Censys deprecated their Search 1.0 endpoints on 3 August 2021, and terminated those services on 30 November. This enricher is no longer available.

This article describes how to configure a particular enrichment source. To see how to configure enrichers in general, see Configure enrichers.

Enricher name	Censys Enricher
Input	Asn, city, company, country, country_code, geo-lat, geo-long, hashes (hash-md5, hash-sha1, and hash-sha256), ipv4, and postcode.
Output	Enriches supported observable types by providing additional context such as geolocation, country and city information, as well as ASN details.
API endpoint	`https://censys.io/api/v1/search/ipv4`
Description	Returns relevant contextual information about the submitted observable types to augment their intelligence value with geographic and geolocation details, hashes, and ASN details. It makes it easier to discover relationships between events, actors, and targets.

Requirements

Users need an API key and API ID. Sign up and subscribe to the service to obtain the required credentials to access the API endpoint exposing the service.

Configure the enricher parameters

Edit the enricher.
From the Observable types drop-down menu, select one or more observable types you want to enrich with data retrieved through the Censys enricher.
The API URL field is automatically filled in with the default domain for the endpoint.

You can add a proxy or set up ports according to your needs.

Default value: https://censys.io/api/v1/search/ipv4.
In the API key field, enter the API key associated with your API user profile, so that you can log in and consume the API service.
In the API ID field, enter your API user ID.

Create an account to receive the login credentials you need to authenticate and access the API service.
From the Extract queries drop-down menu, select the type of observable you want to search for.
In the second input field, specify the observable value associated with the observable type that the rule should look for.

You can use free text, wildcards, Elasticsearch query syntax, as well as the {kind} and {value} placeholders to reference an observable type and value, respectively.

When the query executes, the placeholders take the values from the input observable key ({kind}) and value ({value}) pairs, respectively.

Example:

The *@{value} query searches for observable values matching the input observable values it is fed at runtime.

Censys enables using specific data fields to search for data related to IP hosts. You can combine these data definitions with the {kind} and {value} placeholders.

The Censys Search API enables simple searches for words or phrases, as well as complex searches using query syntax and query parameters:
- For the search syntax, refer to Censys Overview, under Search Syntax.
- For the query parameters you can pass, refer to Censys Overview, under Data Definitions > IPv4 Hosts.
  
  When you chain multiple parameters in the same query without specifying any Boolean operator, the default Boolean operator between parameters is or.
Click + Add or + More to add a new filtering option. For example, to include in the search additional key/value pairs like IP addresses, hashes, or domains.
To store your changes, click Save; to discard them, click Cancel.