Attack Surface (ASM)¶
Audience: Client users whose organization holds an External Network license (the same
license that covers external pentests also enables Attack Surface monitoring) ·
Where: Attack Surface in the sidebar (/attack-surface).
Licensed feature
If your org doesn't have the External Network license, the Attack Surface item won't appear in your nav. The same license that covers external pentests enables Attack Surface monitoring — see Licenses & Credits.
Overview¶
Attack Surface Management (ASM) is Canima's continuous, outside-in monitoring of everything your organization exposes to the internet — domains, subdomains, IPs, services, and the risks attached to them. Unlike a point-in-time assessment, ASM runs on a schedule and alerts you when things change (a new host appears, a DNS record moves, a credential leaks).
The tabs at a glance¶
ASM uses a two-row tab bar: a top row of groups, and a second row with the pages inside the selected group.
| Group | Pages | What it's for |
|---|---|---|
| Overview | — | Your external-risk overview: KPI tiles, severity distribution, monitors, and recent alerts. |
| Inventory | Discovery, Assets | Triage newly discovered assets, see how your estate connects, and manage what's monitored. |
| Monitoring | Monitors, Alerts, History | What ASM is watching, the change feed, and the event log. |
| Threats | Breaches, Phishing Domains, Vulnerabilities | Leaked credentials, look-alike domains, and externally detected vulnerabilities. |
| Config | — | Defines what ASM monitors: scope, blacklists, and breach settings. |
Overview¶
Your external-risk overview. KPI tiles show Root Assets (top-level domains, IP ranges, and standalone IPs — the rows on the Assets page; hostnames found beneath them aren't counted), Attack Surface Vulnerabilities, Unacknowledged Alerts, and an ASM Security Score (with trend). Below:
- Vulnerability Severity Distribution and Risk & Compliance (open findings past your SLA targets, same idea as the main Dashboard).
- Monitors — the scheduled scanners and their cadence (vulnerability scanning, Google dorks, phishing domains, breach data, CVE alerts, port scanning, DNS).
- Asset Growth Trend, Top Risk Assets — Attack Surface, and Recent Alerts.
If ASM isn't set up yet, a Configure ASM button takes you to Config.
Inventory¶
Triage new discoveries. Newly discovered assets don't enter your inventory automatically. When some are waiting, a banner reads "N discovered assets awaiting review" — click Review to open the Discoveries Awaiting Review panel. For each asset (or several at once — select rows to act on them together) choose:
| Action | What it does |
|---|---|
| Add | Puts the asset in your Asset Library without monitoring it. |
| Add & Monitor | Also monitors it, using one ASM slot on your license. |
| Ignore | Hides it and excludes it from all scans and pentests. |
Shared-edge assets. IPs that belong to shared CDN infrastructure are not scanned directly; their hostnames are still tested through the CDN. Expand Show shared-edge assets to see them. Use Add & Monitor on one only if you control that edge (for example, you own the CDN tenant).
First full scan. Right after onboarding, managers and owners see a one-time banner: add and monitor the assets you want scanned, then click Run initial scan now. Otherwise the first full scan runs in the next scheduled window.
Map. The Attack Surface card is a visual map of how domains, subdomains, and IP ranges connect. Toggle Topology vs Tree, use Fit to view, and Export PNG.
Attack Surface Assets lists the external assets you've added from discovery (new discoveries wait on the Discovery page). Filter by Type, Status, and Monitoring. The actions on each row depend on its state:
- Monitor — start monitoring an added asset (uses one ASM slot, where eligible).
- Stop monitoring — frees the slot and permanently deletes the asset's alerts, breach records, and monitoring history. The asset stays in your library, unmonitored. This can't be undone.
- Ignore — hides the asset and blocks all future scans and pentests against it.
- Stop ignoring — managers and owners can bring an ignored asset back (also available from Show ignored in the Asset Library).
For your full inventory across every engagement type, use the Asset Library.
Monitoring¶
What ASM is watching: tiles for Monitored assets, Awaiting review, and Services discovered, then:
- A monitors table — Monitor, Status, Schedule, Last run, Next run. Status is Enabled, Disabled, Paused (license) (the covering license lapsed — see Licenses & Credits), or Not scheduled.
- A table of discovered services (host, port, service, product, first/last seen).
- Any sensitive-content (Google-dork) results.
ASM Alerts is the change feed: DNS-record changes, new/changed device fingerprints, newly exposed services, and so on. Each alert explains what changed and why it matters. Use Search alerts… and the Severity, Type, and Status (Open / Acknowledged) filters. Acknowledge alerts one at a time, or click Acknowledge all matching to acknowledge every open alert that matches the current filters (you'll be asked to confirm).
The Activity Log of ASM events (scans, asset/service changes, new vulnerabilities, breach-data updates) with Search activity… and a Type filter, plus an Average Time to Fix trend.
Threats¶
The Breaches & Dark Web view: credentials belonging to your domains found in known third-party breaches and dark-web dumps (see Breach Monitoring under Config for how this is filtered). Tiles highlight Total Breaches, Employee Passwords Exposed, and the Most Recent Breach. Search by email, domain, or source and filter by Classification, Source, and Password status. The Stored as column shows how the leaked password was stored (for example Cleartext, bcrypt, NTLM). Refresh pulls in records found since the list was last loaded.
Possible Phishing Domains: look-alike/typo-squat domains flagged against your watched TLDs. Each row shows the Phishing domain, the domain it Resembles, its Status, Source (DNS confirmed or Threat intel), and first/last seen. Tiles count New, Takedown requested, Taken down, and Total.
Work each candidate through triage with Set status:
| Status | Use it when |
|---|---|
| New | Not looked at yet (default). |
| Reviewing | Someone is investigating. |
| Benign | It's legitimate or harmless (e.g. a parked domain you're not worried about). |
| False positive | It doesn't actually resemble your brand. |
| Takedown requested | You've asked a registrar/host to remove it. |
| Taken down | It's gone. |
Open a candidate to see what it Resolves to (with a link to find that IP in your assets), when its status last changed, and a Notes field for your team.
Attack-surface findings: tiles for Total Findings, Critical Vulnerabilities, and the ASM Security Score, then a filterable, exportable table (Search findings…, severity/status/category) with a detail page per issue. These findings also appear in the organization-wide Findings list.
Config¶
Defines what ASM monitors. Under Scope Configuration you set the Top-Level Domains (TLDs) to watch (required), plus optional IP Addresses and CIDR Ranges. Blacklists (optional) exclude Domains, Subdomains, IP Addresses, or CIDR Ranges from monitoring. Breach Monitoring controls how leaked-credential intel is ingested — by default only credentials on your own domains appear; toggle Include consumer credentials to also surface personal-email breaches (useful when executives reuse personal accounts).
The first time you save, the button reads Start Monitoring; after that it's Update Configuration.
Scope changes apply going forward only
Removing a TLD, IP, or CIDR does not delete already-discovered assets — they keep being monitored. To stop monitoring one, use Stop monitoring or Ignore on Inventory → Assets.
Tips¶
Working ASM effectively
- Start on Overview, clear Discovery regularly so new assets get monitored (or ignored), then work Alerts — acknowledging alerts keeps the feed meaningful so real changes stand out.
- Set your TLDs accurately in Config — everything ASM discovers flows from that scope.
- Breaches and Phishing Domains are early-warning signals; act on them before they turn into an incident, and use phishing statuses so your team knows what's handled.
- ASM does not produce a formal PDF report; its findings live in these dashboards. For a formal deliverable, run an assessment.
Related: Asset Library · Home Dashboard · Findings · Licenses & Credits