---
updatedAt: 2026-09-29T13:05:20.000Z
agentTools:
  projectIndex: https://docs.censys.com/llms.txt
---

# CensEye

CensEye helps you identify assets on the internet that share a specific key-value pair with the asset you are currently viewing. It extracts data values then shows how many other assets present the same value. This allows you to pivot into related infrastructure and begin building queries based on shared characteristics. CensEye can also be <Anchor target="_blank" href="https://docs.censys.com/reference/v3-threathunting-value-counts#/">executed via API</Anchor>.

CensEye saves you time during investigations and supports the creation of queries or fingerprints to identify activity linked to specific methods, indicators, or threat actors—even those that may not have been fingerprinted or categorized already.

Once you identify related assets, you can group and monitor them using [collections](https://docs.censys.com/docs/platform-collections#/). Collections enable you to track threat-related infrastructure over time. Use [webhooks](https://docs.censys.com/docs/platform-collections-webhooks#/) with collections to receive alerts about new assets affiliated with a threat in near-real-time.

<Callout icon="📘" theme="info">
  ### Note

  Read <Anchor target="_blank" href="https://censys.com/blog/threathunting-with-censys-api">this detailed blog written</Anchor> by a Censys team member to learn about how to use CensEye for advanced threat hunting.
</Callout>

## Video walkthrough

<Embed title="" typeOfEmbed="youtube" url="https://www.youtube.com/watch?v=Ugl5JY2FVBU" href="https://www.youtube.com/watch?v=Ugl5JY2FVBU" html="%3Ciframe%20class%3D%22embedly-embed%22%20src%3D%22%2F%2Fcdn.embedly.com%2Fwidgets%2Fmedia.html%3Fsrc%3Dhttps%253A%252F%252Fwww.youtube.com%252Fembed%252FUgl5JY2FVBU%253Ffeature%253Doembed%26display_name%3DYouTube%26url%3Dhttps%253A%252F%252Fwww.youtube.com%252Fwatch%253Fv%253DUgl5JY2FVBU%26image%3Dhttps%253A%252F%252Fi.ytimg.com%252Fvi%252FUgl5JY2FVBU%252Fhqdefault.jpg%26type%3Dtext%252Fhtml%26schema%3Dyoutube%22%20width%3D%22854%22%20height%3D%22480%22%20scrolling%3D%22no%22%20title%3D%22YouTube%20embed%22%20frameborder%3D%220%22%20allow%3D%22autoplay%3B%20fullscreen%3B%20encrypted-media%3B%20picture-in-picture%3B%22%20allowfullscreen%3D%22true%22%3E%3C%2Fiframe%3E" providerName="YouTube" providerUrl="https://www.youtube.com/" />

## Use CensEye in the Platform web UI

To use CensEye:

1. In the Platform web console, go to an asset.
2. Click the **Discover Pivots** tab.

<Image src="https://files.readme.io/87ae111939c758ee2594d62b6598fbba6e42e087d7a9019c56e5a6fcb1933a4c-pivot.png" align="center" border={true} />

3. Click **Run CensEye**.
4. Review the extracted key-value pairs.

   CensEye identifies key-value pairs that the asset shares with other data records. In the screenshot below, the number to the left shows how many internet-facing assets share the same attribute for the indicated field-value pair.

   This data can be used to pivot from one asset to a broader set of related infrastructure that share the same attribute. You can track patterns across assets with similar characteristics and investigate the assets to determine shared usage or intent.

<Image src="https://files.readme.io/53144e0988afcd828eed9bfdf834cb066d51554ac9b7c96dbfca51d0ccc25d98-pivot_return.png" align="center" width="950px" border={true} />

5. Click 🔍 to the right of the key-value pair to execute a search. Using the example above, a search is executed the `host.services.endpoints.http.body_hash_sha256` field-value pair.
6. The search returned 48 assets. Filter the data to isolate the most relevant infrastructure. In the left-hand navigation, the **Threats** filter shows that 3 of these assets are associated with Viper malware. At this point, you might look for other outliers such as unusual port numbers.

