These guides start with a security decision and end with a stored or reviewable result. Each guide identifies required access, exact endpoints, state, and stopping conditions.

​
Exposure management

Zero-day exposure

Combine vulnerability, exploit, KEV, EPSS, and observed-asset evidence.

Attack-surface drift

Compare a stored baseline with current hosts, services, products, and certificates.

OEM scan lifecycle

Queue, resume, poll, and retain the terminal result of an authorized OEM scan.

Post-deployment exposure

Compare explicit port policy only after scan completion and fresh indexed evidence.

Certificate monitoring

Review expiry windows, issuers, DNS names, hostname validity, and stale observations.

Cloud decommissioning

Compare before-state and post-scan evidence without treating missing data as proof.

​
Security operations

SOC IOC enrichment

Normalize IP, Tor, reverse-host, passive DNS, and registration context.

Brand impersonation

Build a stateful review queue for phishing and typosquatting candidates.

Alert-to-ticket delivery

Deduplicate Enterprise alerts and checkpoint only accepted downstream events.

Credential-exposure response

Create privacy-reduced incidents without storing returned password values.

Historical exposure

Preserve current, historical, passive DNS, and certificate evidence in one case bundle.

​
Platform and partner operations

Enterprise and MSSP onboarding

Map a tenant to an organization, register scope, and store an initial baseline.

OEM tenant metering

Attribute usage with query tags, audit logs, and account credit checks.

Agent-assisted research

Use MCP search, fetch, and named tools with evidence and safety controls.

Package vulnerability monitoring

Poll recent advisories, deduplicate aliases, and retain affected version ranges.

M&A exposure assessment

Separate candidate domains from verified ownership before passive enrichment.
For shorter implementation patterns, see Workflow Recipes.

​
Before production

  • Verify endpoint access with /auth/status.
  • Store the API key outside source code.
  • Define pagination, retry, timeout, and deduplication behavior.
  • Preserve source timestamps and separate API observations from analysis.
  • Enforce authorized scope before any active scan.
  • Define a maximum request, page, polling, and credit budget for each run.