This tool allows you to generate a report on the breakdown of a value present on the domains returned by your query. For example, to generate a report on the cipher suites chosen by HTTPS servers in the United States, you could query for location.country_code: US AND protocols:443/https and then generate a report on the breakdown of the field 443.https.tls.cipher_suite.name. A list of reportable fields is available here.

Many fields have both both parsed and raw values available (e.g., 80.http.get.headers.server and 80.http.get.headers.server.raw. In these cases, the raw value will represent the exact string (e.g., Apache/2.2.22 (Debian)) and the parsed version will bucket on individual terms (e.g., Apache and Debian). Incidentally, in this case, you likely want to aggregate on a parsed out version of the web server, 80.http.get.metadata.description.raw.


Website Report


Raw Data


443.https.tls.cipher_suite.name Websites
tls_ecdhe_rsa_with_aes_128_gcm_sha256 77,012 62.25%
tls_ecdhe_rsa_with_aes_256_cbc_sha 16,686 13.49%
tls_ecdhe_ecdsa_with_aes_128_gcm_sha256 11,637 9.41%
tls_dhe_rsa_with_aes_256_cbc_sha 7,239 5.85%
tls_dhe_rsa_with_aes_128_gcm_sha256 3,267 2.64%
tls_rsa_with_aes_256_cbc_sha 2,594 2.1%
tls_rsa_with_aes_128_cbc_sha 1,727 1.4%
tls_rsa_with_rc4_128_sha 1,097 0.89%
tls_rsa_with_aes_128_gcm_sha256 879 0.71%
tls_rsa_with_rc4_128_md5 566 0.46%
tls_dhe_rsa_with_aes_128_cbc_sha 390 0.32%
tls_ecdhe_rsa_with_rc4_128_sha 250 0.2%
tls_ecdhe_rsa_with_aes_128_cbc_sha 205 0.17%
tls_rsa_with_3des_ede_cbc_sha 124 0.1%
tls_ecdhe_rsa_with_chacha20_poly1305_sha256 31 0.03%
tls_ecdhe_ecdsa_with_aes_256_cbc_sha 3 0.0%
tls_dh_rsa_with_aes_128_cbc_sha 2 0.0%
tls_dhe_rsa_with_chacha20_poly1305_sha256 1 0.0%
tls_ecdhe_ecdsa_with_chacha20_poly1305_sha256 1 0.0%
Total123,711 100.0%

JSON Report


{
  "status": "ok", 
  "results": [
    {
      "key": "tls_ecdhe_rsa_with_aes_128_gcm_sha256", 
      "doc_count": 77012
    }, 
    {
      "key": "tls_ecdhe_rsa_with_aes_256_cbc_sha", 
      "doc_count": 16686
    }, 
    {
      "key": "tls_ecdhe_ecdsa_with_aes_128_gcm_sha256", 
      "doc_count": 11637
    }, 
    {
      "key": "tls_dhe_rsa_with_aes_256_cbc_sha", 
      "doc_count": 7239
    }, 
    {
      "key": "tls_dhe_rsa_with_aes_128_gcm_sha256", 
      "doc_count": 3267
    }, 
    {
      "key": "tls_rsa_with_aes_256_cbc_sha", 
      "doc_count": 2594
    }, 
    {
      "key": "tls_rsa_with_aes_128_cbc_sha", 
      "doc_count": 1727
    }, 
    {
      "key": "tls_rsa_with_rc4_128_sha", 
      "doc_count": 1097
    }, 
    {
      "key": "tls_rsa_with_aes_128_gcm_sha256", 
      "doc_count": 879
    }, 
    {
      "key": "tls_rsa_with_rc4_128_md5", 
      "doc_count": 566
    }, 
    {
      "key": "tls_dhe_rsa_with_aes_128_cbc_sha", 
      "doc_count": 390
    }, 
    {
      "key": "tls_ecdhe_rsa_with_rc4_128_sha", 
      "doc_count": 250
    }, 
    {
      "key": "tls_ecdhe_rsa_with_aes_128_cbc_sha", 
      "doc_count": 205
    }, 
    {
      "key": "tls_rsa_with_3des_ede_cbc_sha", 
      "doc_count": 124
    }, 
    {
      "key": "tls_ecdhe_rsa_with_chacha20_poly1305_sha256", 
      "doc_count": 31
    }, 
    {
      "key": "tls_ecdhe_ecdsa_with_aes_256_cbc_sha", 
      "doc_count": 3
    }, 
    {
      "key": "tls_dh_rsa_with_aes_128_cbc_sha", 
      "doc_count": 2
    }, 
    {
      "key": "tls_dhe_rsa_with_chacha20_poly1305_sha256", 
      "doc_count": 1
    }, 
    {
      "key": "tls_ecdhe_ecdsa_with_chacha20_poly1305_sha256", 
      "doc_count": 1
    }
  ], 
  "metadata": {
    "count": 136180, 
    "backend_time": 53, 
    "nonnull_count": 123711, 
    "other_result_count": 0, 
    "buckets": 19, 
    "error_bound": 0, 
    "query": "protocols: \"443/https\""
  }
}