Track and Monitor Collections

After a collection is created, you can track its results, monitor trends, and review added or removed assets. Use the search functionality to explore assets across multiple collections. The Collection Report Builder allows you to group and count unique values within a field in your collection. This helps you understand how often each unique value appears, making it easier to analyze and summarize data.

View All Collections

The All Collections page displays collections you created or that have been shared with you.

View Collection Results

The Results tab displays a collection's active results (i.e., the assets that match the query.)

📘

Note

Exploring the data returned by your query may result in credit consumption, depending on the actions performed. For more information, see Credit Costs for Collections .

1. Go to Collections.
2. Click a Collection Overview Card.
3. Click the Results tab.

View Collection History

The Collection Timeline tab records the log of the Asset-Added and Asset-Removed events. Use this page to identify new assets added to a collection that may require further investigation.

📘

Note

Collection history is available for 6 months.

1. Go to Collections.

2. Click a Collection Overview Card.

3. Click the History tab.

4. Click Filter to select a specific event type or status. The Collection timeline records status events to display details about whether a collection is paused or populating.

   

5. Use the Date Filters to isolate events within specific date ranges.

6. Click the asset ID to view the historical representation of a host at the time of the event, or to view the current representation of the certificate or web property.

Search within a Collection

You can use the Search field at the top of the page to query assets in a collection using Censys Query Language (CenQL) syntax. Querying across assets in a collection will consume credits. To learn more, see Credit Costs for Collections.

👍

Tip

Consider a scenario where you create a collection to monitor a netblock within your organization. To determine whether any hosts in that netblock are running a specific software, You can search within the collection to return hosts in that netblock that have a specific CPE fingerprint.

1. Go to Collections.
2. Click a Collection Overview Card.
3. From the query bar, enter a query and click Search.

   📘

   Note

   Within a collection, the query bar displays helper text to indicate you are searching across a collection result, not Global Search.

Monitor Collection assets

The Overview tab provides insights about the total number of assets added and removed, a sparkline that displays a 30-day trend of the maximum number of assets in a collection, and whether the collection is shared.

Overview tab

To access the Overview tab, go to Collections > select a Collection > Overview.

Collection Trends

Collection sparklines display a 30-day trend of the maximum number of assets in a collection, which is recorded once daily. Sparklines assist users in quickly identifying significant fluctuations in collection size. For example, a sudden spike in activity may indicate a need for further investigation, such as a new deployment, a misconfiguration, or potentially malicious activity. A gradual decrease could indicate that a service is being phased out or that vulnerabilities are being patched.

Build Collection Reports

The Collection Report Builder allows you to group and count unique values for a field in your collection. Report Builders help you understand how many times each unique value appears, which is useful for analyzing and summarizing data.

👍

Tip

Consider a scenario where you need to identify open ports on hosts in your collection. You expect most assets in your collection to have similar open ports and want to validate this. Go to Report Builder, enter the host.services.port field, and the report checks all the hosts in your collection, groups them by port number. It displays unique ports and a count of services with that open port.

1. Go to Collections.
2. Click a Collection Overview Card.
3. Go to the Report tab.
4. Select a field you want to group by.
5. (Optional) Edit the number of buckets; this dictates the number of unique values displayed.
6. Click Generate Report.