Core concepts¶
This chapter describes the objects the platform works with and how they relate to one another. Understanding these relationships makes every subsequent chapter easier to follow.
The analysis cycle¶
The platform operates as a repeating cycle rather than as a single scan:
- You define a scope for a project by entering search terms: domains, keywords, IP addresses, or IP ranges.
- The platform runs a search job that analyses the scope and identifies systems, services, and further indicators.
- Indicators that are related but not yet confirmed are presented in the Discovery view for assessment.
- You confirm the relevant findings, which become additional search terms, or reject them, which adds them to the blacklist.
- Confirmed systems appear in the Assets view, and the cycle repeats with the extended scope.
Each confirmed search term therefore widens the analysis; each blacklisted value prevents a recurring false positive.
Objects¶
| Object | Description |
|---|---|
| Company | The billing and membership entity. A project can belong to more than one company, and every user belongs to one or more companies. |
| Plan | The quota assigned to a company. It caps how many keywords, IP addresses, domains, darknet records, and employee lookups may be consumed, separately for search and for monitoring. |
| Project | A container for one scope and its results. All views, Dashboard, Scope, Discovery, Assets, Intel, Darknet, operate within a single project. |
| Search term | A single entry in the scope. The platform classifies each entry by type, for example Domain, Keyword, IPv4 Address, or IPv4 Range. |
| Search scope | The sources analysed for a search term: Attack surface, Darknet, and Employees. Domains and administrator-created TLD entries can use all three; email addresses can use Darknet and Employees; keywords, IP addresses, and IP ranges are fixed to Attack surface. The exact selectable options depend on the company plan. |
| Asset | A confirmed part of the attack surface: a host, a service on a host, or a domain. |
| Service | A single reachable endpoint, identified by IP address, protocol, and port. For example ssh/22. |
| Search job | One execution of an analysis. Jobs are of type Discovery, Asset, Monitoring Discovery, Monitoring Asset, or Employee Lookup. See Search Jobs for details. |
| Preset | A reusable set of scan options that can be applied when a project is created. Presets are maintained per company. |
Search terms and types¶
The type of a search term determines how the platform uses it. Types are detected automatically from the value you enter.
| Type | Example value | Effect |
|---|---|---|
Domain |
example.com |
The domain and, depending on the scan options, its subdomains are analysed. The search scope is selectable. |
TLD |
com |
The top-level domain can use all three search scopes. Only administrators can classify an entry explicitly as this type; for other users, the value is treated as a keyword. |
Email |
jane.doe@example.com |
The email address is used to search for related leak data or employee information. The available search scopes are Darknet and Employees, subject to the company plan. |
Keyword |
Example Company GmbH |
The value is matched against banners, certificate attributes, Whois records, and Autonomous System names. |
IPv4 Address |
192.0.2.15 |
The single address is analysed. |
IPv4 Range |
192.0.2.0/24 |
Every address in the range is analysed. |
IPv6 Address / IPv6 Range |
2001:db8::1, 2001:db8::/32 |
As for IPv4. |
Choosing between a domain and a keyword
A domain is precise and produces few false positives. A keyword is broad: it finds systems that carry your organisation's name in a banner or certificate but that you may not know about, at the cost of also matching third parties with similar names. Start with domains and IP ranges, then add keywords once you are able to assess the findings.
Attack surface, Darknet, and Employees¶
The three search scopes answer different questions and are billed against different parts of the plan.
| Search scope | Question answered | Where the results appear |
|---|---|---|
| Attack surface | Which systems and services of the organisation are reachable from the internet, and which vulnerabilities do they carry? | Assets, Discovery |
| Darknet | Have credentials or other data belonging to the organisation been published in a leak? | Darknet |
| Employees | Which employees are publicly identifiable, and are their accounts affected by known leaks? | Intel |
Monitoring versus search¶
Every plan distinguishes two kinds of consumption:
- Search covers the analysis you trigger yourself, for example when a project is created or a search term is added.
- Monitoring covers the recurring re-analysis of an existing scope. Monitoring is configured per project on the Monitoring tab of the project settings and reported per company on the Plans tab of Companies.
A project whose monitoring is switched off is shown as Inactive in the projects overview. This does not delete any results; it only stops the recurring analysis.