Search syntax examples

When working with Dark web or Surface web data, you should typically run a custom search based on keywords. These include your company, brand, product name, or unique strings related to your organization.

For the Dark web posts, social media publications, and other hidden publications, Kaspersky Threat Intelligence Portal supports simple Elasticsearch queries.

The following search operators can be used:

• Conditional union operator AND: +

  Example: keyword1 + keyword2 — returns messages containing both keyword1 and keyword2.

• Exclusive operator: -

  Example: -keyword1 — returns messages that do not contain keyword1.

• Space between two keywords (or symbol | ) is equivalent for logical disjunction operator OR

  Example: keyword1 keyword2 / keyword1 | keyword2 — returns messages containing keyword1 or keyword2.

• Double quotes are used to search for a phrase consisting of two or more words: ""

  Example: "keyword1 keyword2".

• Asterisk symbol (*) for any sequence of characters

  Example: keyw* — returns all messages that begin with keyw: keyword1, keyword2, keywhat, etc.

• Asterisk symbol (*) to filter results by source

  Example: darknet_site.com* — returns all publications found on the darknet_site.com web site.

  Do not use schemes (HTTP or HTTPS) or slash character (/) to perform the search.

• Round brackets () to group performed operations

  Example: (keyword1 | keyword2) + YYYY* — returns messages for the specified year (YYYY) that contain keyword1 or keyword2.

• The ~N operator after a word, where N is an integer specifying the allowed edit distance for matching (Levenshtein edit distance)

  Example: keyword~2 — returns messages which allow two edits to make the keyword.

• The ~N operator after a phrase, where N is the maximum number of positions allowed between matching tokens

  Example: "keyword1 keyword2"~2 — returns messages which allow two changes in word sequence to make the "keyword1 keyword2" phrase.

• Backslash (\) before a control character to escape it and interpret literally as a regular character

  Example: \" + keyw* — Returns messages containing " (double quotes) and keyword1, keyword2, keywhat, etc.

• Combined search using multiple criteria

  Example: "Kaspersky Lab" + -keys + 202112* — returns messages that contain the phrase "Kaspersky Lab" and do not contain the word "keys", posted in December, 2021.

More information on syntax and working with search operators is available at: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-simple-query-string-query.html#simple-query-string-syntax.

Page top