> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Hunt exposed services

> Find internet-facing endpoints by protocol, network, technology, fingerprint, or tag

Use the `services` dataset when each endpoint matters. One result represents one
observed network service, so a host with several exposed ports can produce
several results.

## Build the hypothesis

Start with the strongest stable signal you have, then add constraints that
reduce noise.

| Signal                  | Example                                        |
| ----------------------- | ---------------------------------------------- |
| Protocol and port       | `protocol:ssh AND port:22`                     |
| Network attribution     | `asn:AS13335 AND country_code:GB`              |
| Provider name           | `isp:"Cloudflare"`                             |
| Server fingerprint      | `fingerprints.ja4s:"<ja4s-fingerprint>"`       |
| Certificate name        | `tls.leaf_certificate.dns_names:"example.com"` |
| Reviewed classification | `tags.category:"malware/*"`                    |

<Note>
  Tag results respect the API key's organisation visibility. Category paths use
  canonical slash notation, and `/*` includes descendants.
</Note>

## Run the search

This example finds observed SSH services on port 22:

```bash theme={null}
curl --get "https://api.infrawatch.com/api/v1/search/services" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "q=protocol:ssh AND port:22" \
  --data "limit=100"
```

Search results are ordered by recent matching observations. Review:

* `ip_address` or `domain`, `port`, and `transport` for endpoint identity.
* `protocol`, `status`, and `scanned_at` for the observation.
* `banner`, `http`, and `tls` for promoted protocol evidence.
* `fingerprints` for allowlisted stable fingerprints.
* `tags` for visible reviewed classifications.
* `matched_fields` only as bounded match context; check
  `matched_fields_complete` before treating it as exhaustive.

## Validate generated queries

Validate queries produced by a user, agent, or saved hunt before execution:

```bash theme={null}
curl --request POST \
  --url "https://api.infrawatch.com/api/v1/search/services/validate" \
  --header "Content-Type: application/json" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data '{"query":"protocol:ssh AND port:22"}'
```

Validation checks syntax, public fields, and field-specific operators without
running a search.

## Turn one service into a broader hunt

<Steps>
  <Step title="Choose stable evidence">
    Prefer a protocol fact, certificate identity, reviewed tag, or fingerprint
    over a volatile banner fragment.
  </Step>

  <Step title="Add environmental constraints">
    Narrow by ASN, country, port, or observation date when the hypothesis calls
    for it.
  </Step>

  <Step title="Inspect a result page">
    Confirm the matches represent the intended service before requesting an
    exact count or distribution.
  </Step>

  <Step title="Measure the population">
    Run count and aggregate independently so analytics do not block the first
    page of evidence.
  </Step>
</Steps>

<CardGroup cols={2}>
  <Card title="Measure the result set" icon="https://mintcdn.com/infrawatch/gCEz_Bv1hOrMPG8n/images/products/measure.svg?fit=max&auto=format&n=gCEz_Bv1hOrMPG8n&q=85&s=de995887e2324aaeba6ac28c70da274c" href="/use-cases/measure-infrastructure" width="32" height="32" data-path="images/products/measure.svg">
    Count the hunt and group it by fields such as country, ASN, or port.
  </Card>

  <Card title="Browse searchable fields" icon="https://mintcdn.com/infrawatch/gCEz_Bv1hOrMPG8n/images/products/data-dictionary.svg?fit=max&auto=format&n=gCEz_Bv1hOrMPG8n&q=85&s=7610d618bf3603732c6f9102b62101df" href="/data-dictionary#services" width="32" height="32" data-path="images/products/data-dictionary.svg">
    Find protocol-specific fields and supported operators.
  </Card>
</CardGroup>