Umbra
Start free
← All docs

SmartSearch grammar

20+ token-based filters across services, hosts, findings, targets. The same grammar everywhere: typed once, learned forever.

Last updated May 27, 2026

What it is

A unified token-based query grammar that powers every list view in the dashboard AND every relevant Slack slash command. Tokens are key:value pairs (port:443, product:apache); free text appears inline (product:apache login); same-field OR uses commas (port:80,443).

What it produces

A filtered list, plus a copy-pastable query string in the URL. Sample tokens by view:

  • Services: port, status, http, product, version, device_type, category, cert_cn, cert_expiring, banner, title, os, state, liveness, identity, place, company, processed, has_cve, kev, cve_severity, cve, favicon, ai_findings, ai_verdict, compromised, internal, agent
  • Hosts: ip, asn, as_org, city, country, cert_cn, hostname, hosting, compromised, internal, agent
  • Findings: kind, company, severity, internal, agent
  • Targets: value, company, tag, paused

What to use it for

  • ”Find every internal HTTP service that returns 401 and has at least one critical CVE”: internal:true http:true status:401 cve_severity:critical
  • ”Every Confluence with a known KEV”: product:Confluence kev:true
  • ”All cameras and routers in Germany on non-cloud IPs”: device_type:camera,router country:DE hosting:false
  • ”Findings on services discovered by a specific agent”: /api/findings?agent=prod-bastion

Why it matters

Vendor dashboards usually pick one of two extremes: dropdown-driven filters that don’t compose, or raw SQL that nobody types. The token grammar splits the difference: composable like SQL, learnable in a few minutes, copy-pasteable as a URL, AND the same grammar appears in Slack so the muscle memory carries.

Why it’s valuable

  • One grammar, six surfaces. Dashboard, Slack, REST API, AI natural-language translator, help drawer, click-to-run examples. All the same tokens.
  • No drop-down forest. A 20-field filter set in a sidebar is unusable past row 50; tokens stay readable at any combination count.
  • Sharable. Paste the URL into Slack; the recipient sees the same filtered list (scope-checked, of course).

How to use it

  • Click into the search box on any list page; the right-side help drawer shows the full token table for that view (also click-to- run examples).
  • Type free text (no :) for substring search on the obvious free-text fields (IP / hostname / product / banner).
  • Combine: internal:true compromised:true for “internal services the AI agent has proved a compromise on.”

Related: