Welcome back to our Unleash the Power of Censys Search blog series, which helps Censys Search users make the most of our leading internet intelligence. In our previous posts, we talked about Censys Search use cases, writing queries, and the value of historical data.
In today’s post, we focus on a Censys Search capability that can help you and your team work more efficiently to get the results you’re looking for, faster.
Matched services highlight the specific service(s) that match a Censys Search query, which enables users to quickly analyze hosts, empowers users with clear insights, and significantly saves time in threat hunting investigations.
Matched services are available in upgraded Censys Search packages, which include Censys Search Solo and Censys Search Teams. These packages are ideal for users ready to move beyond the core features of our Censys Search Community version.
Let’s get into how matched services work, and how they can amplify your Censys Search experience!
Using Matched Services to Highlight Relevant Host Services
Matched services provide users with a more specific subset of query results. When users perform a query on a host with multiple services, matched services highlight exactly which services on the host meet the search criteria. This is especially useful when dealing with hosts that offer numerous services, as it helps users quickly pinpoint the relevant ones without manually sifting through all the services a host may run.
Matched Services in Practice: Basic Use Case
When searching for services, users can highlight all matched services running across multiple ports. Let’s take a look at a Censys Search query that asks for all Russian hosts with both RDP and FTP services.
Results page for the query: location.country: “Russia” and services.service_name: {RDP, FTP}
Our query returns many different hosts, the first of which is shown above. We can see that though Censys Search provides a preview of all 20+ services across different ports on this host, only the services listed under “Matched Services” meet our query’s specific criteria for RDP and FTP.
Without matched services, a user would need to comb through all 20+ service previews to identify the four RDP and FTP services.
Matched Services in Practice: Advanced Use Case
We know that a host can have multiple HTTP services, all running on different ports. When each of these services is scanned, each HTTP service returns a response, which can be unique or the same. The Censys query language allows users to search across each of those responses.
Matched services can save users significant time investigating each of those responses by identifying which HTTP service running on a host matches the query. So, if a user is concerned about vulnerabilities in HTTP services, matched services will directly show which of the host’s services matched the HTTP-related search terms.
In the example below, we’re looking for a host with an HTML title that includes “Bitcoin” and more than 10 services running on it.
Results page for the query: services.http.response.html_title: Bitcoin and service_count: [10 to *].
Rather than clicking into the 82 other services, all of which are on the same HTTP service, users only need to investigate the two Matched Services.
This kind of precise matching is crucial for cybersecurity professionals who need to identify and address specific vulnerabilities or compliance issues efficiently. It streamlines the process of threat detection by eliminating guesswork and reducing the time to insight.
Unlocking More Value with Upgraded Access
When it comes to cybersecurity, we know that speed and efficiency are paramount. Matched Services give practitioners and their teams a powerful ability to work more swiftly and strategically, eliminating cumbersome guesswork and manual effort.
This enhanced capability is just one example of additional value users can unlock with upgraded access to Censys Search. Users who upgrade from the free Community version of Censys Search to a paid package can further accelerate their investigations with more queries, more page results, full API access, faster API calls, tags and comments, and enhanced customer support, among other benefits.
A Note to Our Community Users
As referenced above, we recently introduced two new Censys Search packages with features and pricing to serve smaller security teams and individuals: Censys Search Teams and Censys Search Solo. These new packages are in response to feedback we’ve received from Censys Search users, who shared they could benefit from low-cost packages that offer more functionality than our Censys Search Community version.
With the addition of these upgraded self-serve options, we will be making some changes to the Community version of Censys Search. Namely, we will be discontinuing API access beyond 60 days. This will apply to both new Community Users and current Community Users. This means that Community Users who created their Censys Search Community accounts on or before December 6, 2023 – the date our new packages were launched – will no longer have API access after February 5, 2024.
Any Community User who created a Community account after December 6, 2023 will have API access for 60 days after their specific date of enrollment.
We appreciate your understanding and cooperation as we strive to maintain a high standard of service! Our commitment remains strong in providing you with a reliable platform, and we believe these changes will contribute to a better overall experience to our entire community.
To learn more about our new packages and to upgrade your account, please visit our pricing page.
Upgrade My Access
