hunter_search
Search the Hunter cyberspace mapping platform to discover web and non-web assets using field-based queries with fuzzy/exact matching and logical operators.
Instructions
Search Hunter (奇安信鹰图) cyberspace mapping platform. Requires HUNTER_KEY environment variable. Query syntax: field="value" format. Matching operators: = (fuzzy match), == (exact match), != (fuzzy exclude), !== (exact exclude). Logical operators: && (AND), || (OR). Examples: web.body="keyword", web.title=="login", domain="example.com" && web.status_code="200", ip!="1.1.1.1". Supports filtering by asset type: web assets, non-web assets, or all. Supports time range filtering (querying beyond 30 days will consume extra credits).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Hunter search query. Matching operators: = (fuzzy), == (exact), != (fuzzy exclude), !== (exact exclude). Logical: && (AND), || (OR). Examples: web.body="keyword", web.title=="login", domain="example.com" && ip!="1.1.1.1", (web.title="admin" || web.title="login") && ip!="" | |
| page | No | Page number, starting from 1 (default: 1) | |
| page_size | No | Results per page (default: 10, valid values: 10, 50, 100). IMPORTANT: If user specifies a number (e.g., '查询10个', 'find 5 results'), choose the closest valid value (10, 50, or 100). For 1-30 use 10, for 31-75 use 50, for 76+ use 100. | |
| is_web | No | Asset type filter: 1=only web assets (websites, web services), 2=only non-web assets (databases, IoT devices, etc.), 3=all assets (default: 3) | |
| status_code | No | HTTP status codes filter (e.g., '200,301') | |
| fields | No | Comma-separated fields to return. Available: ip,port,domain,ip_tag,url,web_title,is_risk_protocol,protocol,base_protocol,status_code,os,company,number,icp_exception,country,province,city,is_web,isp,as_org,cert_sha256,ssl_certificate,component,asset_tag,updated_at,header,header_server,banner. If not specified, returns all fields. | |
| start_time | No | Query start time in format: 2021-01-01 (YYYY-MM-DD). Note: Querying beyond 30 days will consume extra credits. | |
| end_time | No | Query end time in format: 2021-03-01 (YYYY-MM-DD). Note: Querying beyond 30 days will consume extra credits. |