<Image src="https://files.readme.io/79d47c2c84e2688c6562b36f4f7a3bab5a6bccf93a7ea669c5bc2ca7364d58b3-viper.png" align="center" border={true} />

<Callout icon="📘" theme="info">
  ### Note

  When you use CensEye on a historical host record, the key-value pairs are obtained from the historical appearance of that host and compared against current data.
</Callout>

## View historical CensEye runs

You can see previous CensEye runs against web assets executed by members of your organization by clicking the run count dropdown within the **Discover Pivots** tab. Each historical run lists its timestamp and the number of interesting pivots discovered. Click the entry for a historical run to see the full list of results.

<Image src="https://files.readme.io/d1d68d46f4b07d2e8708e0b0e3a3ee3c55b6acad831710c0446b1ac0b7af9b9e-historical_new.png" align="center" border={true} />

## Default pivot fields

CensEye searches across the following fields for assets with matching values. To define specific fields to target with CensEye, use the <Anchor target="_blank" href="https://docs.censys.com/reference/v3-threathunting-value-counts#/">value counts API endpoint</Anchor>.

<Accordion title="Host fields" icon="fa-info-circle">
  Banner information

  * `host.services.banner_hex`
  * `host.services.banner_hash_sha256`

  Certificate information

  * `host.services.cert.fingerprint_sha256`
  * `host.services.cert.parsed.subject_dn`
  * `host.services.cert.parsed.subject.common_name`
  * `host.services.cert.parsed.subject.organization`
  * `host.services.cert.parsed.subject.organizational_unit`
  * `host.services.cert.parsed.issuer_dn`
  * `host.services.cert.parsed.issuer.common_name`
  * `host.services.cert.parsed.issuer.locality`
  * `host.services.cert.parsed.ja4x`

  TLS hashes

  * `host.services.jarm.fingerprint`
  * `host.services.tls.ja4s`
  * `host.services.tls.ja3s`

  HTTP

  * `host.services.endpoints.banner_hash_sha256`
  * `host.services.endpoints.http.headers`
  * `host.services.endpoints.http.html_title`
  * `host.services.endpoints.http.body_hash_sha256`
  * `host.services.endpoints.http.favicons.hash_sha256`
  * `host.services.endpoints.http.favicons.name`

  SSH

  * `host.services.ssh.endpoint_id.raw`
  * `host.services.ssh.server_host_key.fingerprint_sha256`

  Cobalt Strike

  * `host.services.endpoints.cobalt_strike.x64.http_post.uri`
  * `host.services.endpoints.cobalt_strike.x64.public_key`
  * `host.services.endpoints.cobalt_strike.x64.user_agent`
  * `host.services.endpoints.cobalt_strike.x64.watermark`
  * `host.services.endpoints.cobalt_strike.x86.http_post.uri`
  * `host.services.endpoints.cobalt_strike.x86.public_key`
  * `host.services.endpoints.cobalt_strike.x86.user_agent`
  * `host.services.endpoints.cobalt_strike.x86.watermark`

  Other endpoints

  * `host.services.endpoints.kubernetes.nodes.name`
  * `host.services.endpoints.scada_view.title`

  Other protocols

  * `host.services.cwmp.server`
  * `host.services.pc_anywhere.name`
  * `host.services.pptp.hostname`
  * `host.services.smb.group_name`
  * `host.services.winrm.ntlm_info.netbios_computer_name`
  * `host.services.redline.settings_response`
  * `host.services.mssql.instance_name`
  * `host.services.vnc.desktop_name`
  * `host.services.s7.plant_id`
  * `host.services.bacnet.object_name`
  * `host.services.dhcpdiscover.params.device_info.machine_name`
  * `host.services.snmp.oid_system.name`
</Accordion>

<Accordion title="Web property fields" icon="fa-info-circle">
  Certificate information

