Application Discovery FAQ: Scope, Requests, and Results
How does Application Discovery relate to Source Intelligence?
Section titled “How does Application Discovery relate to Source Intelligence?”Application Discovery maps the estate, so you know what is out there to test. Source Intelligence maps a single application’s code, so NightVision knows how to test it. See the comparison.
Is a discovery run a scan?
Section titled “Is a discovery run a scan?”No. Enumeration reads public records. Probing makes ordinary HTTP requests and, on hosts that belong to the estate, requests six well-known paths that reveal misconfiguration when readable. There is no fuzzing, no authentication, no port scanning and no payloads. See What discovery sends.
Do I need to allowlist anything, or notify my hosting provider?
Section titled “Do I need to allowlist anything, or notify my hosting provider?”Usually not. Traffic comes from NightVision’s AWS infrastructure and amounts to a handful of requests per host. If your WAF rate-limits unfamiliar sources aggressively, hosts may appear dead that are not; the run’s source coverage panel is worth checking in that case.
Why is a domain I do not recognize in my inventory?
Section titled “Why is a domain I do not recognize in my inventory?”It is probably an unconfirmed related domain, marked Unconfirmed beside its
name and hidden by the default Live & confirmed filter. See
How hosts relate to the domain.
Why did my run find so few related domains?
Section titled “Why did my run find so few related domains?”Related-domain discovery works from the company name, and a privacy-shielded registration can leave NightVision unable to derive one. Re-run the domain with Company name filled in; it is remembered for later runs.
Most of my inventory is hosts that do not answer. Is that wrong?
Section titled “Most of my inventory is hosts that do not answer. Is that wrong?”No, that is what a real estate looks like: certificate transparency logs remember every hostname a certificate was ever issued for. The Live & confirmed filter is on by default for that reason, and dead hosts are kept because a name that resolves again later is a change worth seeing.
The run says done but the screen is still working. Why?
Section titled “The run says done but the screen is still working. Why?”Classification and breach-record counting happen after the run has stored its
report. The inventory is complete as soon as the status reads done; those two
phases add to it. See
After the report.
Why is a host in the Untriaged tab?
Section titled “Why is a host in the Untriaged tab?”It has not been classified yet, or classification could not decide (Unknown),
or it resolves but serves nothing (Dead/parked). If the banner’s count is
falling on its own, classification is still working.
What does the asterisk next to an exposure score mean?
Section titled “What does the asterisk next to an exposure score mean?”The score is provisional: the host has not been classified yet, or was classified with low confidence. See Provisional scores.
Is the exposure score a vulnerability?
Section titled “Is the exposure score a vulnerability?”No. It is scored by fixed rules from what discovery can see from the outside, and says how much attention a host deserves, not that anything is wrong with it. Scanning is how you find out. See How exposure is decided.
What is the breach records number?
Section titled “What is the breach records number?”How many records in a third-party breach and infostealer corpus mention the hostname in the last 90 days. Only the count is retrieved. It is not a count of accounts and should not be summed across hosts. See Breach records.
Why is my run marked partial?
Section titled “Why is my run marked partial?”It stopped before finishing: it was cancelled, or it hit the 5,000-host or 60-minute cap. See Partial runs.
Can I run discovery on a schedule?
Section titled “Can I run discovery on a schedule?”Not yet. Runs are started manually.
How many runs can I have going at once?
Section titled “How many runs can I have going at once?”Two per workspace, and one per domain.
Does creating a target start a scan?
Section titled “Does creating a target start a scan?”No. The dialog offers to start scans once the targets exist, and any covered host has Start scan in its row. See Creating targets from discovery.
Who can run discovery?
Section titled “Who can run discovery?”Organization Admin or Project Manager to start a run on a new domain; Scan Operator or above to re-run a tracked one. See Availability.
I do not see Discovery in the sidebar.
Section titled “I do not see Discovery in the sidebar.”It is on for team workspaces on a Professional or Enterprise plan, and off for personal workspaces and trials. Contact NightVision if you think your workspace should have it.
I see Discovery, but not the Run discovery button.
Section titled “I see Discovery, but not the Run discovery button.”On the Discovery list page the button needs permission to change a project, and a project to put the inventory in. On a domain’s own page it needs only the discovery permission. When the button is present but disabled, its tooltip says whether the plan or the workspace’s entitlement is holding it.