How Assets are Detected and Identified

The following information is used to detect active systems, identify assets that are online, and measure the amount of usage (e.g., more DNS lookups indicate higher usage and importance):

• Attribution data
• Internet scans
• Passive DNS lookups
• Sinkhole data
• Systems responding to internet scans confirm activity

Learn more about the network mapping process.

Offline Assets

An asset is considered to be offline if it is not reachable. This is determined with the following checks on the assets associated with the findings:

• If the asset is IP-based, we check if the IP:port is reachable.

• If the asset is domain-based, we check if the DNS resolves and if it does, we check if the IP:ports associated with the domain are reachable.

  Example: If a domain has findings in ports 80 and 443, the domain and both ports are checked.