Internet Asset Discovery

This scenario addresses a basic ASM (attack surface management) question: given a domain or company name, how can you build the most complete possible view of that organization's internet-exposed assets?

Rather than acting as another standalone scanner, Flocks correlates external discovery sources, enterprise CMDB data, and threat intelligence into a unified Agent context, so asset volume and asset risk appear in the same result.

Scenario Overview

Typical pain points in external asset discovery include:

• Internal CMDB only covers "registered" assets and misses test, temporary, or third-party hosted assets
• Using a single discovery platform, such as FOFA / Shodan / ThreatBook assets, always leaves coverage gaps
• After discovery, results still need manual correlation with internal information: who uses it, and does it have vulnerabilities?

Rex connects the full workflow: external discovery, classification and aggregation, internal correlation, risk tagging, and report output.

Inputs and Outputs

Typical Inputs

• Root domain: example.com
• Company / organization name: fuzzy search -> expand to all related domains
• IP range: a certain ASN / a known IP range
• Mixed input: a batch of seeds, such as domain + IP + certificate keyword

Typical Outputs

• Asset inventory: domain / subdomain / IP / port / service / certificate / title
• Classification view: by business / region / environment, such as production / test / third-party
• Risk view: correlated vulnerability intelligence, threat intelligence, and alert history
• Diff view, for continuous tracking: assets added / disappeared / changed this run vs the previous run

Prerequisites

Dependency	Requirement
Model	The default model is sufficient
Discovery tools	At least one source is integrated; ThreatBook assets + FOFA is recommended
Intelligence tools	Optional. Used to add threat / vulnerability tags to assets
Internal CMDB	Optional. Integrated through API or exported files for "external discovery x internal registration" alignment
Channels	Optional. Continuous tracking scenarios push new assets through WeCom / DingTalk

Steps (WebUI)

Step 1: Create a Session and Provide a Seed

"Discover internet assets for threatbook.cn, including subdomains, exposed ports, and Web services, and output them by category."

Step 2: Rex Runs Multi-source Discovery in Parallel

Rex:

• Identifies the seed type, such as root domain
• Calls integrated discovery tools in parallel
• Receives raw results from each source, such as subdomains / IP / Banner / certificates
• Deduplicates and merges results, since different tools may return different fields for the same asset

Step 3: Classify and Aggregate

Unlike basic multi-source summarization, Flocks enhances asset context through structured categorization:

• Classify by business system, such as main site / mail / OA / API / CDN / third-party hosting
• Classify by environment, such as production / test / staging
• Classify by technology stack, such as Nginx / Tomcat / a cloud provider / a SaaS
• Classify by region / ownership

Classification rules can be captured as Skills: organizational naming conventions, subdomain standards, and third-party supplier lists can be reused directly next time.

Step 4: Internal Correlation (CMDB / Owner)

If CMDB is integrated:

• Match: external discovery x internal registration -> distinguish "registered" assets from "shadow assets"
• Owner: when a shadow asset is found, automatically infer the likely responsible team / owner
• Enrich: for assets not in CMDB, infer ownership from WHOIS / certificate subject where possible

Step 5: Risk Tagging

Optional but recommended:

• Query threat intelligence for each asset, such as whether an IOC has been associated before
• Query vulnerability intelligence for exposed ports / components, such as a CVE in a certain Nginx version
• Check certificate status, such as expiring soon / self-signed / weak algorithm

Step 6: Output Report

Typical report structure:

• Overview: total assets, new assets, risky assets
• Asset list: supports filtering by multiple dimensions
• Risk asset Top N: assets requiring priority handling
• Change list, for continuous tracking tasks: diff between this run and the previous run

Real Case Walkthrough: Asset Discovery for threatbook.cn

Stage	Rex action	Notes
Input	Seed domain threatbook.cn	Expand from one point
Discovery	Calls ThreatBook assets + FOFA + certificate transparency logs in parallel	Gets a batch of subdomains + IPs
Deduplicate and merge	Same IP returned with different tags by multiple sources -> merge	Use field union and strict verdict
Classification	Official website / blog / docs site / admin backend / CDN / third-party	Based on naming conventions and Banner
Internal correlation	Match CMDB, none in this example -> all treated as "known assets"	Real projects can usually match 80-90%
Risk tagging	Certificate status normal; no IP hits in threat intelligence; if an exposed admin backend exists, mark it as key attention	Transparent evidence chain
Output	Markdown report + JSON	Ready to deliver
Follow-up	Recommend converting to a "weekly asset diff task" that pushes additions / disappearances / changes to WeCom automatically	Upgrade one-off discovery into continuous operations

Output Example

# threatbook.cn Internet Asset Discovery Report

## Overview
- Total assets: 42
- Subdomains: 28
- Exposed IPs: 11
- Web services: 21
- Key attention: 1 (admin backend directly exposed to the internet)

## Classification View
- Official Website: www.threatbook.cn, ...
- Product console: console.threatbook.cn
- Documentation: docs.threatbook.cn
- API: api.threatbook.cn
- CDN: xxx.cdn.*
- Third-party hosting: <identified SaaS>

## Risk List
| Asset | Risk | Recommendation |
| --- | --- | --- |
| xxx.threatbook.cn | Old component version has CVE-2024-xxxx | Upgrade or take offline |

Continuous Operation: Asset Diff Tasks

The most valuable part of asset discovery is not one-off scanning, but continuous tracking:

• Weekly / daily task: rerun discovery and compare with the baseline
• New asset alert: newly launched assets become visible immediately
• Disappeared asset alert: assets that were online suddenly go offline, which may be decommissioning or a fault
• Changed asset alert: certificates changed, Banner changed, ports changed; these are risk signals

These tasks are attached to Task Center. New / changed assets are automatically pushed to the WeCom duty group.

Relationship with Other Scenarios

Downstream scenario	Linkage
Threat Intelligence and IOC Triage	Reverse-check each exposed IP / domain through intelligence
Alert Triage	Check whether a target asset in an alert belongs to your organization
Vulnerability management, not a separate page	Asset + version information -> match vulnerability intelligence

Boundaries and FAQ

Question	Handling
Discovery results are noisy and include assets not owned by the organization	Capture judgment rules in a Skill: IP ownership, certificate subject, DNS SOA, and similar evidence
Assets missed by one discovery platform	Cross-check multiple sources; add WHOIS + certificate transparency logs if needed
Shadow assets are discovered but no one claims them	Create a dedicated "no owner" section in the report to drive process registration
Large enterprise with too many assets, tens of thousands	Slice by business / department and avoid one full pass; consider distributed Workflow if needed
Discovery platform API quota	Write rate limits in a Skill; use a cache layer for continuous tasks
Only ports are found, no Banner	Let Rex use the browser tool to actively visit the port and enrich Banner. See Browser Automation
Compliance / legal boundaries	Flocks does not perform external offensive scanning. All asset discovery is based on public discovery data and data sources authorized by the organization

---

Related Resources: Scenario Overview · Threat Intelligence and IOC Triage · Internal Security Product Integration · Browser Automation · Task Center