External attack surface

Seeds are used to discover IP addresses, domains, network services, certificates used in your environment, which help build visibility of your external attack surface.

To add seeds:

1. Log in to Surface Command.
2. Go to Discovery Seeds.
3. Click Add Seeds. A window containing a free text field opens.
4. Enter seeds (separated by spaces, commas, or line breaks) into the text field.
5. Click Add Seeds. Rapid7’s External Asset Engine begins scanning your seeds immediately. You will see discoveries populate the External Attack Surface pages as appropriate.

You can filter any External Attack Surface page using the Filter icon in any column header. Click Filter and adjust the operator to get started.

After filtering an External Attack Surface page, you can save the filter for later access. Anyone in Surface Command can access a saved filter.

To save a filter:

1. Filter the External Attack Surface page as necessary.
2. Click Save View.
3. Enter a name for the view.
4. Optionally, enter a description for the view.
5. Click Save.

To access a saved filter:

1. Go to an External Attack Surface page.
2. Click Filter views (top-left corner).
3. Select a filter. The filters with a lock icon denote a pre-made filter created by the Surface Command team.

To modify a saved filter:

1. Go to an External Attack Surface page.
2. Click Filter views (top-left corner).
3. Select a filter.
4. Remove, add, or modify filters as necessary.
5. Save the filter:
   1. Click Save View to update the filter with the current configuration. This option is not available for pre-made filters.
   2. Click Save as... to save the current configuration as a new filter.

You can access properties from these locations:

• Query results - click the asset or identity in the results table.
• Widgets - click View results or View all query results, then click the asset or identity in the results table.
• Relationships graph - click an asset or identity node, then click Show details.

Properties are organized into two categories depending on where they come from: General properties and connector properties. This means you'll see multiple tabs when you open the properties side panel. Navigate to a connector tab to see the properties associated with that particular connector.

After seeds have been added, you can update the status of discovered network services, certificates, domains, and IP addresses to adjust or filter your Vector Command attack plan.

To update the status of an individual asset:

1. Log in to Surface Command.
2. Go to one of the External Attack Surface pages (Network Services, Certificates, Domains, IP Addresses).
3. Hover over the Testing Status value for an asset.
4. Click Edit EASM Status (pencil icon).
5. Select a status:
   • Approved: Indicates the asset has been reviewed and determined to be owned by your organization and part of your attack surface.
   • Rejected: Indicates the asset has been reviewed and determined not to be owned by or relevant to your organization. This asset is not part of your attack surface.
   • Not Reviewed: Indicates the asset has not been reviewed or confirmed yet.
   • Not Approved: Indicates the asset has been reviewed and determined to be owned by your organization but should not be considered part of your attack surface.
   • SaaS: Indicates the asset is related to a Software as a Service (SaaS) product your organization uses and does not own but should be part of your attack surface.

To update the status of assets in bulk:

1. Log in to Surface Command.
2. Go to one of the External Attack Surface pages (Network Services, Certificates, Domains, IP Addresses).
3. Filter the page as necessary.
4. Click Change Status.
5. Select the group of assets to change status for:
   • This page: Change status for all assets on the current page (limited to 25 assets).
   • All results: Change status for all assets.
   • Filtered results: This option is available if a filter is currently applied. Change status for all filtered assets.
6. Select a status:
   • Approved: Indicates the asset has been reviewed and determined to be owned by your organization and part of your attack surface.
   • Rejected: Indicates the asset has been reviewed and determined not to be owned by or relevant to your organization. This asset is not part of your attack surface.
   • Not Reviewed: Indicates the asset has not been reviewed or confirmed yet.
   • Not Approved: Indicates the asset has been reviewed and determined to be owned by your organization but should not be considered part of your attack surface.
   • SaaS: Indicates the asset is related to a Software as a Service (SaaS) product your organization uses and does not own but should be part of your attack surface.
7. Click Change Status. A summary of the changed statuses is displayed.
8. Click Close and Refresh.

The External Attack Surface section of the Command Platform (Attack Surface > External Attack Surface) hosts all seeds and discoveries from the Rapid7 External Asset Engine. The External Attack Surface is divided into three tabs:

• Seeds: Displays existing seeds. You can also add seeds from this page.
• IPs & Domains: Displays the following:
  • Independent IPv4 or IPv6 addresses referring to a discovered method of reaching an asset (note that the same asset may be listed by multiple addresses if it is accessible via multiple addresses).
  • Top-level domains or subdomains that are accessible using the Domain Name System (DNS).
• Network Services & Certificates: Displays the following:
  • SSL certificates associated with a web service.
  • Open network ports indicating a service responding at the given address.

The information available with each discovery includes its Type, Name, Severity and Status. The Name identifies the discovery based on the given type, and the Status helps you take action on the discovery. Severity is automatically determined by Rapid7 based on the impact a compromise could have and cannot be adjusted.