InfraQL

InfraQL is the query language for Infrawatch data. It combines readable search syntax with typed fields, boolean logic, time windows, collections, pattern matching, and dataset-aware correlation.

protocol:https AND port:443

The public API validates InfraQL against the selected dataset before it reaches the search backend. Invalid fields, values, and operators return a stable client error.

What InfraQL supports

Operators and values

Combine typed comparisons, boolean logic, collections, existence checks, and field aliases.

Time and ranges

Search relative windows, fixed dates, exact timestamps, and inclusive or exclusive ranges.

Correlate services

Use same_service(...) when several conditions must match one service on a host.

Patterns and text

Use contains, wildcards, regular expressions, quoted phrases, and bare banner terms where the field allows them.

Choose a dataset

Search starts with the result you want:

Dataset	One result represents	Best for
`hosts`	An IP address with summarized services	Host context, exposure overviews, and infrastructure discovery
`services`	One observed network service	Ports, protocols, banners, HTTP, TLS, and fingerprints
`dns`	One DNS observation segment	Forward and reverse passive-DNS pivots
`osint`	One intelligence report	Published reporting associated with an IP or topic

Host queries normally prefix service fields with services.. Service queries use those fields directly. Inside same_service(...), use the service field names without the prefix.

Start with a field

The basic clause is:

field:value

Combine clauses with AND, OR, NOT, and parentheses:

protocol:ssh AND (port:22 OR port:2222) AND NOT country_code:{US,CA}

InfraQL also accepts implicit AND between adjacent clauses:

protocol:ssh port:22

Use the explicit form in saved queries and automation because it is easier to review.

Examples by dataset

Hosts
Services
DNS
OSINT

same_service(protocol:ssh AND port:22) AND country_code:GB

Returns hosts in Great Britain with one observed SSH service on port 22.

protocol:https AND timestamp>=now-24h

Returns HTTPS endpoints observed during the last 24 hours.

answer_ip:1.1.1.1 AND first_seen>=now-30d

Returns recent DNS observations whose answer is 1.1.1.1.

ip:1.1.1.1

Returns published reports associated with 1.1.1.1.

Combine context in one query

Host search can combine network attribution, tag classifications, and evidence from one matching service:

services.tags.category:proxy/*
AND country_code:DE
AND same_service(
  protocol:https
  AND http.title="Grafana"
)

This finds hosts in Germany that are classified in the proxy taxonomy and have one HTTPS service whose page title equals Grafana. same_service(...) prevents the protocol and HTTP conditions from matching different services on the same host.

Validate before execution

Validate a generated, user-supplied, or automated query against the same dataset you intend to search:

curl --request POST \
  --url "https://api.infrawatch.com/api/v1/search/hosts/validate" \
  --header "Content-Type: application/json" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data '{"query":"same_service(protocol:ssh AND port:22)"}'

Validation checks syntax, fields, operators, and dataset policy without running the search.

Run the search

Pass the InfraQL expression in q. curl --data-urlencode safely encodes spaces and punctuation:

curl --get "https://api.infrawatch.com/api/v1/search/services" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "q=protocol:ssh AND timestamp>=now-24h" \
  --data "limit=25"

Every response contains a dataset array, the normalized query, and a shared pagination object.

Browse every field

Inspect types, operators, aliases, and dataset-specific meanings.

Follow analyst workflows

Apply InfraQL to IP, service, DNS, bulk-enrichment, and aggregation work.

Start here

Language guide

Investigation workflows

What InfraQL supports

Operators and values

Time and ranges

Correlate services

Patterns and text

Choose a dataset

Start with a field

Examples by dataset

Combine context in one query

Validate before execution

Run the search

Browse every field

Follow analyst workflows

​What InfraQL supports

Operators and values

Time and ranges

Correlate services

Patterns and text

​Choose a dataset

​Start with a field

​Examples by dataset

​Combine context in one query

​Validate before execution

​Run the search

Browse every field

Follow analyst workflows

What InfraQL supports

Choose a dataset

Start with a field

Examples by dataset

Combine context in one query

Validate before execution

Run the search