Discovery

The Discovery tab presents indicators that the platform has identified as potentially related to the organisation but that have not yet been confirmed as part of the attack surface. Assessing these findings is the main activity through which the coverage and the accuracy of a project improve.

The complete workflow, including the assessment criteria, is described in the Add search terms guide. This chapter is the reference for the view itself.

Sub-tabs

The findings are grouped into five categories. The number in each tab label is the number of findings still awaiting assessment.

Sub-tab	Content	Search terms typically derived
Services	Identified network services, including IP address, protocol, port, and service banner.	Whois description, Whois netname
Domains	Domain names identified through certificate data, reverse DNS, or keyword searches.	Domain names (FQDN)
Certificates	TLS certificates, including subject and issuer attributes.	Subject CN, Subject organization, Issuer CN, Issuer organization
Whois	Whois records for identified IP ranges, including contact and abuse data.	Net name, description, abuse email, abuse domain
AS	Autonomous systems associated with identified IP ranges.	AS name, organization name

Understanding a row

The columns differ per sub-tab, because each category carries different attributes. Two columns document where a finding came from and appear in every category that has them.

Column	Content
Matches	The matching rule, for example, Banner Match, Body Match, or Domain Match; the responsible search term as a label, such as Keyword: example.com; and the data field in which the match occurred.
Origin	How the finding was reached, for example Keyword search rDNS match ("192.0.2.15"). Present on the Domains sub-tab.

The remaining columns are those of the category:

Sub-tab	Columns
Services	IP, FQDNs, Server banner, Protocol, Port, Matches, Whois description, Whois netname, Actions
Domains	Domain, Origin, Matches, Actions

Use Manage columns to show or hide individual columns, as described in Working with the interface. Where a value has been truncated, select Show full text to display it in full.

Assessing a finding

Each value that can be promoted carries two controls.

Control	Tooltip	Effect
Green plus	Add to project	Adds the value to the project scope as a search term.
Red minus	Remove and add to blacklist	Removes the finding and adds the value to the blacklist, preventing it from reappearing.

Recommended assessment criteria

Confirm a finding if the value clearly identifies your organisation: a company name, a brand, a domain you own, or a network range registered to your organisation. Reject findings that identify a third party, such as a hosting provider, a content delivery network, or a certificate authority, as these would introduce assets outside your responsibility.

Adding a single value

1. Select the green plus next to the value. The Add search term · General dialogue opens at Step 1 of 2.
2. Amend the value if required, for example by shortening a company designation to its distinctive component.
3. Select Continue and review the detected type and search scope in Step 2 of 2 · Scope options.
4. Select Add.

Processing several findings together

1. Activate the checkbox at the beginning of each relevant row.
2. Use the action bar that appears above the table on the right:

Action	Effect
Add selected to project	Opens the Add services to project dialogue with the selected values pre-filled, and adds them to the scope.
Remove selected and add to blacklist	Removes the selected findings and adds their values to the blacklist.
Delete selected	Removes the selected findings without blacklisting them. Identical findings may reappear in a later analysis.

The number of selected rows is shown in each tooltip, for example Add selected to project (3).

What happens after a confirmation

Confirmed findings disappear from the discovery list, because they are no longer awaiting assessment. Related findings that are covered by the same search term are resolved in the same operation, so the counter in the sub-tab label may fall by more than the number of entries you confirmed.

The platform then re-analyses the extended scope. The indicator Updating data is shown next to the project name for the duration. Once the analysis has completed, newly identified indicators appear in Discovery and confirmed systems in Assets.

We recommend repeating the cycle until no further relevant findings are reported.