FQL Documentation

Table of Contents

• Grammar
• Operators
• Fields
  • domain object
  • result object
  • Events
  • bundle object
  • user object
  • notification object
  • agent object
  • agent token object
• Examples
  • Symbolic Operators
  • Textual Operators

Grammar

expr := clause | expr bool expr | [not] ( expr )

clause := name op value

bool := and | or

op := eq | = |
      ne | != |
      gt | > |
      ge | >= |
      lt | < |
      le | <= |
      like | ~

Operators

Operator availability depends on the field type.

For fields of type number (int, float) the following operators are allowed (plus their symbolic counter part):

• eq, ne, gt, ge, lt, le
• (Info) Please make sure that you use the correct number format for a field (e.g. 0 for integer fields and 0.0 for float fields)
• (Info) Float numbers must be entered with dot as decimal mark (e.g. 0.9). Please note that entering comma as decimal mark (e.g. 0,9) will not work

For fields of type string the following operators are allowed (plus their symbolic counter part):

• eq, ne, gt, ge, lt, le, like
• (Info) Strings must be delimited by double quotes ( e.g. "this is a string" )
• (Info) The like operator supports _ as wildcard for any single character and % as wildcard for zero or more characters

For fields of type boolean the following operators are allowed (plus their symbolic counter part):

• eq, ne

For fields of type date the following operators are allowed (plus their symbolic counter part):

• eq, ne, gt, ge, lt, le
• (Info) Dates must be delimited by double quotes ( e.g. "this is a string" )
• (Info) The format for the date is of: yyyy-MM-dd HH:mm:ss

For fields of type uuid the following operators are allowed (plus their symbolic counter part):

• eq, ne
• (Info) UUID must be delimited by double quotes ( e.g. "this is a string" )

For the equality operators (eq, ne) it is also possible to test for the absence of a value (check for null).

Fields

Each filter in the API operates on 1 target per URL. Each target has different fields and field types. The following tables first list all available targets and then describe the available fields for each target.

The following fields can be filtered:

domain object

The following table describes all fields that can be filtered when you are interacting with the URL /v2/domain of the API.

result object

The following table describes all fields that can be filtered when you are interacting with the URL /v2/infected of the API.

Events

bundle object

The following table describes all fields that can be filtered when you are interacting with the URL /v2/bundle of the API.

user object

The following table describes all fields that can be filtered when you are interacting with the URL /v2/userof the API.

notification object

The following table describes all fields that can be filtered when you are interacting with the URL /v2/user//notification of the API.

(Info) the values for serverside, content and blacklist reflect the severity as described in result object

agent object

The following table describes all fields that can be filtered when you are interacting with the URL /v2/download of the API.

agent token object

The following table describes all fields that can be filtered when you are interacting with the URL /v2/token of the API.

Examples

Symbolic Operators

domain with id 10
id = 10

domain with id 10 and starting with example (matches e.g. example.com)
id = 10 and name ~ "example%"

(domain with id 10 and schema "https") or domains that are not "blog.example.com"
(id = 10 and schema = "https") or name != "blog.example.com"

results that have category "text" and a probability greater or equal 0.9
category = "text" and probability >= 0.9

results that refer to files which are safe to delete
safetodelete = "true"

results that last occurred on or before 2015-07-01 00:00:00
lastdate <= "2015-07-01 00:00:00"

domains that do not have the bundle identifier a39649ff-ddb5-47ce-8b97-9758961534b1
not (bundle = "a39649ff-ddb5-47ce-8b97-9758961534b1")

bundles that do not have an end date set
enddate = null

Textual Operators

domain with id 10
id eq 10

domain with id 10 and starting with example (matches e.g. example.com)
id eq 10 and name like "example%"

(domain with id 10 and schema "https") or domains that are not "blog.example.com"
(id eq 10 and schema eq "https") or name ne "blog.example.com"

results that have category "text" and a probability greater or equal 0.9
category eq "text" and probability ge 0.9

results that refer to files which are safe to delete
safetodelete eq "true"

results that last occurred on or before 2015-07-01 00:00:00
lastdate le "2015-07-01 00:00:00"

domains that do not have the bundle identifier a39649ff-ddb5-47ce-8b97-9758961534b1
not (bundle eq "a39649ff-ddb5-47ce-8b97-9758961534b1")

bundles that do not have an end date set
enddate eq null

Textual Operators

domain with id 10
id eq 10

domain with id 10 and starting with example (matches e.g. example.com)
id eq 10 and name like "example%"

(domain with id 10 and schema "https") or domains that are not "blog.example.com"
(id eq 10 and schema eq "https") or name ne "blog.example.com"

results that have category "text" and a probability greater or equal 0.9
category eq "text" and probability ge 0.9

results that refer to files which are safe to delete
safetodelete eq "true"

results that last occurred on or before 2015-07-01 00:00:00
lastdate le "2015-07-01 00:00:00"

domains that do not have the bundle identifier a39649ff-ddb5-47ce-8b97-9758961534b1
not (bundle eq "a39649ff-ddb5-47ce-8b97-9758961534b1")

bundles that do not have an end date set
enddate eq null