Correlate services

A host contains summaries of several observed services. A normal host query can be true when different services satisfy different clauses. Consider:

services.protocol:https AND services.port:8443

One HTTPS service on port 443 and a different service on port 8443 can satisfy that host query.

Use `same_service`

Wrap service conditions when they must describe one service:

same_service(protocol:https AND port:8443)

Inside the wrapper, use service field names without the services. prefix.

same_service(
  protocol:https
  AND port:{443,8443}
  AND http.response.status_code:{200,301,302}
  AND tls.not_after>=now
)

You can combine the correlated service condition with host-level fields:

same_service(protocol:ssh AND port:22)
AND country_code:GB
AND last_seen>=now-7d

When the wrapper changes nothing

Each result in the services dataset already represents one service. same_service(...) is most useful in a hosts query, where the result can contain several service summaries.

DNS correlation

Each public DNS search result represents one DNS observation segment, so normal AND clauses already apply to that result. Cross-record same-name correlation requires a per-name summary index and is not currently exposed by the public DNS search endpoint.

Validate correlation queries with the dataset-first validation endpoint before saving or scheduling them.

Start here

Language guide

Investigation workflows

Use `same_service`

When the wrapper changes nothing

DNS correlation

​Use same_service

​When the wrapper changes nothing

​DNS correlation

Use `same_service`

When the wrapper changes nothing

DNS correlation