Software

Legacy Search datasets use the Common Platform Enumeration (CPE) format and the Hershel+ library to categorize software, hardware, and operating systems of hosts and the services running on them. A complete list of host data fields and information, including software data, is available in the in-app data definitions page.

Search for software

If you have a CPE-formatted URI, paste it as the value for services.software.uniform_resource_identifier in the query bar.

📘

Tip

Wrap your identifier string in backticks (`) to escape all the reserved characters.

If you don’t have a CPE-formatted URI, search other software fields with more friendly (but still CPE-informed) names and values, like:

• services.software.vendor: Search for values like apple or microsoft.
• services.software.product: Search for values like windows or apache.
• services.software.version: Search for things like 8.0. Combine this with a value for the product field used nested fields.

Or look up the CPE URI in the dictionary provided by the National Vulnerabilities Database.

If you have a Hershel+ fingerprint, paste the ID as a value for services.transport_fingerprint.id in the query bar.

Software fields in host records

Software information is recorded in three places in a host record:

• Host operating system (operating_system): Censys' best estimate of the host’s operating system.
• Service software (services.software): The software reported at OSI Layer 7 when connecting to a service on a host.
• Transport fingerprint (services.transport_fingerprint): The software detected at OSI Layer 4 when connecting to a service on a host.

Host operating system fields

The Censys best estimate of a host’s operating system is stored at the root level of the host entity in a record called operating_system.

Each field in the record is defined in the host operating system with its value type.

This record can be populated from a few software identification methods that Censys employs at different networking layers.

An operating system detected at OSI Layer 7 is preferred over an OSI Layer 4 detection, and the most specific version information is preferred.

Service software (L7)

Censys considers software and OS reporting on OSI Layer 7 to be the most reliable. Multiple software products, hardware, and operating systems can be detected, so this information is stored in an array called software with other general service information.

Each field in a software record is defined in service software with its value type.

Transport fingerprint (L4)

Censys uses the Hershel+ algorithm for fingerprinting operating systems at the transport layer (OSI Layer 4). This information, if obtained, is found in service records under the name services.transport_fingerprint.

Each field in the record is defined in the miscellaneous service info with its value type.

Censys retains raw observations with no matching fingerprint in the services.transport_fingerprint.raw for searching. The services.transport_fingerprint.id field for an unknown fingerprint is not present in this case.