Hey Azim, I might need some additional info to help you more, but I think I can answer part of your question.

You can combine your queries into one using the OR operator. So for example if you’ve got two queries of interest like services.port: 22 and location.city: Austin and another query like services.service_name: FTP and location.city: Oakland you could get the results of both queries by combining them as follows:
(services.port: 22 and location.city: Austin) or (services.service_name: FTP and location.city: Oakland).

For getting results into a CSV, you could use the pandas standard Python library.

Hope this helps.

Hi ​@MattK_Censys ,
Thanks for your reply. I understood the boolean logic (AND, OR, NOT) to make a combine query.

I’m a newbie in Censys and still learning.  I need that information from seed data or asset inventory. Information is needed in CSV:
IP address, FQDN, Acquisition (scan) date, Open port, Services / Software, Service / Software version, Vulnerability, EOL, SSL protocol in use, Compromised Cipher Suites, Incomplete Certificate, HTTP CSP header, HTTP CC header, HTTP XCTO header, HTTP STS header, IP location.
 

I built one query, but it is not working. Can you please check what will be the correct form?

(host.ip:"1.1.1.1" OR parsed.names:"example.com") AND (
services.port:* OR
services.software:* OR
services.software.version:* OR
services.software.eol:* OR
services.vulnerabilities:* OR
services.tls.version:* OR
services.tls.cipher_suites:* OR
services.tls.certificates:* OR
services.http.response.headers.content_security_policy:* OR
services.http.response.headers.cache_control:* OR
services.http.response.headers.x_content_type_options:* OR
services.http.response.headers.strict_transport_security:* OR
location.country_code:*
)

Also, I need HTTP security information as well. And IP will be more than 15. How can we mention all IP or need another file list to share? How can do that with csv output.

I appreciate your prompt support in this matter.

Hey Azim, I was unable to locate many of those fields in our data schema for Search or ASM. I recommend going through those documents to find the name fields you’re looking to target.

It also looks like you are attempting to combine fields from the ASM data schema (host.ip) with those from Search. Are you attempting to run this in Search or ASM? The data fields are different between the two products.

Yes, I’m trying in ASM. I checked the ASM documentation and created based on this, but it is not working. That’s why I seek help to see where I can improve.

Hi again Azim, to start you’ll need to replace the incorrect fields with correct ones. The ASM UI will inform you of which fields are invalid, so I recommend going one by one to identify problematic fields and reference the asset schema doc as well as the auto-complete field suggestions in the ASM query bar.