View asset inventory

The Inventory displays all assets discovered during EASM scans, so you can search, filter, and manage your external attack surface by asset type and findings. Use this view to search and filter assets, review asset details, monitor security findings, and perform bulk actions on multiple assets.

Prerequisites

• You must have a UI user account with the Security Lead or Reviewer role.

Get access to the Inventory

The Inventory displays a comprehensive list of all discovered assets.

To complete this task:

1. Sign in to the Veracode Platform.
2. Select Scans and Analysis > EASM.
3. From the top-left corner of the screen, select the project you want to review.
4. Select Inventory or the inventory icon .

View assets by category

At the top of the Inventory, four category sections organize your discovered assets with count badges for each type:

• Asset things: core applications and services exposed on your external attack surface.
• DNS & TLS things: domain infrastructure and Transport Layer Security protocols supporting your assets.
• Web observation things: web content and configurations discovered during scanning operations.
• Stack & third-party things: software components and external dependencies integrated into your environment.

To complete this task:

1. Open the Inventory.
2. At the top of the page, review the four category sections: Asset things, DNS & TLS things, Web observation things, and Stack & third-party things.
3. Within each category section, view the asset type buttons with counts.
4. To apply a filter in the Inventory, select an asset type button. The table updates to show only the assets of the selected type.

Search and filter assets

Search and filter to locate specific assets or narrow the results to your criteria.

Search for assets

Enter search terms to locate assets by name, domain, IP address, or other identifying information.

To complete this task:

1. Open the Inventory.
2. In the search bar at the top of the page, enter your search criteria. The table updates as you type, so you can quickly locate the asset you need.

Filter by asset type

Narrow results by selecting specific asset categories.

To complete this task:

1. Open the Inventory.
2. Select an asset type tab (such as Domains, Web Apps, DNS Records, IPs, Certificates, URLs, Headers, Cookies, Scripts, Script Variants, Software Components, Vendor Connections, or Vulnerabilities). The table updates to show only the assets of the selected type.

View asset details

Each asset displays key information in a table format. Use this information to assess asset status and associated findings.

Asset table columns

The Inventory displays the following information for each asset:

• Grade: risk grade based on the asset's security posture.
• Type: asset category (for example, Domain, Web App, IP).
• Name: the asset identifier (for example, domain name, IP address, FQDN).
• Relation: related assets or dependencies.
• Findings: security issues detected for the asset, color-coded by severity.
• Owner: the person or team responsible for the asset.
• New: indicator showing whether the asset was newly discovered in the most recent scan.
• Last seen: date when the asset was last detected during scanning.

Review asset details in the Passport view

When you select an asset from the Inventory, the Passport view opens and displays detailed information organized into tabs. Each tab provides a different perspective of your asset's security posture and relationships.

View asset overview and attack surface metrics

The Overview tab provides a high-level summary of the asset's security status and properties.

• Attack surface: displays a radial chart showing the asset's attack surface score across different dimensions such as Data Risk (DBF), Social Security (SSS), Remote Technical Services (RTS), Email Security (ESP), and Directory Control (DCT). The center shows the aggregate attack surface score.
• This thing: lists core information such as asset type, owner, last observed date, company, domain registrar, and business unit assignment.
• Parent: shows whether the asset has a parent domain or FQDN relationship in the asset graph. If no parent exists, this section displays "No domain or FQDN parent in this graph."
• Hosted on: displays hosting infrastructure information. If no hosting information exists, this section displays "No hosting infrastructure in this graph."
• Discovered from: shows the discovery source that identified the asset. If there is no discovery source, this section displays "No discovery source in this graph."
• Things discovered from this: shows the count of related assets discovered from this asset, grouped by category (FQDNs, Web applications, DNS records).

To complete this task:

1. Open the Inventory.
2. Select the desired asset from the table. The Passport view opens.
3. In the Passport view, the Overview tab opens by default.
4. Review the displayed information to assess the asset's security posture and relationships.

Review security findings for an asset

Access detailed information about security findings associated with each asset.

• Findings list: displays all security findings detected for the asset, organized by:
  • Source: finding origin or category
  • Priority action: recommended urgency level (Fix now, Review, Monitor)
  • Type: finding classification (Classic Finding, Custom Finding, or other types)
  • Indicator name: the specific name of the security issue detected
  • Evidence: summary of supporting evidence for the finding
  • Solution: recommended remediation steps
• Finding detail panel: when you select a specific finding, a detail panel displays:
  • Complete finding description
  • Evidence details with specific technical information
  • Recommended remediation guidance
  • Related findings on the same asset

To complete this task:

1. Open the Inventory.
2. Select the desired asset from the table. The Passport view opens.
3. In the Passport view, select the Findings tab.
4. Review the findings list and select a specific finding to view:
   • Finding name and description
   • Severity level
   • Remediation recommendations
   • Related assets impacted by the same finding

Monitor asset compliance and cyber hygiene controls

The Discovery & Cyber Hygiene tab displays security findings and check results (Pass or Fail), where you can also add custom tags to organize assets.

To complete this task:

1. Open the Inventory.
2. Select the desired asset from the table. The Passport view opens.
3. In the Passport view, select the Discovery & Cyber Hygiene tab.
4. Review findings and check results to assess the asset's security posture.
5. Optionally, select + Add tag to add custom tags (for example, "crown-jewel", "pci-scope") for asset management.

Explore related assets and dependencies

The Related things tab displays assets connected to your selected asset, organized by type (FQDNs, Web applications, DNS records, and others).

To complete this task:

1. Open the Inventory.
2. Select the desired asset from the table. The Passport view opens.
3. In the Passport view, select the Related things tab.
4. Select any related asset to view its Passport view.

Understanding the Attack Surface Score

The Attack Surface Score is calculated using an algorithm that considers the following seven key vectors. These vectors help determine the level of exposure for each application and support the prioritization of security measures.

• Security mechanisms: identifies whether the application uses HTTP, HTTPS, or a combination of both.
• Page creation method: assesses whether the application is built using server-side, client-side, or mixed technologies.
• Degree of distribution: evaluates the number of pages and external or internal connections associated with the application.
• Authentication: detects the presence of login or authentication mechanisms.
• Input vectors: identifies whether the application includes input fields, such as forms, for user interaction.
• Active content: determines the use of internal, external, or embedded scripts.
• Cookies: measures the number of cookies used by the application.