You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/external-attack-surface-management/using-and-managing-discovery.md
+23-17Lines changed: 23 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,7 +24,8 @@ We recommend that you search for your organization's attack surface before you c
24
24
25
25
When you first access your Defender EASM instance, select **Getting Started** in the **General** section to search for your organization in the list of automated attack surfaces. Then choose your organization from the list and select **Build my Attack Surface**.
26
26
27
-
:::image type="content" source="media/Discovery_1.png" alt-text="Screenshot that shows a preconfigured attack surface selection screen.":::
27
+

28
+
28
29
29
30
At this point, the discovery runs in the background. If you selected a preconfigured attack surface from the list of available organizations, you're redirected to the dashboard overview screen where you can view insights into your organization's infrastructure in Preview mode.
30
31
@@ -44,47 +45,51 @@ Custom discoveries are organized into discovery groups. They're independent seed
44
45
45
46
1. On the leftmost pane, under **Manage**, select **Discovery**.
46
47
47
-
:::image type="content" source="media/Discovery_2.png" alt-text="Screenshot that shows a Defender EASM instance on the overview page with the Manage section highlighted.":::
48
+

48
49
49
-
1. The **Discovery** page shows your list of discovery groups by default. This list is empty when you first access the platform. To run your first discovery, select **Add Discovery Group**.
50
+
2. The **Discovery** page shows your list of discovery groups by default. This list is empty when you first access the platform. To run your first discovery, select **Add Discovery Group**.
50
51
51
-
:::image type="content" source="media/Discovery_3.png" alt-text="Screenshot that shows the Discovery screen with Add Discovery Group highlighted.":::
52
+

52
53
53
-
1. Name your new discovery group and add a description. The **Recurring Frequency** field allows you to schedule discovery runs for this group by scanning for new assets related to the designated seeds on a continuous basis. The default recurrence selection is **Weekly**. We recommend this cadence to ensure that your organization's assets are routinely monitored and updated.
54
+
3. Name your new discovery group and add a description. The **Recurring Frequency** field allows you to schedule discovery runs for this group by scanning for new assets related to the designated seeds on a continuous basis. The default recurrence selection is **Weekly**. We recommend this cadence to ensure that your organization's assets are routinely monitored and updated.
54
55
55
56
For a single, one-time discovery run, select **Never**. We recommend that you keep the **Weekly** default cadence and instead turn off historical monitoring within your discovery group settings if you later decide to discontinue recurrent discovery runs.
56
57
57
-
1. Select **Next: Seeds**.
58
+
4. Select **Next: Seeds**.
59
+
60
+

58
61
59
-
:::image type="content" source="media/Discovery_4.png" alt-text="Screenshot that shows the first page of the discovery group setup.":::
60
62
61
-
1. Select the seeds that you want to use for this discovery group. Seeds are known assets that belong to your organization. The Defender EASM platform scans these entities and maps their connections to other online infrastructure to create your attack surface.
63
+
5. Select the seeds that you want to use for this discovery group. Seeds are known assets that belong to your organization. The Defender EASM platform scans these entities and maps their connections to other online infrastructure to create your attack surface.
64
+
65
+

62
66
63
-
:::image type="content" source="media/Discovery_5.png" alt-text="Screenshot that shows the seed selection page of the discovery group setup.":::
64
67
65
68
The **Quick Start** option lets you search for your organization in a list of prepopulated attack surfaces. You can quickly create a discovery group based on the known assets that belong to your organization.
69
+
70
+

66
71
67
-
:::image type="content" source="media/Discovery_6.png" alt-text="Screenshot that shows the prebaked attack surface selection page output in a seed list.":::
68
-
69
-
:::image type="content" source="media/Discovery_7.png" alt-text="Screenshot that shows the prebaked attack surface selection page.":::
72
+

70
73
74
+
71
75
Alternatively, you can manually input your seeds. Defender EASM accepts organization names, domains, IP blocks, hosts, email contacts, ASNs, and Whois organizations as seed values.
72
76
73
77
You can also specify entities to exclude from asset discovery to ensure they aren't added to your inventory if detected. For example, exclusions are useful for organizations that have subsidiaries that will likely be connected to their central infrastructure, but don't belong to their organization.
74
78
75
79
After your seeds are selected, select **Review + Create**.
76
80
77
-
1. Review your group information and seed list and select **Create & Run**.
81
+
6. Review your group information and seed list and select **Create & Run**.
82
+
83
+

78
84
79
-
:::image type="content" source="media/Discovery_8.png" alt-text="Screenshot that shows the Review + Create screen.":::
80
85
81
86
You're taken back to the main Discovery page that displays your discovery groups. After your discovery run is finished, you see new assets added to your approved inventory.
82
87
83
88
### View and edit discovery groups
84
89
85
90
You can manage your discovery groups from the main **Discovery** page. The default view displays a list of all your discovery groups and some key data about each one. From the list view, you can see the number of seeds, recurrence schedule, last run date, and created date for each group.
86
91
87
-
:::image type="content" source="media/Discovery_9.png" alt-text="Screenshot that shows the discovery groups screen.":::
92
+

88
93
89
94
Select any discovery group to view more information, edit the group, or kickstart a new discovery process.
90
95
@@ -94,7 +99,8 @@ The discovery group details page contains the run history for the group. This se
94
99
95
100
Run history is organized by the seed assets that were scanned during the discovery run. To see a list of the applicable seeds, select **Details**. A pane opens on the right of your screen that lists all the seeds and exclusions by kind and name.
96
101
97
-
:::image type="content" source="media/discovery-10.png" alt-text="Screenshot that shows the run history for the discovery group screen.":::
102
+

103
+
98
104
99
105
### View seeds and exclusions
100
106
@@ -108,7 +114,7 @@ The source name is the value that was input in the appropriate type box when you
108
114
109
115
When you input seeds, remember to validate the appropriate format for each entry. When you save the discovery group, the platform runs a series of validation checks and alerts you of any misconfigured seeds. For example, IP blocks should be input by network address (for example, the start of the IP range).
110
116
111
-
:::image type="content" source="media/Discovery_11.png" alt-text="Screenshot that shows the Seeds view of a discovery page.":::
117
+

0 commit comments