Welcome to Cytellite
Cytellite is a powerful IP-centric threat intelligence platform designed to give you unparalleled insight into internet-facing devices. Our intuitive query language and comprehensive dataset make it easy to uncover threats, track actors, and understand the global threat landscape.
Navigating the Application
Getting around Cytellite is simple. Here's a breakdown of the main sections, accessible from the sidebar navigation:
Overview
Your starting point. The overview provides a high-level summary of the latest threat intelligence, including emerging IPs, top malicious countries, and key analytics.
Search & Query Builder
The heart of Cytellite. Here you can perform detailed searches using our powerful query language. This documentation will focus heavily on mastering this tool.
Advanced Search Documentation
Comprehensive guide to mastering complex queries, threat hunting scenarios, and advanced search techniques with detailed examples.
Saved Queries
Save your complex queries to reuse them later. This is perfect for recurring investigations or monitoring specific threats.
API Documentation
For our technical users, this section provides all the information you need to integrate Cytellite data into your own applications and workflows.
User Profile
Manage your account settings, including personal information, MFA (Multi-Factor Authentication), and organization details.
Mastering the Query Builder
The query builder is how you communicate with our vast IP database. Queries are built using simple `key:value` pairs. Combine multiple pairs to create highly specific searches. Here are the primary filters you can use:
Country
Filter IPs based on their geographic location. You can use the full country name.
Tag
Tags are labels assigned by Cytellite based on observed behavior, such as 'SSH_SCANNER' or 'RDP_SCANNER'.
Actor
An actor is a known entity, like "Shodan" or "GoogleBot", that actively scans the internet. Filter by actor to see IPs associated with them.
Example:
actor:"Shodan"This helps differentiate between known scanners and potentially unknown threats.
Organization (AS ORG)
Filter by the name of the organization that owns the network (Autonomous System).
Example:
org:"GOOGLE-CLOUD-PLATFORM" Useful for investigating activity from a specific company or provider.
ASN (Autonomous System Number)
Filter by the specific Autonomous System Number.
CVE (Common Vulnerabilities and Exposures)
Find IPs that have been observed exploiting or being associated with a specific CVE.
Last Seen
Filter IPs based on when they were last observed by Cytellite. Use relative timeframes.
Classification
Filter based on how Cytellite has classified the IP.
Combining Filters for Powerful Queries
The true power of the search engine comes from combining these filters. For example, to find all malicious IPs in Germany that are running an SSH scanner, you would use:
classification:malicious and country:Germany and tag:SSH_SCANNERThis query asks Cytellite for IPs that match all three conditions. You can combine as many filters as you need to narrow down your search.