Using HYAS Insight Search

Conceptual Model

The foundation for HYAS Insight search is an “exact keyword” concept that looks for a single, specific value for one of the supported object types. HYAS Insight identifies the object type and triggers a set of secondary queries based upon the object type, and the specific value. For example, searching for 1.2.3.4 will cause Insight to recognize the request as an IPv4 address and will query specific data sets determined to be relevant for IP addresses using the value 1.2.3.4.

Generic Search Strings

When the input string is not recognized as a supported type, an “exploratory faceted search” is performed. In this case HYAS Insight queries the inputted value across specific data sets for domains, email addresses, registrant names, certificates, tags, and notes.

Recognized Fields

The fields that HYAS Insight will recognize if entered with the correct syntax are the following:

Sometimes it is not possible to identify the difference between object types, such as in the case of a nameserver versus a domain. In the event you wish your query to be limited to a specific object type, all of the object types in the table above can be specified in your query using the syntax objecttype:value. For example, querying nameserver:asd.com will return the nameserver object and associated data rather than the domain object and associated data.

Wildcards

Wildcards can be used to query multiple values of a certain object type. Wildcards query against HYAS Insight’s WhoIs and other data.

The fields that currently support wildcards are:

• Domain domain:

• Email address email:

• Nameserver nameserver:

• MX Record mailhost:

• User Agent useragent:

Wildcards are bound by the following rules:

• The object:value syntax must be followed

• Wildcards are represented with an asterisk (*) only

• Leading wildcards can be used before a string such as domain:*cruz.com

• Trailing wildcards can be used after a string such as domain:cruz*

• Middle wildcards can be used (between characters of your string) such as domain:cr*uz.com

• Multiple wildcards can be used in a single query such as domain:*c*ruz*.com

• Strings must contain at least 3 characters other than * . @ such as domain:*a.us and email:*@a.us

• *.[TLD] is not supported such as domain:*.com

• Domains must include the . between the TLD and SLD unless you use a trailing wildcard, in which case the trailing * will be assumed to be *.*

  • Example: domain:*cruz* will be considered domain:*cruz*.*

Refining Table Results

Results produced by your search queries can be further refined using two operations: Filter and Find. Filter operates against all results in a query but in only specified fields; Find operates against only the results on the current page of a table but all fields in the table. There are some other differences as well:

Filter

Filters act against all results, reducing the total number of relevant records for your search query. The available filter fields varies depending upon the object type you are working with.  Filters open in a panel when the icon is clicked.

Since Filters act against all results of your query, they represent a coarse method for reducing what can be very large data sets and making them more practical to analyze. Filters are also a good first step for refining your search results (Find is often a better second step).

Things to know about Filters:

• Best results can be obtained by using strings without blank spaces

• Strings you filter on assume a leading and trailing wildcard. So for example, filtering on tre will be equivalent to filtering on *tre*

• Filters make a round-trip request to HYAS servers and return the refined results to your browser

Find

Find acts against only the results on the current page of a table. Find is located above the table in the “Find in Table” input field.

Since Find only works on the current page of the table, it a good secondary way of refining your search results once Filters have been used. Find acts against all visible columns of a table and refines the table contents as you type. So it is multi-field and single-page, and is faster and easier to do iterative refinements once you are on a page of the table that particularly interests you.

Note: Find will only refine table data for columns that are visible. If you have columns hidden, Find will not match against content in those columns.