Attack surface
The attack surface discovered by the campaign's network scan events: the exposed assets and the main services reachable on them, at a glance.
This tab presents the technical information gathered through the campaign's network scan events, for the selected simulation. The same results are available in three views, chosen with the
table, map and matrix buttons above them; the active view is highlighted in purple. The search field stays active in all three views, and the information can be exported as a CSV file. The sort control of the search bar only applies to the table view.
Table view
The table shows one row per IP address: the IP address, the hostname of the machine when it could be retrieved, the number of open ports and the list of the open port numbers, shown as grey pills. Click the chevron at the start of a row to expand the address and see, port by port, the information disclosed by the service reachable on that port.
A button next to the CSV export expands or collapses all the rows of the current page.
The table is paginated; you can order it by IP address or by port number, filter the information, and search for a specific entry.
Four key indicators above the table summarize the detected perimeter:
- IP addresses detected
- Open ports detected
- Distinct ports detected
- Most frequent port , with the number of hosts on which it was identified (if several ports are tied, they are all listed)
Map view
The map shows the Attack Vector at the center and one circle for each IP address on which at least one open port was found. Circles are sized according to the number of open ports, so the most exposed hosts stand out.
Click a circle to open a detail panel on the right: the IP address, the hostname when it is known, the number of open ports, then the list of ports in ascending order, each with its service name when it is identified.
On the left, the list of all the open ports lets you filter the map. Each port shows how many times it was seen, and its service name is the one conventionally associated with the port number. Click one or several ports to keep only the hosts that expose at least one of them: selecting SMB and RDP shows the hosts exposing either.
To stay readable, the map shows every host up to 50 IP addresses. Beyond that, it shows the 50 most exposed hosts (those with the most open ports) and a permanent message says so: use the port filter or the table view to see the full list.
Matrix view
The matrix shows the structure of your exposure: which ports are open on which hosts, and above all which combinations of ports repeat from one host to another.
Hosts are the rows, identified by their IP address, and ports are the columns. A cell is solid purple when the port is open and its service identified, light purple when the port is open but its service is not identified, and grey when the port is closed or was not detected; a legend sits above the grid. Hovering a cell highlights its whole row and column.
By default, columns are sorted by the number of hosts exposing the port and rows by their number of open ports. This gathers common port combinations in dense blocks and makes anomalies stand out. A selector switches to a numeric sort, with ports and IP addresses in ascending order.
A Total column gives each host's number of open ports, and a Hosts per port row gives the number of hosts exposing each port. The grid keeps the 30 most frequent ports and folds the others into an Other column; a note below the grid states how many ports are folded, and the detail panel lists the folded ports of the selected host, so nothing is hidden silently.
Click a row to select a host: the detail panel on the right shows the same information as in the map view, and the selection is kept when you switch between the two views. Click a port header to bring the hosts exposing that port to the top, and click it again to cancel; no host is hidden. Search and filters recalculate the grid and all the totals.
With fewer than 5 hosts, the matrix shows a message pointing to the table view instead of a grid.