# Searching and filtering data

While this page discusses some EASM-specific search criteria, the NetSPI Platform's built-in
[filtering and search capabilities](/legacy/general-navigation/search-sort-and-filter-tables/#search-sort-and-filter-tables)
can also help you accomplish your tasks.

## Search syntax

All search fields in the NetSPI Platform support
[intelligent full text search](https://www.elastic.co/guide/en/elasticsearch/reference/7.10/query-dsl-query-string-query.html#query-string-syntax).

Learning how to use this text search is key to maximizing the value of the collected data.

## Query building

You can query a large amount of data in every search field. For example, when searching [Domain Assets](/EASM/assets/domain/#domains) you can search for not only the domain name, but for all IPs that domain resolves to, or all tags for that domain. To discover what fields you can search, view the EASM API documentation for the respective asset or exposures, as listed below, by visiting this link: [NetSPI Platform API Documentation](https://platform.netspi.ai/apidocs).

- Domain
- IP Address
- Port
- Vulnerability
- Product
- Certificate
- Tag
- DNS Record

To query nested data within a document, join the field names with a `.`, similar to JSON. For example, if you want to
query all IP Addresses that have `netspi.com` resolve to them, search for `domains.name:netspi.com` in the search field on the
[IP Address](/EASM/assets/ip/#ip-addresses) page.

## Common searches

Searches must start with a root asset or exposure. For example, when searching IP Addresses, perform the search
from the [IP Address page](/EASM/assets/ip/#ip-addresses), and not another page.
==+ IP Addresses in a CIDR range
:icon-search: `ip:"74.115.3.0/24"`
===
==- Domains tagged 'production'
:icon-search: `tags.tag.name:production`
===
==- Ports running an HTTPS service
:icon-search: `service:https`
===
==- IP Addresses with SSH ports
:icon-search: `ports.service:ssh OR ports.number:22`
===
==- SSL/TLS certificates expiring soon
:icon-search: `validTo:<now+1w`
===
