> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.
# External Surface Intelligence
> See what your organisation exposes to the internet, and work the findings raised against it
Infrawatch sees the entire internet every day. External Surface Intelligence
(ESI) aims that at one organisation: yours, or one you depend on. Declare the
assets that belong to it, and every daily observation of those assets becomes a
finding you can work.
That applies as readily to a supplier as to yourself. The same inventory and
detectors run against a vendor, a subsidiary, or an acquisition target, so the
supply-chain risk you inherit is visible on the same terms as your own exposure,
without waiting on a questionnaire.
## What we find
Names still pointing at infrastructure you no longer control, followed to
the end of the chain and grouped by provider.
Look-alike domains scored by similarity, with a screenshot of what each one
actually serves.
Credential material found exposed on the surface, matched by fingerprint.
MCP servers, LLM gateways, model runtimes, and agent endpoints exposed on
your surface.
ESI is scoped to a project. Open the project that represents the organisation
you are protecting, then work inside it.
## The workspace
| Section | What it answers |
| ------------- | -------------------------------------------------------- |
| Dashboard | How large is the surface, and what changed recently |
| Findings | Everything raised across all detectors, in one queue |
| Inventory | What do we own, and what is waiting for review |
| DNS risks | Which names point at infrastructure we no longer control |
| Typosquatting | Who is imitating our domains and brands |
| Secrets | What credential material has leaked onto the surface |
| AI surface | What AI exposure do we have |
Sections appear only when your access allows them, so a read-only analyst and a
project manager see different workspaces.
## Start with the inventory
Detectors only raise findings against assets in scope, so everything here
follows from the inventory. Add the domains, addresses, ranges, and brands you
can name, import the rest in bulk, and review the candidates Infrawatch
discovers for you.
Asset kinds, bulk import, the review queue, and the brand context that feeds
impersonation detection.
## Review findings
Every detector normalises to one finding row with the same lifecycle, so the
actions are learned once and used everywhere.
| Status | Meaning |
| ---------------- | ----------------------------- |
| `open` | Newly raised, not yet triaged |
| `accepted` | Real, and accepted as-is |
| `resolved` | The exposure has been fixed |
| `ignored` | Not worth acting on |
| `false_positive` | The detector was wrong |
Reopening a finding returns it to `open` and clears the resolved metadata. DNS
risks add one extra state, `acknowledged`, for a name you have seen but not yet
dealt with.
Select a batch and apply one status to as many as 500 findings at once. The
batch is atomic: if a single identifier falls outside the active project, the
whole request fails and nothing changes.
Findings carry a severity, which is what you triage by:
| Severity | Response |
| ------------- | -------------------------- |
| Critical | Act now |
| High | Act this cycle |
| Moderate | Plan the fix |
| Low | Track it |
| Informational | Context, no action implied |
Each detector has its own page covering the evidence it collects and how to
triage it. Typosquatting candidates and secret exposures are detector-owned:
you cannot create one by hand, but you work them through the same lifecycle as
everything else.
## Access
ESI access resolves from your organisation, group, entitlement, credential, and
project authorization together. An API key is limited to the project ceiling of
the account that owns it.
| Scope | Grants |
| ---------------------- | ----------------------------------------------- |
| `esi.inventory.manage` | Add, update, approve, ignore, and import assets |
| `esi.services.manage` | Create, update, and delete curated services |
| `esi.findings.view` | Read findings, including secrets |
| `esi.findings.manage` | Apply lifecycle actions and delete findings |
Project managers keep access without those scopes, but manager access never
widens what an API key can do. Check the project capabilities endpoint to see
what the current credential actually has before building a workflow on it.
ESI requests are rate-limited and consume monthly quota.
Keep the surface, its findings, and analyst notes together.
Inspect the inventory, service, and finding endpoints with full schemas.