2.3 Attack Surface Management
The Attack Surface module discovers and visualizes the organization's internet-facing infrastructure, including services, ports, and potential vulnerabilities. The module header displays the description: "View your infrastructure's scanned topology, policies, and insights." The main interface is shown in Figure 2.3-1.
Figure 2.3-1 – Attack Surface Graph View
2.3.1 View Modes
The top-right corner of the module provides three view mode options for analyzing your attack surface data, as shown in Figure 2.3.1-1.
Figure 2.3.1-1 – Attack Surface View Mode Selector
View | Description |
|---|---|
Graph | Visual node-edge topology of discovered assets and their relationships |
List | Tabular inventory of all discovered assets with detailed information |
Policies | Configuration management for automated scanning policies |
2.3.2 List View
The List view provides a detailed tabular inventory of all discovered assets, as shown in Figure 2.3.2-1. This view is ideal for security analysts who need to review specific subnet details and vulnerability data.
Figure 2.3.2-1 – Attack Surface List View
2.3.2.1 Search Functionality
A search bar at the top of the List view allows you to filter assets by specific criteria. The placeholder text reads "Search by subnet or IP address..." enabling quick location of specific network segments or hosts within the discovered inventory.
2.3.2.2 Asset Table Columns
The asset inventory table displays the following columns for each discovered asset:
Column | Description |
|---|---|
Subnet | The network subnet containing the discovered asset |
IP Address | The specific IP address of the asset |
Open Ports | Number and list of open ports detected on the asset |
Services | Identified services running on open ports |
Vulnerabilities | Number of vulnerabilities detected, with severity indicators |
Source Scenarios | Contextual information about how the asset was discovered |
2.3.2.3 Vulnerability Filtering
The List view includes vulnerability filtering options to help prioritize findings, as shown in Figure 2.3.2.3-1.
Figure 2.3.2.3-1 – Vulnerability Filters
The Filter by Vulnerability dropdown allows you to narrow results by severity level:
Severity Level | Description |
|---|---|
Critical | Vulnerabilities requiring immediate remediation |
High | Significant risk vulnerabilities |
Medium | Moderate risk vulnerabilities |
Low | Minor or informational findings |
All Severities | Display all vulnerability levels (default) |
2.3.2.4 Export Functionality
The Export CSV button, located in the List view toolbar, allows you to download the current asset inventory in CSV format for external analysis, reporting, or integration with other security tools.
2.3.3 Policies View
The Policies view manages automated scanning configurations for attack surface discovery, as shown in Figure 2.3.3-1.
Figure 2.3.3-1 – Policy Management Interface
2.3.3.1 Policy List Table
Existing policies are displayed in a table with the following columns:
Column | Description |
|---|---|
Policy Name | Unique identifier for the scanning policy |
Description | Purpose and scope of the policy |
Actions | Edit and delete controls for the policy |
2.3.3.2 Creating a New Policy
To create a new scanning policy, click the Add New Policy button located on the right side of the Policies view. The policy creation form opens, as shown in Figure 2.3.3.2-1.
Figure 2.3.3.2-1 – Add New Policy Form
Configure the following parameters when creating a new policy:
Parameter | Description |
|---|---|
Policy Name | A unique identifier for the scanning policy |
Description | Detailed explanation of the policy's purpose and scope |
Source Guardpots | Select one or more honeypot agents to perform the scanning |
Target IP/Subnets | IP addresses or subnet ranges to include in the scan |
Schedule Type | Scheduling method for scan execution |
Interval (seconds) | Time between consecutive scan cycles |
Enable Port Scan | Toggle to activate port scanning |
Ports to Scan | Specific ports or port ranges to include |
Enable Web Discovery | Toggle to activate web service and application discovery |
Activate Policy on Save | When enabled, the policy begins executing immediately after creation |
2.3.4 Empty State
When no scan data is available, the Attack Surface module displays the following empty state message, as shown in Figure 2.3.4-1:
No Scan Data Found Waiting for data or no assets are discovered yet.
Figure 2.3.4-1 – Attack Surface Empty State
This indicates that scans have not yet been performed or no internet-facing assets have been discovered. Configure a scanning policy in the Policies view and ensure at least one Source Guardpot is active to begin populating attack surface data.