Skip to main content
An Asset is any discovered entity — a domain, IP address, or service — that makes up your attack surface. Assets are produced by asset discovery and scanning processes and form a continuously updated inventory of what is exposed. You can reach the module from the console sidebar under Attack surface → Assets. Assets give you visibility into what is actually reachable on the internet, letting your team monitor, analyze, and secure infrastructure effectively.
Assets are automatically generated from discovery and scanning jobs and cannot be created manually.

​
What an asset contains

An asset is an entity with an evolving set of attributes observed over time:
  • Services — host and port combinations, such as oasm.dev:8443
  • Technologies — detected software, frameworks, and services (e.g. Cloudflare, HSTS)
  • Certificates — TLS/SSL certificate state for the asset
  • Screenshots — visual captures of web-based services
  • Status codes — HTTP response codes observed on services
  • IP addresses and ports — where the asset is reachable
The asset record aggregates these observations, so a single asset gives you its services, the technologies those services run, and the TLS state of each.

​
Data sources

Assets and their observations come from multiple discovery and scanning sources. Each record notes the type of scan that discovered it. For example, subdomain enumeration discovers domains and IP addresses, while HTTP probing and screenshots produce observations about specific services. Some observations are about the entity itself, while others describe a specific service it runs.

​
Auto enable assets

Whether newly discovered assets are immediately usable is controlled by the Auto enable assets toggle in workspace settings:
  • Enabled — newly discovered assets become active immediately, without manual review. This keeps the inventory fully automated and current.
  • Disabled — newly discovered assets are registered but waiting for review, pending manual approval. You approve them before they are treated as part of the active attack surface.
With Auto enable assets disabled, discovery still runs and records everything it finds, but the resulting assets wait in a pending state until a user enables them. Use this when you want a review gate before new assets join the active inventory.

​
Explore assets

The Assets page lists every asset in your workspace. Each row in the table shows: Use the search bar to find assets by name or attribute, and the Filter value input to filter by a specific value such as an IP, port, or host.

​
Filter assets

At the top of the page, filter buttons narrow the inventory by:
  • IP — filter by IP address
  • Port — filter by port number
  • Technology — filter by detected technology
  • Status Code — filter by HTTP response code
  • Host — filter by host or hostname
  • TLS Host — filter by TLS host
  • Date — filter by observation time
Pagination keeps the list manageable as the inventory grows. Combine filters with search and the Filter value input to pivot to exactly the slice of the attack surface you need.

​
View modes

Assets can be examined from different perspectives using the view modes: Each mode is the same inventory seen through a different lens. For example, the Technologies view aggregates which technologies are used where, and the TLS view surfaces certificates and their state across assets. The Graph view renders assets and their relationships visually for exploration.

​
Activation states

An asset is either active or waiting for review, and the workspace’s Auto enable assets setting decides what happens to newly discovered assets:
  • Auto enable assets ON — every newly discovered asset becomes active immediately, with no manual step. The inventory stays fully automated.
  • Auto enable assets OFF — newly discovered assets land in the inventory as inactive and wait for a review gate before they count as part of the active attack surface.
With auto-enable off, discovery continues to record everything it finds — services, technologies, certificates — but the assets remain pending until a user reviews and activates them. Use this mode when new inventory should be vetted before it is scanned, grouped, or used in workflows.

​
Working with the inventory

1

Navigate to Assets

Open Attack surface → Assets to see the full inventory table.
2

Filter and search

Use the filter buttons (IP, Port, Technology, Status Code, Host, TLS Host, Date), the search bar, and the Filter value input to narrow the list.
3

Inspect observations

Review each service’s screenshot, detected technologies, certificate state, and last observed time directly in the table.
4

Pivot with view modes

Switch between Services, Hosts, Ports, IP Addresses, Technologies, Status Code, TLS, and Graph to analyze the inventory from different angles.

​
Common questions

An asset is the entity itself — a domain, IP, or host. A service is a specific observation on that entity, such as an HTTP probe result on oasm.dev:8443. Technologies, screenshots, and probes attach to the service level, while subdomain and port-scan results attach to the asset level.
Technologies (e.g. Cloudflare, HSTS) reveal what stack each service runs. That is the basis for attack-surface reasoning — end-of-life frameworks, exposed admin panels, and missing hardening headers all become visible from the Technologies view.
Assets reflect the last observed state. Observations update on subsequent discovery runs, and the TIME column shows when each observation was recorded. If the inventory looks stale, re-run discovery on the target that produced the asset.
It shows the TLS/SSL certificate state for the service — a key input for identifying expired, self-signed, or misconfigured certificates across the inventory. The TLS view aggregates assets by this state.

​
How assets update

Assets reflect the current observed state of your attack surface, not just your configured targets:
  • Assets are continuously updated as new discovery and scan jobs run
  • Status codes, technologies, and TLS state may change over time
  • Historical observations remain useful for trend analysis on the dashboard
Because every asset traces back to a target and the jobs that discovered it, you can always answer “where did this come from?” and “when was it last seen?”.

Targets

Assets are discovered from targets — define the scope first.

Dashboard

Monitor asset growth and trends across your workspace.

Search

Find assets and related findings across the workspace.

Groups

Organize assets into named collections to scope discovery and workflows.

​
API

Everything available in the console is also available through the API — see the API Reference tab.