Searching
Every table in Red Kite has a search bar that understands a simple query language. Filters are the most useful tool of the platform: they let you find the resources you care about, act on them in bulk, and define intel.
Start typing in the search bar and Red Kite will suggest the available filters and their values.
Syntax
A filter is a key:value pair. Several filters are separated by spaces.
project:"My project" port.service:ssh
- Different keys are combined with AND. The example above shows the SSH ports of the project My project.
- The same key repeated is combined with OR.
port:80 port:443shows the ports 80 or 443. - Quotes are needed when a value contains spaces:
project:"My project". - Wildcards (
*) can be used in text values:domain:*.example.commatches every subdomain ofexample.com, andhost:10.0.*matches the IPs starting with10.0.. - Text comparisons are case insensitive.
Excluding results
Prefix a filter with - to exclude what it matches. This is very useful to remove the noise and look at what is left.
-is:blocked -port:80 -port:443
This filter shows the ports that are not blocked and that are neither 80 nor 443, which is a quick way to find non-standard ports.
Resource filters
These filters are available on the resource pages (Domains, Hosts, Ports, Websites, IP Ranges). Not every filter applies to every resource type: the suggestions in the search bar only show the relevant ones.
| Filter | Example | Description |
|---|---|---|
project | project:"ACME Corp" | Resources of a project. |
domain | domain:*.example.com | Resources linked to a domain name. |
host | host:1.2.3.4 | Resources linked to a host IP. |
port | port:3389 | Resources linked to a port number. |
port.protocol | port.protocol:tcp | tcp or udp ports. |
port.service | port.service:ssh | Ports running a given service. |
port.product | port.product:openssh | Ports running a given product. |
port.version | port.version:8.9* | Ports running a given product version. |
ipRange | ipRange:10.0.0.0/8 | Resources in an IP range. |
tag | tag:Critical | Resources with a tag. |
confidence | confidence.gte:likely | Resources by confidence score. |
is | is:blocked, is:merged | Blocked resources, or merged websites. |
finding | finding.WafFinding:exists | Resources that have a given finding. |
finding.key.field | finding.MyFinding.myField:"value" | Resources whose finding field has a given value. |
The confidence filter accepts the values verified, likely, suspected and unlikely, with the operators confidence: (equal),
confidence.gte:, confidence.gt:, confidence.lte: and confidence.lt:. A number between 0 and 100 can also be used, for instance
confidence.gte:60.
On a resource's page, clicking the value of a finding's text field opens the resource list filtered with
finding.key.field:"value". It is an easy way to find all the other resources sharing that same value, for instance the same
technology or the same certificate issuer.
Default filters
The resource pages hide the blocked resources by default with the -is:blocked filter. The Websites page also hides merged websites
with -is:merged. Remove these filters to see everything, or use is:blocked to only see the blocked resources.
Intel filters
The Intel page supports its own filters:
| Filter | Example | Description |
|---|---|---|
is | is:open, is:closed | Open intel (open, validated, ready to retest, regression) or closed intel (resolved, false positive, risk accepted). |
status | status:regression | Intel with a given status. |
severity | severity:critical | Intel with a given severity: informational, low, medium, high or critical. |
project | project:"ACME Corp" | Intel of a project. |
intel | intel:"Exposed FTP server" | Records of a given intel definition. |
Date filters
The resource tables have a date picker at the top right. It filters the resources by their first seen date, which is the date at which Red Kite found them for the first time. It is the main tool to find what changed.
Resources found during the last seven days show a New! tag. Clicking it filters the table on the resources of the last week.
Acting on the results
Filters are not only for reading. Once a table is filtered:
- Select resources with the checkboxes, or select the whole page with the header checkbox.
- To go beyond the current page, click Select all N elements. The action will apply to every resource matching the filter, not only to the visible ones.
- Use the buttons at the top of the table to tag, block, verify ownership, delete or export the selection.
See Data enrichment for the details of each action.
Finding what changed
Your attack surface changes all the time: new subdomains are created, servers are moved, services are opened for a test and never closed. Regularly checking what is new is the best way to keep it under control.
Every resource has a first seen date: the date at which Red Kite found it for the first time.
On the resource pages (Domains, Hosts, Ports, Websites, IP Ranges), use the date picker at the top right of the table to only show the resources first seen during a period. For instance, select the last week to see everything that appeared since your last review.
Resources found during the last seven days also show a New! tag. Click it to filter the table on the resources of the last week.
The date filter can be combined with any other filter. Some useful combinations:
| What you are looking for | Page | Filter (with the date picker set) |
|---|---|---|
| New subdomains of your main domain | Domains | -is:blocked domain:*.example.com |
| New ports, excluding the HTTP(S) ones | Ports | -is:blocked -port:80 -port:443 |
| New ports on your verified hosts | Ports | -is:blocked confidence:verified |
| New websites | Websites | -is:blocked -is:merged |
What is new may require your attention: verify or block the new resources, as described in Data enrichment.