> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Inventory

> Declare what the organisation owns, review what Infrawatch discovers, and keep the surface accurate

Inventory is the list of things that belong to the organisation. Everything else
in External Surface Intelligence follows from it: detectors only raise findings
against assets in scope, so the quality of the inventory sets the quality of
everything downstream.

You are never starting from a blank page. Add what you know, and Infrawatch
brings you candidates it found for the rest.

## What counts as an asset

The workspace groups assets into five categories:

| Category     | What it holds                                        |
| ------------ | ---------------------------------------------------- |
| Hostnames    | Root domains and hostnames                           |
| IPs          | Individual hosts and ranges                          |
| Certificates | TLS certificates and their subject alternative names |
| Brands       | Brand names to watch for across the internet         |
| All          | The complete surface                                 |

Underneath, each asset has a specific kind: `domain`, `subdomain`,
`ip_address`, `ip_block`, `asn`, `ssl_certificate`, `brand_name`, `page`, or
`contact`.

## Add inventory

<Steps>
  <Step title="Add what you already know">
    Create assets directly for the domains, addresses, ranges, and brands you
    can name without research. These are manual assets and are approved from
    the moment you add them.
  </Step>

  <Step title="Import the rest in bulk">
    Import a file to load a larger surface in one pass. The importer accepts
    `.csv`, `.txt`, `.log`, and `.json`, and extracts hostnames, single IPv4 and
    IPv6 addresses, and IPv4 and IPv6 ranges from it.

    The upload is queued durably before the request returns, so you poll it for
    status rather than waiting. A file containing no supported assets is
    rejected outright instead of being partly applied.
  </Step>

  <Step title="Review what Infrawatch discovers">
    Discovery files assets it believes are yours as candidates. They sit under
    **Needs review** until a human decides, because an inventory that grows
    without review stops meaning anything.
  </Step>

  <Step title="Add brands last">
    A brand asset is what turns on impersonation detection, and it works better
    once the domains it should be compared against are already in place.
  </Step>
</Steps>

<Note>
  Bulk creation through the API supports `on_conflict=fail`, which is atomic. A
  single conflicting or invalid row leaves the whole batch unapplied, so you can
  correct the file and retry without creating duplicates.
</Note>

## Review the queue

The review state is the daily loop:

| State        | Meaning                                   |
| ------------ | ----------------------------------------- |
| Needs review | Discovered, and requires a human decision |
| Ignored      | Rejected, but retained in the inventory   |
| All          | Everything in scope                       |

Approve a candidate to bring it into the surface, or mark it monitored to
approve and actively watch it. Ignoring one is recorded rather than deleted,
which is the point: a rejected candidate stays rejected instead of returning as
new the next time discovery runs.

The full set of statuses an asset can hold is `candidate`, `approved`,
`monitored`, `ignored`, `archived`, and `removed`.

<Tip>
  Work the queue to empty rather than perfectly. An ignored asset is cheap to
  revisit, while a candidate left undecided suppresses nothing and clutters
  every count on the dashboard.
</Tip>

## Brand assets

A `brand_name` asset carries the context impersonation detection needs, and it
is worth filling in properly:

| Attached to a brand | What it does                                                                   |
| ------------------- | ------------------------------------------------------------------------------ |
| Terms               | Strings, aliases, subsidiaries, and brand markers, deduplicated per brand      |
| Favicons            | Favicon observations, which catch a copied site even when its text has changed |
| Links               | `associated_with` relationships to other assets in the inventory               |

These feed [typosquatting](/external-surface/typosquatting) directly. A brand
with its aliases and favicons recorded gives the detector far more to match than
a bare domain, and the difference shows up as fewer missed look-alikes rather
than as anything visible on this page.

## Filter and search

Assets filter by category and review state, and the workspace exposes group
counts, review-state counts, and hostname facets so you can narrow a large
surface without scrolling it.

## Access

Adding, updating, approving, ignoring, and importing assets all require the
`esi.inventory.manage` scope, or project manager access. Reading the inventory
does not.

<CardGroup cols={2}>
  <Card title="External surface overview" icon="https://mintcdn.com/infrawatch/gCEz_Bv1hOrMPG8n/images/products/esi.svg?fit=max&auto=format&n=gCEz_Bv1hOrMPG8n&q=85&s=ebc334425db0ee423bdf03e1348a066c" href="/external-surface/overview" width="32" height="32" data-path="images/products/esi.svg">
    How inventory, findings, and the workspace fit together.
  </Card>

  <Card title="Typosquatting" icon="clone" href="/external-surface/typosquatting">
    What your brands and domains are compared against.
  </Card>
</CardGroup>