$ and are used like any other query in the searchbar, API, reports and alerts. They can sometimes be combined with regular Query Syntax. You cannot do join-like statements in the ShadowTrackr query language, but if you need one just contact support and we'll fix it with a magic query for you.| Query | What it does | Extra keywords |
|---|---|---|
Query: $remote_login_services_report | What it does: Show on overview of all remote login services (like citrix, SSH and remote desktop) found for your assets | Extra keywords: last_seen, tags |
Query: $mailservers_report | What it does: An overview of your mailservers and their SPF/DKIM/DMARC settings | Extra keywords: last_seen, tags |
Query: $shared_hosting_report | What it does: Show which of your assets are using shared hosting, and where the hosts are | Extra keywords: last_seen, tags |
Query: $dns_dependency_report | What it does: Show which of your domains are using which nameservers | Extra keywords: last_seen |
Query: $non_webserver_hosts_report | What it does: Show hosts that have ports open other than 80 and 443 | Extra keywords: last_seen, tags |
Query: $rare_ports_report | What it does: Shows hosts that have uncommon ports open | Extra keywords: last_seen, tags |
Query: $isp_report | What it does: Provides an overview of all your hosts grouped by ISP | Extra keywords: regions, ips, last_seen |
Query: $exposed_email_addresses_report | What it does: Shows all email addresses, where they where discovered, and what breaches they are in | Extra keywords: |
Query: $phishy_domains_report | What it does: Shows domains that look like yours and can be used to phish, with a phishyness score and details | Extra keywords: last_seen, tags |
Query: $software_overview_report | What it does: Shows an overview of all software (with and without versions) found on your assets, with the number of assets (num_assets) and the assets themselves (assets) per software | Extra keywords: last_seen, tags, url, software |
Query: $cisa_vulnerabilities_report | What it does: Shows vulnerabilities found on your assets that are in the CISA Common Vulnerabilities and Exposures (CVE) database | Extra keywords: last_seen, tags, url, software |
Query: $exploited_vulnerabilities_report | What it does: Shows vulnerabilities found on your assets that are known to be exploited | Extra keywords: last_seen, tags, url, software |
Query: $ncsc_vulnerabilities_report | What it does: Shows NCSC advisories that affect your assets, grouped per advisory number, with the NCSC impact and chance ratings, the publication date, the affected software and assets, and a link to the advisory | Extra keywords: last_seen, tags, url, ip, ncsc_number, software |
Query: $new_vulnerabilities | What it does: Shows the vulnerabilities that appeared on your assets recently, one row per asset and CVE, with the CVSS score, asset, hostname and ASN, software, CISA and NCSC status. By default CVSS 7 or higher, first seen in the last 24 hours; change that with cvss_score>=9 or first_seen>-7d. Made to be used as an alert | Extra keywords: first_seen, url, ip, asn_name, organization, cvss_severity, cisa_date_added, ncsc_link, software |
Query: $software_vulnerabilities_report | What it does: Shows all vulnerabilities found on your assets | Extra keywords: last_seen, tags, url, software |
Query: $stale_dns_records_report | What it does: Show DNS A and AAAA records that don't have a website or host associated with them | Extra keywords: last_seen, tags |
Query: $subdomain_takeover_report | What it does: Shows URLs that point to a server that is not set up for them: possible subdomain takeovers, where someone else's live website answers for your name, and stale DNS records, where only a registrar, for-sale or hosting default page does | Extra keywords: last_seen, tags |
Query: $cloudprovider_report | What it does: Shows all cloud providers found for your assets | Extra keywords: last_seen, tags |
Query: $domains_report | What it does: An overview your domains, the number of mailservers per domain, and DNSSEC and SPF settings | Extra keywords: last_seen, tags |
Query: $ncsc_tls_report | What it does: Grades every scanned certificate against the NCSC-NL TLS guidelines (ICT-beveiligingsrichtlijnen voor Transport Layer Security), on the guideline's own four levels: good, sufficient, to be phased out, and insufficient | Extra keywords: last_seen, tags, ip |
Query: $post_quantum_cryptography_report | What it does: Shows for each of your servers whether its encryption is quantum-safe, so traffic recorded today cannot be decrypted later by quantum computers. Checks web encryption (TLS) and remote login (SSH), with an overall score from A+ to F | Extra keywords: last_seen, tags |
Query: $internet_standards_report | What it does: The results of the Modern Internet Standards test (like internet.nl) for all your domains | Extra keywords: last_seen, tags |
Query: $blacklisted_assets_report | What it does: Overview of your assets listed on public blacklists | Extra keywords: last_seen |
Query: $websites_security_report | What it does: Shows Observatory security scores and details for all your websites | Extra keywords: last_seen, tags |
Query: $hosts_without_dns | What it does: Shows a list of hosts that don't have a DNS record associated with them | Extra keywords: last_seen |
Query: $urls_hosts_asns | What it does: Shows a list of URLs and the IP addresses and ASNs for them (a join you cannot make with the query language) | Extra keywords: last_seen |
Query: $weekly_pdf_report | What it does: The weekly PDF report send by email | Extra keywords: tags |
Query: $supplier_dependency_report | What it does: A report showing your dependencies per supplier, including a worldmap with assets per country. For each suppler you can see if it's fully Eurpopean, a subsidary or a Non-European company. | Extra keywords: country, control, city, last_seen |
production, you would write:$weekly_pdf_report AND tags=production
$weekly_pdf_report AND (tags=production OR tags=staging)
$remote_login_services last_seen>-7d
$software_vulnerabilities_report last_seen>-7d url=shadowtrackr.com
$software_overview_report, $software_vulnerabilities_report, $exploited_vulnerabilities_report, $cisa_vulnerabilities_report, $ncsc_vulnerabilities_report and $new_vulnerabilities) can be limited to one piece of software. The name is matched against the software name shown in the report, so there is no need to know in which order vendor, product and version are listed.$software_overview_report software=php* last_seen>-7d
software=php matches PHP and PHP 8.2, but not PHP-FPM. Use * as a wildcard to match more, for example software=php* for everything that starts with PHP. Put quotes around a name that contains a space:$software_vulnerabilities_report software="apache http*"
url, ip and tags.$software_overview_report has one row per software. Besides the software name and the vulnerabilities it shows two asset columns:num_assets: how many assets run it. A host counts once per ip, self-hosted websites count once per ip, and websites on a cloud provider count once per provider.assets: the assets themselves, sorted by name and linked to their host, website or certificate page. Every distinct url or ip is listed, so a software can list more names than num_assets when several urls share an ip or a cloud provider.assets is the same list of names. Both columns can be picked in a table, for example:$software_overview_report software=php* | table software, num_assets, assets
category column (for example Programming Languages) is hidden by default. Ask for it when you want it:$software_overview_report | table software, num_assets, assets, category, vulnerabilities
assets held the count in this report. If you have saved reports or API integrations that read it, switch them to num_assets.