Security Workflows

FullHunt provides data and scan operations. Production workflows also need orchestration, state, approvals, and downstream delivery in your application.

​

Priority workflows

​

Operational workflows

​

Improve common implementations

​

Continuous asset discovery

Start with verified seed domains and public IP ranges. Store a baseline, then compare hosts, services, products, and TLS names between runs. A scheduled job belongs in your application; FullHunt does not create a scheduler from an API request. Success metrics should include new authorized assets reviewed, unknown assets assigned an owner, and unresolved changes. Do not measure only the total number of discovered hosts.

​

Certificate monitoring

Use Enterprise entities and assets to inspect certificate validity and issuer fields. Use Enterprise certificates and Nexus cloud certificates to discover related names. Detect:

• Certificates approaching an organization-defined expiry window
• Unexpected subject alternative names or issuers
• Certificates first observed after the previous run
• Names that may reveal a shadow or forgotten service

Store each certificate identifier and last-seen value. Send notifications from your own ticketing, email, or workflow system. See Certificate Monitoring.

​

Domain and IP intelligence

Treat results as infrastructure enrichment. Preserve the API evidence, collection time, and query. Avoid binary malicious verdicts unless a returned source explicitly supports one.

​

Dark-web exposure

Define the exact dataset and query type before collecting records. Deduplicate by stable record fields, redact credential values, restrict access, and connect new findings to an incident-response process. Do not describe every result as a breach of the monitored organization. Use Credential Response for a collector that excludes password values from state and output.

​

Vulnerability management

Separate two questions:

1. What does vulnerability intelligence say about the CVE, exploitability, and affected products?
2. Which authorized external assets have matching observed evidence?

Use CISA Known Exploited Vulnerabilities (KEV), Exploit Prediction Scoring System (EPSS), exploit availability, exposure, and asset context as transparent inputs. Do not replace them with an undocumented risk score.

​

Compliance evidence

FullHunt can supply dated evidence about external assets, certificates, alerts, and vulnerabilities. It does not certify compliance with PCI DSS, SOC 2, ISO 27001, or another framework. Map retained fields to your own control and evidence requirements.

​

Executive reporting

Use metrics that can be traced to API records:

• New and removed external assets
• New externally visible services
• CISA KEV matches on observed assets
• Certificates inside the expiry window
• New impersonation candidates
• Open alerts by age and owner

​

Deployment verification

Use FullHunt after deployment to verify external exposure. Standard and Enterprise scan requests are asynchronous and do not expose status polling. OEM provides scan status for workflows that require a terminal state. Use Post-Deployment Verification to separate scan completion from indexed-data freshness and policy evaluation.

​

Additional workflow recipes

See Workflow Recipes for concise endpoint sequences and links to their full implementations.

​

Capability boundaries

FullHunt does not document source-code, Terraform, or CloudFormation parsing. It also does not provide social-media monitoring through the documented APIs. Use post-deployment exposure verification and domain impersonation monitoring instead of claiming those capabilities.