The Censys Platform in 766 Words

Censys conducts comprehensive, frequent scanning of the global internet. The data retrieved from these scans composes the Censys Internet Map, a near-real-time representation of publicly accessible assets. This map takes the form of a structured dataset that is presented in the Censys Platform.

Information from Censys scanners and third-party context providers is used to identify software, hardware, vulnerabilities, and threats that are present on assets, describe their geographic location, and much more.

Censys only scans to retrieve information. Censys never tries to log into any service, read any database, or otherwise exploit or gain access to any system.

Security practitioners and researchers use the Platform to perform general surveys of the global internet, triage and investigate their alerts, track their adversaries, and monitor or find their organization's exposed assets.

In the Platform, an asset can be one of four general types:

• Host: An IPv4 or IPv6 address and its services.
• Web property: Websites, web services, and web applications that respond to hostname-based scans. Identified by a hostname and a port. Hostnames can be name-based records (such as app.censys.io) or IP-based records (such as 104.18.10.85).
• Certificate: Digital documents that verify the identities of services that are communicating with each other. In the Platform, certificates are indexed and identified by the SHA-256 digest of the entire raw certificate.
• Fully-qualified domain name (FQDN): The records and information for a specific name within the Domain Name System (DNS) tree, like censys.com or docs.censys.com.

You can retrieve Censys data for an individual asset by directly looking it up in the Platform UI or API. To look up a host in the UI, for example, you can enter its IP in the search bar. To look up a name, enter it in the search bar and click the link to view its details.

You can also find assets by running full-text searches and writing queries in the Censys Query Language (CenQL). You can combine full-text searches with CenQL queries.

A full-text search looks across entire asset records for a value, such as "example.com". It matches any record that contains the search term in any field.

CenQL queries target field-value pairs, like host.location.city="Ann Arbor". A complete list of data fields available for host, web property, and certificate records in the Platform is available on the in-app data definitions page. There are several different field-value pair operators, like = for exact matches, : for records that contain the indicated value or values, and =~ for regular expressions, that you can incorporate into your queries. You can also use boolean operators like and, or, and not to combine and modify your query criteria.

In the UI, your search results are shown in a paginated list. Fields and services on assets that match your search criteria are highlighted on asset preview cards.

In the UI, you can use the interactive map and filters in the left sidebar to refine your search results. When you add filters, note how they modify your original query to help you build a better understanding of CenQL.

Everything that you can do in the Platform UI can also be executed via the API. Learn more about the Platform API here.

The data you have access to in Censys varies based on your license tier and the additional modules you or your organization have purchased. Higher tiers have the ability to view and search across more data, like deeper software component information, vulnerability data, threat fingerprints, industrial control system (ICS) protocols, and more.

If you have grasped the basics of the Censys Platform, set up a collection to monitor search query results, incorporate regex into a query, or set up an integration to bring Censys intelligence into your tech stack.