Surface Command breaks down data silos by combining comprehensive attack surface visibility across hybrid environments to build a dynamic 360-degree view of your entire attack surface in one place. External scans provide an adversary’s perspective on the attack surface, detecting and validating exposures while highlighting areas attackers are most likely to target.

Surface Command combines these external scans with a detailed inventory of your internal assets, no matter the security or IT tool used to scan them. This process delivers complete visibility into your attack surface without the risk of blind spots, unprotected assets, and ungoverned access. Understanding how assets are configured assists in quickly identify and address misconfigurations, shadow IT, and compliance issues. This integrated approach gives you a holistic view of your digital landscape, enabling proactive risk mitigation, threat prevention, and rapid response.

Surface Command is accessible from the Solutions sub-menu on the Command Platform. You can also navigate directly to points of interest within Surface Command by interacting with the Attack Surface Overview or the other Attack Surface-related navigation menu items.

Key concepts

Before getting started with using Surface Command, you should review the following key concepts:

• Connector - A software component that enables Surface Command to collect data from an information source, such as vulnerability scanners, endpoint protection platforms, or cloud services. Each connector understands the API and data schema of its target source. Surface Command provides connectors for most major tools and supports custom connectors for enterprise-specific systems. Learn more about Connectors.
  • Orchestrator - A software component deployed in your environment when Surface Command cannot access an information source directly. Orchestrators collect data from internal or private cloud sources and can also execute actions. After deployment, orchestrators are paired to Surface Command, and one or more connectors are assigned to them.
  • Profile - A configuration that contains credentials and import feeds for a specific connector.
  • Import Feed - A scheduled task that runs a specific data ingestion job. A connector may have multiple associated import feeds.
• Attack Surface - Divided into internal and external components. The internal surface includes assets and identities. The external surface includes IPs, domains, certificates, and services exposed to the internet. Surface Command discovers external assets using domain and IP seeds. Learn more about your Surface Command attack surface.
  • Asset - Any network-connected device, such as a server, workstation, mobile device, or printer. Assets are created automatically when data is ingested from connectors.
  • Identity - A user-based entity like a username, service account, or shared mailbox. Identities can be human or non-human.
  • Seed - A discoverable domain, subdomain, CIDR, or IP used in external asset discovery to uncover certificates, services, and subdomains.
  • Type - * A schema that defines how data is structured for a specific kind of asset or identity. Each connector introduces its own types, which Surface Command maps into standardized unified types (for example, Server, Identity, or Vulnerability). These unified types allow for cross-source correlation and query filtering. Explore unified properties.
• Query - A request written in Cypher or built using the graphical interface to retrieve data ingested by connectors. Queries cannot modify data but can be customized to extract specific insights. Prebuilt queries are available, and you can also create your own. Learn more about Queries.
  • Reference list - External data imported using Excel or CSV files that augments connector data. Use reference lists to enrich queries (for example, to correlate network zones with business units).
• Dashboard - A customizable interface that displays key metrics and insights using widgets. Dashboards help you monitor your security posture visually. Learn more about Dashboards.
  • Widget - A visual component that displays filtered results from a query using charts or graphs. Widgets can be customized to show counts, trends, or metrics. The default widgets on the Surface Command home page provide asset counts by unified type and are not editable.
• Workflow - A repeatable software process that executes steps based on query results. Workflows can be triggered automatically or manually to drive consistent response actions. Learn more about Workflows.
  • Function - A reusable unit of code that interacts with remote systems to retrieve data or take action. Functions serve as the building blocks of workflows and are typically included with connector packages.

Using Surface Command

Surface Command is accessible from the Solutions sub-menu on the Command Platform. You can also navigate directly to points of interest within Surface Command by interacting with the Attack Surface Overview or the other Attack Surface-related navigation menu items. If you’re not sure where to get started, the following list provides a brief overview of the facets of Surface Command:

• Set up or manage Connectors, Import Feeds, and Orchestrators
  • Check out Connectors
• Explore the components that make up your attack surface
  • Check out Assets
• Build queries from my Surface Command data or upload reference data
  • Check out Workspace and Queries
• Build dashboards and widgets
  • Check out Dashboards and Widgets.
• Build automation workflows
  • Check out Workflows