Skip to main content
Inventory is the list of things that belong to the organisation. Everything else in External Surface Intelligence follows from it: detectors only raise findings against assets in scope, so the quality of the inventory sets the quality of everything downstream. You are never starting from a blank page. Add what you know, and Infrawatch brings you candidates it found for the rest.

​
What counts as an asset

The workspace groups assets into five categories: Underneath, each asset has a specific kind: domain, subdomain, ip_address, ip_block, asn, ssl_certificate, brand_name, page, or contact.

​
Add inventory

1

Add what you already know

Create assets directly for the domains, addresses, ranges, and brands you can name without research. These are manual assets and are approved from the moment you add them.
2

Import the rest in bulk

Import a file to load a larger surface in one pass. The importer accepts .csv, .txt, .log, and .json, and extracts hostnames, single IPv4 and IPv6 addresses, and IPv4 and IPv6 ranges from it.The upload is queued durably before the request returns, so you poll it for status rather than waiting. A file containing no supported assets is rejected outright instead of being partly applied.
3

Review what Infrawatch discovers

Discovery files assets it believes are yours as candidates. They sit under Needs review until a human decides, because an inventory that grows without review stops meaning anything.
4

Add brands last

A brand asset is what turns on impersonation detection, and it works better once the domains it should be compared against are already in place.
Bulk creation through the API supports on_conflict=fail, which is atomic. A single conflicting or invalid row leaves the whole batch unapplied, so you can correct the file and retry without creating duplicates.

​
Review the queue

The review state is the daily loop: Approve a candidate to bring it into the surface, or mark it monitored to approve and actively watch it. Ignoring one is recorded rather than deleted, which is the point: a rejected candidate stays rejected instead of returning as new the next time discovery runs. The full set of statuses an asset can hold is candidate, approved, monitored, ignored, archived, and removed.
Work the queue to empty rather than perfectly. An ignored asset is cheap to revisit, while a candidate left undecided suppresses nothing and clutters every count on the dashboard.

​
Brand assets

A brand_name asset carries the context impersonation detection needs, and it is worth filling in properly: These feed typosquatting directly. A brand with its aliases and favicons recorded gives the detector far more to match than a bare domain, and the difference shows up as fewer missed look-alikes rather than as anything visible on this page. Assets filter by category and review state, and the workspace exposes group counts, review-state counts, and hostname facets so you can narrow a large surface without scrolling it.

​
Access

Adding, updating, approving, ignoring, and importing assets all require the esi.inventory.manage scope, or project manager access. Reading the inventory does not.

External surface overview

How inventory, findings, and the workspace fit together.

Typosquatting

What your brands and domains are compared against.