> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Correlate services

> Require several conditions to match the same service on a host

A host contains summaries of several observed services. A normal host query can
be true when different services satisfy different clauses.

Consider:

```text theme={null}
services.protocol:https AND services.port:8443
```

One HTTPS service on port 443 and a different service on port 8443 can satisfy
that host query.

## Use `same_service`

Wrap service conditions when they must describe one service:

```text theme={null}
same_service(protocol:https AND port:8443)
```

Inside the wrapper, use service field names without the `services.` prefix.

```text theme={null}
same_service(
  protocol:https
  AND port:{443,8443}
  AND http.response.status_code:{200,301,302}
  AND tls.not_after>=now
)
```

You can combine the correlated service condition with host-level fields:

```text theme={null}
same_service(protocol:ssh AND port:22)
AND country_code:GB
AND last_seen>=now-7d
```

## When the wrapper changes nothing

Each result in the `services` dataset already represents one service.
`same_service(...)` is most useful in a `hosts` query, where the result can
contain several service summaries.

## DNS correlation

Each public DNS search result represents one DNS observation segment, so normal
`AND` clauses already apply to that result. Cross-record same-name correlation
requires a per-name summary index and is not currently exposed by the public
DNS search endpoint.

<Tip>
  Validate correlation queries with the dataset-first validation endpoint
  before saving or scheduling them.
</Tip>