Search

Search is the fastest way to find anything in your workspace. A global search box in the console top bar lets you query across all indexed workspace data — assets, targets, vulnerabilities, services, and technologies — without navigating between pages. The dedicated Search page shows both your results and your recent search history. Because search covers data types that live in different modules, it is the recommended entry point when you know what you are looking for but not where it lives: a hostname, an IP address, a technology name, or a vulnerability keyword all resolve from the same box.

​

Key concepts

​

Where search lives

Search is available in two places, both backed by the same search index:

• Global search box — in the console top bar, visible on every page. Designed for quick lookup: type, review results, click through.
• Search page — the dedicated page for investigation: shows results and recent search history side by side.

Both surfaces search the same data, so you get the same matches regardless of entry point.

​

Searchable data

Search runs across the indexed data of your workspace. What is searchable depends on what is currently available:

• Assets — hosts, IP addresses, service names
• Targets — target names and associated metadata
• Vulnerabilities — finding names, details, and affected URLs
• Services — host + port combinations
• Technologies — detected technology names (for example, Cloudflare, Nginx)

A single query is matched against everything, so one search can return several categories of results at once.

​

Search history

Completed searches are recorded automatically. The Search page renders this history so you can repeat previous queries without retyping them.

​

Example query patterns

The table is guidance, not a contract — a single term can legitimately match multiple categories, and the results are grouped so you can see which parts of the attack surface matched.

​

Search from the console

When should I use the Search page instead of the top-bar box?

The top-bar box is for quick lookup — type, scan results, click. The Search page is for repeatable investigation: it keeps your history visible, so recurring queries (for example, a hostname you check daily) can be rerun in one click. For structured filtering, use the filter views on the Assets page instead, which support filter buttons and multiple view modes that a free-text query cannot express.

What if a search returns no results?

First, widen the term — try a partial hostname or a shorter technology name. Second, check the workspace scope: search only covers the workspace you are currently switched into, so the data may live in another tenant. Third, consider that the term may simply not match an indexed category; fall back to the Assets filter views (IP, Port, Technology, Status Code, Host, TLS Host) to find the item structurally instead of by text.

​

Search history behavior

Search history exists to make investigations repeatable:

• Searches are recorded per workspace automatically.
• The Search page renders the history next to fresh results, so you always see the last context and the current state together.
• Clicking a past query reruns it, which is faster than retyping the term.
• History is workspace-scoped — switching workspaces shows that workspace’s history, never another tenant’s.

​

Filtering assets instead of searching

Free-text search finds matches quickly, but structured analysis is better served by the Assets page. It offers filter buttons for:

• IP
• Port
• Technology
• Status Code
• Host
• TLS Host
• Date

and view modes that regroup the same data for different analysis angles:

• Services
• Hosts
• Ports
• IP Addresses
• Technologies
• Status Code
• TLS
• Graph

Use filters when you need precise conditions (all assets on port 443, all hosts with a failing TLS certificate); use search when you want a single term to match across everything. See the Assets documentation for details. Everything available in the console is also available through the API — see the API Reference tab.

​

Combine search with other modules

Search is strongest when combined with the rest of the console:

• Dashboard → search — the Dashboard surfaces anomalies (new hosts, unexpected ports, rising vulnerability counts); search resolves them to specific items.
• Notifications → search — a notification that a new vulnerability was found or a new asset was detected names the event; search finds everything else tied to the same asset or host.
• Search → Assets filters — use search for the first match, then pivot to the Assets filter views for the structured list around it.
• Search → Vulnerabilities — a keyword that matches a finding leads to the Vulnerabilities page for severity and status context.

​

Best practices

• Search first, navigate later — a single query across everything is usually faster than checking Assets, Targets, and Vulnerabilities separately.
• Use the Search page for queries you run regularly; the history list saves you from retyping them.
• Move to the Assets filter views when you need structured conditions (a port, a status code, a TLS host) that free-text search cannot express.
• Treat search results as a triage entry point: finding a host or service quickly is the first step, but follow up with the detail page for context such as technologies, TLS status, and attached vulnerabilities.
• Remember search scope — you only search the workspace you are currently switched into.
• Pair search with the Dashboard: use the dashboard to spot anomalies, then search for the exact host, port, or technology behind them.
• When investigating an event from Notifications, search the affected asset name to pull up its full profile in one query.

​

Related