
|
thread.uuid | Filter by the unique Identifier of the thread |
|
thread.title | A textual Boolean query describing the keywords that should (or should not) appear in the thread title |
|
thread.published | A timestamp (in milliseconds) enabling you to filter threads that were published before or after certain date/time. | Return posts from threads published after |
thread.section_title | A textual Boolean query describing the keywords that should (or should not) appear in the section title |
|
thread.site_section | Filter by the site section url. | Find all posts that contains lihkg.com as part of their site section. |
thread.replies_count | Filter by the number of replies per post | Search for all posts that include |
ord_in_thread | Filter by the numerical order of the post in the thread | Return for all first posts published in threads |
extended.external_link | Search for posts that include links to another site | Search for pages that linked to |
extended.external_image | Search for posts that include image links | Retrieve all posts that include image links |
extended.external_video | Search for posts that include video links | Retrieve all posts that include video links |
extended.file_link | Search for posts that include file links | Retrieve all posts that include file links |
extended.file_type | Filter posts based on the file type crawled. Possible file types: | Search only on sql documents: |
extended.network | Filter posts by network. |
|
extended.required_login | A Boolean field (true/false) stating if the content is password protected | Return content posted on |
enriched.category | Filter posts into one or more of the following 14 categories: | Return posts that were |
enriched.email.value | Filter by full or partial email address entity | Search for all posts that include |
enriched.email.count | Filter by the number of email addresses mentions per post | Search for all posts that include |
enriched.ssn.value | Filter by a full or partial social security number (SSN) | Search for all posts that include |
enriched.ssn.count | Filter by number of social security numbers (SSN) mentions per post | Search for all posts that include |
enriched.credit_card.value | Filter by full or partial credit card (CC) number entity | Search for all posts that include |
enriched.credit_card.count | Filter by the number of credit card mentions per post | Search for all posts that include |
enriched.phone.value | Filter by a full or partial phone number entity | Search for all posts that include |
enriched.phone.count | Filter by the number of phone number mentions per post | Search for all posts that include |
enriched.wallet_id.value | Filter by a full or partial cryptocurrency wallet ID entity |
|
enriched.wallet_id.count | Filter by the number of cryptocurrency wallet mentions per post | Search for all posts that include |
enriched.ip.value | Filter by a specific , range or list of IP entities. | • Search for IP that match 127.0.0.1: |
enriched.ip.count | Filter by the number of IPs mentioned in the post | Search for all the posts that include more than 10 IPs. |
enriched.domain.value | Filter by a specific or partial domain entity , it could be TLD or sub domain. | Search for all posts that include |
enriched.domain.count | Filter by the number of domains mentioned in the post. | Search for all the posts that include more than 10 domains. |
enriched.cve.value | Filter by a specific or partial CVE Id entity. The qualified CVE structure is : CVE-[4 digits]-[serial number 4-7 digits] | Search for all the posts that include CVE Ids from 2021. |
enriched.cve.count | Filter by the number of CVE Ids mentioned in the post. | Search for all the posts that contain more than 5 CVE Ids. |
enriched.person.value | Filter by a full or partial person name entity. | Search for all posts that include |
enriched.person.count | Filter by the number of person name mentions per post | Search for all posts that include |
enriched.organization.value | Filter by a full or partial organization entity name. | Search for all posts that include |
enriched.organization.count | Filter by the number of organization mentions per post | Search for all posts that include |
enriched.location.value | Filter by a full or partial location entity name | Search for all posts that include |
enriched.location.count | Filter by the number of locations mentions per post | Search for all posts that include |
enriched.cyber_risk.value | Filter posts based on their cyber risk score, ranging from 0 to 10 (where 10 indicates the highest risk level) |
|
crawled | A timestamp (in milliseconds) enabling you to filter items that were crawled before or after certain date/time. | Return posts crawled after |
Thread Filters
A thread contains global information about the content of the whole page and its content. A thread can contain multiple posts grouped together.
| Parameter | Description | Example |
|---|---|---|
| thread.title | A textual Boolean query describing the keywords that should (or should not) appear in the thread title | Search for posts containing the word "glass" and not "metal" in their title:(thread.title:glass -thread.title:metal) |
| thread.section_title | A textual Boolean query describing the keywords that should (or should not) appear in the site's section where the post was published | Search for the posts containing the word food only under sections with a title that contains the word "restaurants":(food AND thread.section_title:restaurants) |
| thread.url | Get all the posts of a specific thread (note that you must escape the http:// part of the URL like so: http://) | |
| thread.published | A time-stamp (in milliseconds) filtering threads that were published before or after a certain date/time. Here is a Timestamp/Date converter | Return threads published after Thu, 30 Mar 2017 09:16:28 GMT: thread.published:><br />1490865388000 |
Note: The special characters are not supported in Cyber API search. Except for specific characters such as & , $ , @ which can be used as part of the keyword search.
Example : "НЕЙТА $ ДЕПОЗИТ"