Using Surface Command

Surface Command breaks down data silos by combining comprehensive attack surface visibility across hybrid environments to build a dynamic 360-degree view of your entire attack surface in one place. External scans provide an adversary’s perspective on the attack surface, detecting and validating exposures while highlighting areas attackers are most likely to target.

Surface Command combines these external scans with a detailed inventory of your internal assets, no matter the security or IT tool used to scan them. This process delivers complete visibility into your attack surface without the risk of blind spots, unprotected assets, and ungoverned access. Understanding how assets are configured assists in quickly identify and address misconfigurations, shadow IT, and compliance issues. This integrated approach gives you a holistic view of your digital landscape, enabling proactive risk mitigation, threat prevention, and rapid response.

Surface Command is accessible from the Solutions sub-menu on the Command Platform. You can also navigate directly to points of interest within Surface Command by interacting with the Attack Surface Overview or the other Attack Surface-related navigation menu items.

Key concepts

Before getting started with using Surface Command, you should review the following key concepts:

• Connectors - A software component that Surface Command uses to interface with an information source to collect data about the objects in their environment. An information source is an existing system or data source, such as vulnerability scanning tools, endpoint protection technologies, or cloud service providers, that has information about any object of interest. Each connector is designed to understand the specifics of the targeted information source’s API and data schemas. Surface Command provides Connectors for most major security tools, but custom Connectors can be built for your enterprise-specific systems. Review Connectors for more information.
  • Orchestrator - A server that can access and collect data from information sources and execute operations. An orchestrator is installed in the customer’s environment when the Surface Command platform cannot access an information source, such as an application behind a firewall, or when an application's APIs reside on a private cloud network. Once deployed, an orchestrator is paired to the platform. 1 or more Connectors are then assigned to the orchestrator.
  • Profile - A distinct grouping of credentials and import feeds for a given connector.
  • Import Feed - A scheduled software job that performs a specific process like importing data from an information source. Connectors can have multiple associated Import Feeds.
• Attack Surface - Your attack surface is divided into two parts: internal and external. In Surface Command, your internal attack surface is composed of assets and identities while your external attack surface is composed of IP addresses, domains, network services, and certificates. The external attack surface discovery process is driven by domain and IP seeds. For more information, review Explore Your Attack Surface.
  • Asset - Assets are network-attached compute devices, including servers, workstations, mobile devices, storage devices, network devices, and printers. Surface Command creates the representations of assets automatically when data is ingested into the system by a Connector.
  • Identity - Identities are identification-based entities, including user names, service accounts, shared email inboxes, and other non-human identities.
  • Seed - A domain, subdomain, CIDR range, or IP address that is externally accessible and can be used to discover other externally accessible assets, such as an SSL certificate, subdomain, or network service (for example, SMTP, FTP).
  • Type - Describes the structure of the data for a specific type of asset or identity. Every data record is associated with an exact technical description of the structure and semantics of its properties. Each Connector defines its own set of types. Surface Command unifies all the types that pertain to the same class of object, such as a server or a vulnerability, into a set of pre-defined unified types. For example, different information sources might provide information about a single device from the perspective of an EC2 Instance, CrowdStrike Device, SentinelOne Agent, and Tenable.io Asset. They all pertain to the same device and the unified type would be Server. You can use unified asset types, each information source’s asset types, or both when writing queries to select specific results. For more information on the Unified Asset Model, review Explore unified properties.
• Query - A tool used to select and display specific data that was ingested by Connectors. A query cannot add or change data. Some queries are included with Surface Command by default or included with a given Connector. You can also write your own queries to retrieve the data of interest to you. Queries are written in Cypher, which is a standards-based graph query language. Surface Command also provides a graphical interface for building basic queries without needing to understand Cypher. For more information, review Workspace and Queries.
  • Reference list - Enterprise or industry data that is not accessible by a Connector but is collected from Microsoft Excel (.xlsx) or CSV files. For example, it could be a spreadsheet that maps network addresses to physical locations or business owners. Reference lists let you combine this data with other information pulled from information sources when building queries.
• Dashboard - A user-created collection of widgets. You can use and organize dashboards to present and monitor any aspect of your security posture. For more information, review Dashboards and Widgets.
  • Widget - A component that displays a specific dataset in a dashboard. A widget retrieves data from a query, filters the results to show specific data, and presents that data in a customized chart or graphic. You can configure the type of graph and how it calculates values. Since a widget filters the results from a query, you can have several different widgets based on a single query. The Surface Command home page has a set of pre-defined widgets, where each widget provides a count of assets of a specific unified type. These are not editable.
• Workflow - A set of steps that perform 1 or more actions driven by query results that define a repeatable process. You can associate workflows with queries to generate automatic responses to specific changes or invoke them manually as needed. For more information, review Workflows.
  • Function - Code that interacts with a remote application or program to retrieve data or perform an action. It is used as a building block for workflows. When creating workflows, you can leverage functions and chain them together to achieve comprehensive operations. Functions are provided with the Connectors by default.

Using Surface Command

Surface Command is accessible from the Solutions sub-menu on the Command Platform. You can also navigate directly to points of interest within Surface Command by interacting with the Attack Surface Overview or the other Attack Surface-related navigation menu items. If you're not sure where to get started, the following list provides a brief overview of the facets of Surface Command:

• Set up or manage Connectors, Import Feeds, and Orchestrators
  • Check out Connectors
• Explore the components that make up your attack surface
  • Check out Assets
• Build queries from my Surface Command data or upload reference data
  • Check out Workspace and Queries
• Build dashboards and widgets
  • Check out Dashboards and Widgets.
• Build automation workflows
  • Check out Workflows