Investigation workflows

Use these workflows when you have an indicator or a hypothesis and need to know which dataset to query, what to pivot on, and how to interpret the result. The examples use the public API. The same InfraQL expressions work in the Infrawatch search interface.

Investigate an IP

Build host context, inspect exposed services, trace DNS, and find related reporting.

Pivot through passive DNS

Move from an address to names, or from a domain to its observed answers.

Hunt exposed services

Find endpoints by protocol, port, network, HTTP, TLS, fingerprint, or tag.

Enrich IP lists

Use bulk lookup to add bounded context to up to 100 addresses at a time.

Measure a result set

Count matching records and group them by public fields without delaying the initial search response.

Choose the workflow

Starting point	Question	Start with
IP address	What is this host and what does it expose?	Investigate an IP
IP address or domain	Which names and addresses are related?	Pivot through passive DNS
Detection hypothesis	Where is a technology or service exposed?	Hunt exposed services
Indicator list	How do I enrich these addresses efficiently?	Enrich IP lists
Result set	How large is it and how is it distributed?	Measure infrastructure

Before you run an example

Create an API key with search.view, then export it once:

export INFRAWATCH_API_KEY="<your-api-key>"

Exact counts and aggregations also require search.aggregate.

Run your first request

Create a key and make a verified host search.

Understand InfraQL

Learn datasets, operators, pagination, validation, and result semantics.

Start here

Language guide