Skip to content

Commit 2ce231e

Browse files
Update using-and-managing-discovery.md
1 parent 415ed20 commit 2ce231e

File tree

1 file changed

+23
-17
lines changed

1 file changed

+23
-17
lines changed

articles/external-attack-surface-management/using-and-managing-discovery.md

Lines changed: 23 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,8 @@ We recommend that you search for your organization's attack surface before you c
2424

2525
When you first access your Defender EASM instance, select **Getting Started** in the **General** section to search for your organization in the list of automated attack surfaces. Then choose your organization from the list and select **Build my Attack Surface**.
2626

27-
:::image type="content" source="media/Discovery_1.png" alt-text="Screenshot that shows a preconfigured attack surface selection screen.":::
27+
![Screenshot that shows a preconfigured attack surface selection screen.](media/Discovery_1.png)
28+
2829

2930
At this point, the discovery runs in the background. If you selected a preconfigured attack surface from the list of available organizations, you're redirected to the dashboard overview screen where you can view insights into your organization's infrastructure in Preview mode.
3031

@@ -44,47 +45,51 @@ Custom discoveries are organized into discovery groups. They're independent seed
4445

4546
1. On the leftmost pane, under **Manage**, select **Discovery**.
4647

47-
:::image type="content" source="media/Discovery_2.png" alt-text="Screenshot that shows a Defender EASM instance on the overview page with the Manage section highlighted.":::
48+
![Screenshot that shows a Defender EASM instance on the overview page with the Manage section highlighted.](media/Discovery_2.png)
4849

49-
1. The **Discovery** page shows your list of discovery groups by default. This list is empty when you first access the platform. To run your first discovery, select **Add Discovery Group**.
50+
2. The **Discovery** page shows your list of discovery groups by default. This list is empty when you first access the platform. To run your first discovery, select **Add Discovery Group**.
5051

51-
:::image type="content" source="media/Discovery_3.png" alt-text="Screenshot that shows the Discovery screen with Add Discovery Group highlighted.":::
52+
![Screenshot that shows the Discovery screen with Add Discovery Group highlighted.](media/Discovery_3.png)
5253

53-
1. Name your new discovery group and add a description. The **Recurring Frequency** field allows you to schedule discovery runs for this group by scanning for new assets related to the designated seeds on a continuous basis. The default recurrence selection is **Weekly**. We recommend this cadence to ensure that your organization's assets are routinely monitored and updated.
54+
3. Name your new discovery group and add a description. The **Recurring Frequency** field allows you to schedule discovery runs for this group by scanning for new assets related to the designated seeds on a continuous basis. The default recurrence selection is **Weekly**. We recommend this cadence to ensure that your organization's assets are routinely monitored and updated.
5455

5556
For a single, one-time discovery run, select **Never**. We recommend that you keep the **Weekly** default cadence and instead turn off historical monitoring within your discovery group settings if you later decide to discontinue recurrent discovery runs.
5657

57-
1. Select **Next: Seeds**.
58+
4. Select **Next: Seeds**.
59+
60+
![Screenshot that shows the first page of the discovery group setup.](media/Discovery_4.png)
5861

59-
:::image type="content" source="media/Discovery_4.png" alt-text="Screenshot that shows the first page of the discovery group setup.":::
6062

61-
1. Select the seeds that you want to use for this discovery group. Seeds are known assets that belong to your organization. The Defender EASM platform scans these entities and maps their connections to other online infrastructure to create your attack surface.
63+
5. Select the seeds that you want to use for this discovery group. Seeds are known assets that belong to your organization. The Defender EASM platform scans these entities and maps their connections to other online infrastructure to create your attack surface.
64+
65+
![Screenshot that shows the seed selection page of the discovery group setup.](media/Discovery_5.png)
6266

63-
:::image type="content" source="media/Discovery_5.png" alt-text="Screenshot that shows the seed selection page of the discovery group setup.":::
6467

6568
The **Quick Start** option lets you search for your organization in a list of prepopulated attack surfaces. You can quickly create a discovery group based on the known assets that belong to your organization.
69+
70+
![Screenshot that shows the prebaked attack surface selection page output in a seed list.](media/Discovery_6.png)
6671

67-
:::image type="content" source="media/Discovery_6.png" alt-text="Screenshot that shows the prebaked attack surface selection page output in a seed list.":::
68-
69-
:::image type="content" source="media/Discovery_7.png" alt-text="Screenshot that shows the prebaked attack surface selection page.":::
72+
![Screenshot that shows the prebaked attack surface selection page.](media/Discovery_7.png)
7073

74+
7175
Alternatively, you can manually input your seeds. Defender EASM accepts organization names, domains, IP blocks, hosts, email contacts, ASNs, and Whois organizations as seed values.
7276

7377
You can also specify entities to exclude from asset discovery to ensure they aren't added to your inventory if detected. For example, exclusions are useful for organizations that have subsidiaries that will likely be connected to their central infrastructure, but don't belong to their organization.
7478

7579
After your seeds are selected, select **Review + Create**.
7680

77-
1. Review your group information and seed list and select **Create & Run**.
81+
6. Review your group information and seed list and select **Create & Run**.
82+
83+
![Screenshot that shows the Review + Create screen.](media/Discovery_8.png)
7884

79-
:::image type="content" source="media/Discovery_8.png" alt-text="Screenshot that shows the Review + Create screen.":::
8085

8186
You're taken back to the main Discovery page that displays your discovery groups. After your discovery run is finished, you see new assets added to your approved inventory.
8287

8388
### View and edit discovery groups
8489

8590
You can manage your discovery groups from the main **Discovery** page. The default view displays a list of all your discovery groups and some key data about each one. From the list view, you can see the number of seeds, recurrence schedule, last run date, and created date for each group.
8691

87-
:::image type="content" source="media/Discovery_9.png" alt-text="Screenshot that shows the discovery groups screen.":::
92+
![Screenshot that shows the discovery groups screen.](media/Discovery_9.png)
8893

8994
Select any discovery group to view more information, edit the group, or kickstart a new discovery process.
9095

@@ -94,7 +99,8 @@ The discovery group details page contains the run history for the group. This se
9499

95100
Run history is organized by the seed assets that were scanned during the discovery run. To see a list of the applicable seeds, select **Details**. A pane opens on the right of your screen that lists all the seeds and exclusions by kind and name.
96101

97-
:::image type="content" source="media/discovery-10.png" alt-text="Screenshot that shows the run history for the discovery group screen.":::
102+
![Screenshot that shows the run history for the discovery group screen.](media/Discovery_10.png)
103+
98104

99105
### View seeds and exclusions
100106

@@ -108,7 +114,7 @@ The source name is the value that was input in the appropriate type box when you
108114

109115
When you input seeds, remember to validate the appropriate format for each entry. When you save the discovery group, the platform runs a series of validation checks and alerts you of any misconfigured seeds. For example, IP blocks should be input by network address (for example, the start of the IP range).
110116

111-
:::image type="content" source="media/Discovery_11.png" alt-text="Screenshot that shows the Seeds view of a discovery page.":::
117+
![Screenshot that shows the Seeds view of a discovery page.](media/Discovery_11.png)
112118

113119
### Exclusions
114120

0 commit comments

Comments
 (0)