Scope¶
The Scope tab defines what the platform analyses for a project. It contains three sub-tabs.
| Sub-tab | Content |
|---|---|
| Search terms | The active search terms of the project. |
| Blacklist | Values that are excluded from the analysis. |
| Removed services | Services that have been removed from the project. |
The number in each tab label is the current number of entries.
Search terms¶
| Column | Content |
|---|---|
| Search term | The value. The copy control in the column header (tooltip Copy to clipboard) copies the complete list to the clipboard. |
| Type | The type detected by the platform, for example Domain, Email, Keyword, IPv4 Address, or IPv4 Range. Administrators can also create entries of type TLD. |
| Search scope | The sources analysed for this entry, for example Attack surface, All sources, or a combination such as Attack surface & Employees. |
| Actions | Change search scope for entries that support multiple search scopes: Domain, Email, and administrator-created TLD; plus a delete control for every entry. |
Adding search terms¶
Select Add search terms and complete the two-step dialogue. The procedure is described in full in the Add search terms guide.
In summary:
- Step 1 of 2 · General: enter one entry per line in Targets, or select Upload file to import a TXT file.
- Step 2 of 2 · Scope options: review the detected type and search scope of each entry.
- Select Add.
Changing the search scope of an entry¶
The search scope can be changed after an entry has been added if its type supports multiple search scopes. For Domain and administrator-created TLD, these are Attack surface, Darknet, and Employees. For Email, these are Darknet and Employees. The options available in the dialogue depend on the company plan.
- Select Change search scope in the Actions column of the entry.
- Activate or deactivate the available search scopes as needed.
- Select Apply.
Keywords, IP addresses, and IP ranges are analysed under Attack surface and offer no selection. For non-administrators, a TLD-like value such as com is treated as a keyword and therefore also uses the fixed Attack surface scope.
Effect on quota
Each additional search scope consumes its own quota from the company plan. Enabling Employees or Darknet for a large number of domains can exhaust the plan; check the resource limits before doing so.
Removing a search term¶
Select the delete control in the Actions column. The entry is removed from the scope with immediate effect. Results that were found exclusively through this entry are no longer maintained.
Blacklist¶
The blacklist prevents values from reappearing in the analysis. It is the correct instrument for a recurring false positive, typically the name of a hosting provider, a content delivery network, or a certificate authority.
| Column | Content |
|---|---|
| Search term | The excluded value. |
| Actions | A delete control that removes the exclusion. |
Adding a blacklist entry¶
Entries reach the blacklist in two ways:
- by rejecting a finding in Discovery with Remove and add to blacklist; or
- directly, by selecting Add search terms on the Blacklist sub-tab.
The dialogue on the Blacklist sub-tab is a single step: enter one value per line under Targets, or select Upload file, then select Add. Blacklist entries carry no search scope, so no review step is required.
Removed services¶
A service that has been removed from the assets, for example, because it does not belong to the organisation, is listed here. The entry prevents the service from being reported again as an asset. A removed open port of a host whose open ports are hidden is not listed here: restoring it would not show it (see Hidden open ports).
Removing the entry from this list makes the service eligible to be reported again by the next analysis.