> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Host fields

> Search fields for host context and summarized exposure

One host result represents an IP address with current network attribution and summarized services.

Dataset: `hosts`

<Note>
  Host queries can use every service field with the `services.` prefix. For example, use `services.protocol:ssh` instead of `protocol:ssh`. Browse the [service field reference](/data-dictionary/services) for those fields.
</Note>

Host-prefixed service fields support positive matching and ordered comparisons. Negated (`!=`) and substring-regex (`:~`) service clauses are not available in host queries.

<ResponseField name="asn" type="integer">
  Current numeric autonomous system number attributed to the host IP. Friendly label: `ASN`. Operators: `:` `=` `!=` `<` `<=` `>` `>=`.
</ResponseField>

<ResponseField name="country_code" type="string">
  Current ISO 3166-1 alpha-2 country code attributed to the host IP. Operators: `:` `=` `!=` `=~` `:~`.
</ResponseField>

<ResponseField name="distinct_certs" type="integer">
  Distinct TLS leaf certs over the host's current services. Operators: `:` `=` `!=` `<` `<=` `>` `>=`.
</ResponseField>

<ResponseField name="distinct_domains" type="integer">
  Distinct domains over the host's current services (shared-hosting/CDN signal). Operators: `:` `=` `!=` `<` `<=` `>` `>=`.
</ResponseField>

<ResponseField name="distinct_ja4s" type="integer">
  Distinct JA4S over the host's current services (TLS-stack diversity). Friendly label: `Distinct JA4S`. Operators: `:` `=` `!=` `<` `<=` `>` `>=`.
</ResponseField>

<ResponseField name="distinct_servers" type="integer">
  Distinct HTTP server strings over the host's current services. Operators: `:` `=` `!=` `<` `<=` `>` `>=`.
</ResponseField>

<ResponseField name="first_seen" type="timestamp">
  Earliest accepted observation timestamp for this host. Operators: `:` `=` `!=` `<` `<=` `>` `>=`.
</ResponseField>

<ResponseField name="ip" type="ip">
  IP address for the current host record. Operators: `:` `=` `!=`.
</ResponseField>

<ResponseField name="isp" type="string">
  Current ISP or network organization name attributed to the host IP. Friendly label: `ISP Name`. Operators: `:` `=` `!=` `=~` `:~`.
</ResponseField>

<ResponseField name="last_seen" type="timestamp">
  Most recent accepted observation timestamp for this host. Operators: `:` `=` `!=` `<` `<=` `>` `>=`.
</ResponseField>

<ResponseField name="service_count" type="integer">
  Number of current services summarized on this host. Operators: `:` `=` `!=` `<` `<=` `>` `>=`.
</ResponseField>

<ResponseField name="service_ports" type="repeated integer">
  Distinct current service ports summarized on this host. Operators: `:` `=` `!=` `<` `<=` `>` `>=`.
</ResponseField>

<ResponseField name="service_protocols" type="repeated string">
  Distinct current service protocols summarized on this host. Operators: `:` `=` `!=` `=~` `:~`.
</ResponseField>

<ResponseField name="service_transports" type="repeated string">
  Distinct current service transports summarized on this host. Operators: `:` `=` `!=` `=~` `:~`.
</ResponseField>

<ResponseField name="tags" type="string">
  Visible tag slug or name. Operators: `:` `=` `!=`.

  <Expandable title="Fields">
    <ResponseField name="category" type="string">
      Canonical slash-delimited category path assigned to a visible tag; a trailing /\* matches descendants. Operators: `:` `=`.
    </ResponseField>
  </Expandable>
</ResponseField>