# Continuous Scanning

URL: https://www.deepinfo.com/platform/easm/continuous-scanning/

## Watch Each Asset Change Layer by Layer.

Monitored domains, subdomains and IP addresses are scanned layer by layer, from WHOIS and DNS to open ports and web data, and each layer’s results are kept as dated snapshots.

That turns an inventory into a record of what changed, on which layer, and when. A new certificate, an edited DNS record or a port that opened since the last scan arrives as an event your team can act on.

[Request demo](https://www.deepinfo.com/request-demo/)

### From a Scan to an Event.

1. **Collect**

   Each asset in the monitored inventory is scanned across WHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP. There is no scan window to book and nothing to install.
2. **Record**

   Each layer’s result is stored as its own snapshot with a check date, next to the earlier snapshots of that layer.
3. **Compare**

   The new snapshot is compared with the previous one. A difference that matters, such as a new certificate or a newly open port, becomes an event.
4. **Route**

   Notification rules send events to the people you choose, instantly or as an hourly, daily, weekly or monthly digest. Findings move on to detection and scoring.

### Each Layer Keeps Its History.

Each layer keeps its own snapshots. Reverse DNS (PTR) records for IP addresses get a history of their own, and each history lists its snapshots by check date.

| History | What each snapshot holds | API path |
| --- | --- | --- |
| WHOIS | Registrar, registration and expiry dates, name servers, registrant where published | `whois-history` |
| IP WHOIS | ASN, network owner and country of an IP address | `ipwhois-history` |
| IP DNS (PTR) | The name an IP address resolves back to | `ipdns-history` |
| DNS | A, AAAA, MX, NS, SOA, TXT and other record types | `dns-history` |
| SSL | The certificate served: issuer, validity and the names it covers | `ssl-history` |
| Port scan | TCP and UDP ports with their state and protocol | `port-scan-history` |
| Web data | Page content, technologies, headers, login pages and screenshots | `webdata-history` |
| HTTP | Response headers and status codes | `http-history` |

Paths sit under `/easm/assets/{asset_id}/`. Each list returns snapshot ids and check dates, newest first, and each snapshot can be retrieved by its id.

### Changes a Static Inventory Never Shows.

An exposure often starts as a change nobody reviewed. These are the changes the Deepinfo Platform raises as their own events or tracks as trends.

#### Certificate Changes

A new issuer, a name added to or dropped from the certificate, a new expiry date. Raised as `asset_ssl_changed`.

#### WHOIS Changes

A new registrar, new name servers or a moved expiry date, sometimes an early sign of a transfer or a lapsing registration. Raised as `asset_whois_changed`.

#### DNS Changes

A new MX host, an edited TXT record, a different set of name servers. Raised as `asset_dns_changed`.

#### Newly Open Ports

A service answering on a port that was not open on the previous scan. Raised as `new_open_port_detected`.

#### Technology Changes

A framework added, removed or running a different version, visible between web data snapshots. The technology count timeline tracks the total per asset.

#### New Subdomains

Hosts appearing under a monitored domain, raised as `new_asset_discovered` and counted in the subdomain count timeline.

### Scan Now or Read Any Past State.

Your team never has to schedule a scan, but any asset can be scanned on demand from the asset view or through the API. An open-port scan can also run immediately and return its result in the same response, which is useful for confirming a firewall change before the ticket is closed.

For the past, list an asset’s SSL snapshots, pick a check date and read the certificate it served that day. Each history works this way. Timelines return the security score, issue and vulnerability severity, and the technology, website, subdomain and open-port counts over time.

[Asset SSL History reference](https://docs.deepinfo.com/reference/easm/asset-ssl-history-list/) · [Platform guide: Asset details](https://docs.deepinfo.com/guide/easm/asset-details/)

Instant scan:

```bash
# Start an on-demand scan of one asset
curl -X POST \
  "https://api.deepinfo.com/v1/easm/assets/ASSET_ID/instant-scan" \
  -H "apikey: YOUR_API_KEY"

# pending, queued, monitoring, issue_queued, finished or failed
curl "https://api.deepinfo.com/v1/easm/assets/ASSET_ID/instant-scan-status" \
  -H "apikey: YOUR_API_KEY"
```

SSL history:

```bash
# Snapshots recorded for one asset, newest first
curl "https://api.deepinfo.com/v1/easm/assets/ASSET_ID/ssl-history" \
  -H "apikey: YOUR_API_KEY"

# One snapshot, by the id the list returned
curl "https://api.deepinfo.com/v1/easm/assets/ASSET_ID/ssl-history/HISTORY_ID" \
  -H "apikey: YOUR_API_KEY"
```

### Where Scanning’s Output Goes Next.

- [Asset Discovery](https://www.deepinfo.com/platform/easm/smart-asset-discovery/) (EASM): Where the assets being scanned come from.
- [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/) (EASM): How snapshots become issues with a severity.
- [Remediation](https://www.deepinfo.com/platform/easm/remediation-with-actionable-insights/) (EASM): Every issue, from first seen to verified gone.

### Query This Data Through the API

The subdomains, DNS records, certificates, ports and technologies this module finds come from Deepinfo’s own index. Your developers can query it through the API.

- [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/)
- [DNS Lookup API](https://www.deepinfo.com/data-api/apis/dns-lookup/)
- [SSL Lookup API](https://www.deepinfo.com/data-api/apis/ssl-lookup/)
- [Port Scan API](https://www.deepinfo.com/data-api/apis/port-scan/)
- [Technology Lookup API](https://www.deepinfo.com/data-api/apis/technology-lookup/)
- [All Subdomains Feed](https://www.deepinfo.com/data-api/feeds/all-subdomains/)

### Questions About Continuous Scanning

**Do we have to schedule scans?**

No. An asset is scanned automatically once it joins the monitored inventory, whether discovery proposed it or your team added it, one by one or in bulk through the API. You can still scan any asset on demand.

**How often is an asset rescanned?**

On a recurring schedule that Deepinfo sets, without anyone on your team triggering it.

**Can a change slip through between two scans?**

It shows up at the next check. Monitoring is periodic, and each layer’s history records when each check ran; when a change can’t wait, scan the asset on demand.

**Can a scan disrupt our hosts?**

Standard monitoring runs no authenticated scans, no exploit attempts and no load tests, from infrastructure Deepinfo operates. It reaches only what a host already exposes to the internet.

**Can we see what an asset looked like on a past date?**

Yes. Each history lists its snapshots with their check dates, and any snapshot can be retrieved in full by its id through the API.

**Which changes can send a notification?**

Certificate, WHOIS and DNS changes, newly open ports and newly discovered assets each have their own event, alongside new and reappeared issues, new vulnerabilities and security score changes. Each rule picks its recipients and a frequency: instant, hourly, daily, weekly or monthly.

**What happens when we remove an asset from monitoring?**

Its scans stop, and it moves to a list of deleted assets with the date it was removed, which the [EASM API](https://docs.deepinfo.com/reference/easm/deleted-asset-search/) can search.

### Watch Your Attack Surface Change Over Time.

Book a demo and we’ll walk through an asset’s history with you.

[Request demo](https://www.deepinfo.com/request-demo/)