> ## Documentation Index > Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt > Use this file to discover all available pages before exploring further. # InfraQL > Search Infrawatch data with a typed, analyst-friendly query language InfraQL is the query language for Infrawatch data. It combines readable search syntax with typed fields, boolean logic, time windows, collections, pattern matching, and dataset-aware correlation. ```text theme={null} protocol:https AND port:443 ``` The public API validates InfraQL against the selected dataset before it reaches the search backend. Invalid fields, values, and operators return a stable client error. ## What InfraQL supports Combine typed comparisons, boolean logic, collections, existence checks, and field aliases. Search relative windows, fixed dates, exact timestamps, and inclusive or exclusive ranges. Use `same_service(...)` when several conditions must match one service on a host. Use contains, wildcards, regular expressions, quoted phrases, and bare banner terms where the field allows them. ## Choose a dataset Search starts with the result you want: | Dataset | One result represents | Best for | | ---------- | -------------------------------------- | -------------------------------------------------------------- | | `hosts` | An IP address with summarized services | Host context, exposure overviews, and infrastructure discovery | | `services` | One observed network service | Ports, protocols, banners, HTTP, TLS, and fingerprints | | `dns` | One DNS observation segment | Forward and reverse passive-DNS pivots | | `osint` | One intelligence report | Published reporting associated with an IP or topic | Host queries normally prefix service fields with `services.`. Service queries use those fields directly. Inside `same_service(...)`, use the service field names without the prefix. ## Start with a field The basic clause is: ```text theme={null} field:value ``` Combine clauses with `AND`, `OR`, `NOT`, and parentheses: ```text theme={null} protocol:ssh AND (port:22 OR port:2222) AND NOT country_code:{US,CA} ``` InfraQL also accepts implicit `AND` between adjacent clauses: ```text theme={null} protocol:ssh port:22 ``` Use the explicit form in saved queries and automation because it is easier to review. ## Examples by dataset ```text theme={null} same_service(protocol:ssh AND port:22) AND country_code:GB ``` Returns hosts in Great Britain with one observed SSH service on port 22. ```text theme={null} protocol:https AND timestamp>=now-24h ``` Returns HTTPS endpoints observed during the last 24 hours. ```text theme={null} answer_ip:1.1.1.1 AND first_seen>=now-30d ``` Returns recent DNS observations whose answer is `1.1.1.1`. ```text theme={null} ip:1.1.1.1 ``` Returns published reports associated with `1.1.1.1`. ## Combine context in one query Host search can combine network attribution, tag classifications, and evidence from one matching service: ```text theme={null} services.tags.category:proxy/* AND country_code:DE AND same_service( protocol:https AND http.title="Grafana" ) ``` This finds hosts in Germany that are classified in the proxy taxonomy and have one HTTPS service whose page title equals `Grafana`. `same_service(...)` prevents the protocol and HTTP conditions from matching different services on the same host. ## Validate before execution Validate a generated, user-supplied, or automated query against the same dataset you intend to search: ```bash theme={null} curl --request POST \ --url "https://api.infrawatch.com/api/v1/search/hosts/validate" \ --header "Content-Type: application/json" \ --header "X-API-Key: ${INFRAWATCH_API_KEY}" \ --data '{"query":"same_service(protocol:ssh AND port:22)"}' ``` Validation checks syntax, fields, operators, and dataset policy without running the search. ## Run the search Pass the InfraQL expression in `q`. `curl --data-urlencode` safely encodes spaces and punctuation: ```bash theme={null} curl --get "https://api.infrawatch.com/api/v1/search/services" \ --header "X-API-Key: ${INFRAWATCH_API_KEY}" \ --data-urlencode "q=protocol:ssh AND timestamp>=now-24h" \ --data "limit=25" ``` Every response contains a dataset array, the normalized query, and a shared pagination object. Inspect types, operators, aliases, and dataset-specific meanings. Apply InfraQL to IP, service, DNS, bulk-enrichment, and aggregation work.