  * `web.cert.fingerprint_sha256`
  * `web.cert.parsed.subject_dn`
  * `web.cert.parsed.subject.common_name`
  * `web.cert.parsed.subject.organization`
  * `web.cert.parsed.subject.organizational_unit`
  * `web.cert.parsed.issuer_dn`
  * `web.cert.parsed.issuer.common_name`
  * `web.cert.parsed.issuer.locality`
  * `web.cert.parsed.ja4x`

  HTTP

  * `web.endpoints.banner_hash_sha256`
  * `web.endpoints.http.body_hash_sha256`
  * `web.endpoints.http.favicons.hash_sha256`
  * `web.endpoints.http.favicons.name`
  * `web.endpoints.http.headers`
  * `web.endpoints.http.html_title`

  TLS hashes

  * `web.jarm.fingerprint`
  * `web.tls.ja4s`
  * `web.tls.ja3s`

  Cobalt Strike

  * `web.endpoints.cobalt_strike.x64.http_post.uri`
  * `web.endpoints.cobalt_strike.x64.public_key`
  * `web.endpoints.cobalt_strike.x64.user_agent`
  * `web.endpoints.cobalt_strike.x64.watermark`
  * `web.endpoints.cobalt_strike.x86.http_post.uri`
  * `web.endpoints.cobalt_strike.x86.public_key`
  * `web.endpoints.cobalt_strike.x86.user_agent`
  * `web.endpoints.cobalt_strike.x86.watermark`

  Other endpoints

  * `web.endpoints.kubernetes.nodes.name`
  * `web.endpoints.scada_view.title`
</Accordion>

<Accordion title="Certificate fields" icon="fa-info-circle">
  Subject

  * `cert.parsed.subject_dn`
  * `cert.parsed.subject.organization`
  * `cert.parsed.subject.organizational_unit`

  Issuer

  * `cert.parsed.issuer_dn`
  * `cert.parsed.issuer.common_name`
  * `cert.parsed.issuer.locality`

  Other

  * `cert.parsed.ja4x`
</Accordion>

## CensEye API endpoints

Use the following API endpoints to programmatically run CensEye actions. Note that the create pivot analysis job and get value counts endpoints have variable credit costs.

| API endpoint and link                                                                                                                            | Description                                                                                                                                                                                                                                                                                                                                                                                                 |
| :----------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <Anchor target="_blank" href="https://docs.censys.com/reference/v3-threathunting-censeye-jobs-create">Create a pivot analysis job</Anchor>       | Create an asynchronous CensEye pivot analysis job for a host, web property, or certificate. The job extracts default pivot fields from the target asset and counts matching documents for each field-value pair. Poll the job status endpoint to track progress, then retrieve results when complete. Credit cost varies based on the asset: 44 for a host, 28 for a web property, seven for a certificate. |
| <Anchor target="_blank" href="https://docs.censys.com/reference/v3-threathunting-censeye-job-results">Get job results</Anchor>                   | Retrieve the results of a completed CensEye pivot analysis job. Each result contains a count and the field-value pairs that were analyzed. Results may be empty if the job is still running.                                                                                                                                                                                                                |
| <Anchor target="_blank" href="https://docs.censys.com/reference/v3-threathunting-censeye-jobs-get">Get job status</Anchor>                       | Retrieve the current status of a CensEye pivot analysis job. Use this to poll for completion before fetching results.                                                                                                                                                                                                                                                                                       |
| <Anchor target="_blank" href="https://docs.censys.com/reference/v3-threathunting-value-counts">Retrieve value counts to discover pivots</Anchor> | Get counts of web assets for specific field-value pairs and combinations of field-value pairs. This endpoint allows you to define specific fields of interest rather than the default fields leveraged by the tool in the UI. Costs one credit per count condition (array of objects)                                                                                                                       |

## Additional resources

The Censys team maintains the <Anchor target="_blank" href="https://github.com/censys-research/censeye-ng">Censeye-NG tool</Anchor> for advanced configuration options and threat hunting.