Use these recipes during workflow design. Follow the linked guide when you need runnable code, state handling, and failure behavior.

​
MSSP multi-tenant onboarding

Sequence: create Enterprise organization → add authorized domains and public IP ranges → list entities and assets → collect alerts and vulnerabilities. Store the FullHunt organization ID beside the MSSP tenant ID. Enforce tenant isolation before every request, and test deletion and asset reassignment behavior before production onboarding. Output: tenant inventory, onboarding status, initial baseline time, and unresolved ownership questions. Implement Enterprise or MSSP onboarding

​
Merger and acquisition due diligence

Sequence: organizations database search → Nexus domain collection → domain and host details → certificates → WHOIS → vulnerability intelligence. Treat results as observable external evidence, not a security rating of the company. Record uncertain ownership, shared hosting, and stale records separately. Output: externally observable domains and hosts, certificate relationships, registration context, material exposed services, and evidence timestamps. Implement M&A external exposure assessment

​
Package advisory monitoring

Sequence: vulnerability advisories search by ecosystem and package → vulnerability search by alias CVE → exploit search → recent feed. Store advisory source IDs and aliases to prevent duplicate tickets for the same issue. Compare affected and fixed version ranges with your software inventory outside FullHunt. Output: package, affected range, fixed version, aliases, exploit evidence, and owner. Implement package vulnerability monitoring

​
Certificate-based shadow asset discovery

Sequence: Enterprise certificates or Nexus cloud certificates → extract subject alternative names → domain details → host details → ownership review. Do not automatically add every certificate name to an organization. Shared infrastructure and historical names require review. Output: candidate name, certificate identifier, issuer, first seen, last seen, ownership disposition, and related host evidence. Implement certificate expiry and issuer monitoring

​
Cloud decommissioning verification

Sequence: stored pre-decommission baseline → current host details → OEM historical hosts → OEM alerts → certificate search. Check that the old service is no longer externally reachable and that DNS, certificates, and cloud endpoints no longer expose the legacy name. A missing current record alone does not prove decommissioning. Output: removed services, remaining DNS or certificate references, observation times, and final reviewer approval. Implement cloud decommissioning verification

​
OEM scan orchestration

Sequence: validate authorized scope → queue OEM scan → persist scan_id → poll status → query timestamped indexed observations. Treat queue completion and indexed-data freshness as separate conditions. Resume an existing non-terminal scan instead of automatically creating another one. Output: submitted target, tenant tags, scan ID, terminal state, completion time, and follow-up evidence. Implement the OEM scan lifecycle

​
Alert delivery

Sequence: retrieve Enterprise alerts by organization and date window → normalize → deliver with an idempotency key → checkpoint after acceptance. Keep ticket state in the downstream case system. FullHunt’s alerts endpoint does not acknowledge or close tickets. Output: alert evidence, organization, delivery outcome, downstream ticket ID, owner, and disposition. Implement alert-to-ticket delivery

​
Sector-wide exposure research

Sequence: Global Search filters → product or technology intelligence → vulnerability intelligence → aggregate results by sector-defined grouping. Use this only for passive research or an authorized monitoring mandate. Avoid publishing named organizations or exposures without a validated disclosure process. Output: query definition, dataset cutoff, aggregate counts, limitations, and reproducible filters.