Request demo

Continuous Scanning

Watch Each Asset Change Layer by Layer.

Monitored domains, subdomains and IP addresses are scanned layer by layer, from WHOIS and DNS to open ports and web data, and each layer’s results are kept as dated snapshots.

That turns an inventory into a record of what changed, on which layer, and when. A new certificate, an edited DNS record or a port that opened since the last scan arrives as an event your team can act on.

Request demo

Scanall checked

api.acme.example 198.51.100.40 · monitored

  1. WHOISwhois

    acme.example · unchanged

    09-17 → 09-24

  2. IP WHOISipwhois

    AS64500 · owner unchanged

    09-17 → 09-24

  3. DNSdns

    A 198.51.100.40 · unchanged

    09-17 → 09-24

  4. SSLssl

    certificate replaced · new issuer, new expiryasset_ssl_changed

    09-17 → 09-24

    changed

  5. Port scanport_scan

    8443/tcp newly opennew_open_port_detected

    09-17 → 09-24

    High

  6. Web datawebdata

    nginx 1.25 · unchanged

    09-17 → 09-24

  7. HTTPhttp

    200 · headers unchanged

    09-17 → 09-24

Route
  • instantly
  • hourly
  • daily
  • weekly
  • monthly

All layers checked · 2 changes

From a Scan to an Event.

  1. 01

    Collect

    Each asset in the monitored inventory is scanned across WHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP. There is no scan window to book and nothing to install.

  2. 02

    Record

    Each layer’s result is stored as its own snapshot with a check date, next to the earlier snapshots of that layer.

  3. 03

    Compare

    The new snapshot is compared with the previous one. A difference that matters, such as a new certificate or a newly open port, becomes an event.

  4. 04

    Route

    Notification rules send events to the people you choose, instantly or as an hourly, daily, weekly or monthly digest. Findings move on to detection and scoring.

Each Layer Keeps Its History.

Each layer keeps its own snapshots. Reverse DNS (PTR) records for IP addresses get a history of their own, and each history lists its snapshots by check date.

HistoryWhat each snapshot holdsAPI path
WHOISRegistrar, registration and expiry dates, name servers, registrant where publishedwhois-history
IP WHOISASN, network owner and country of an IP addressipwhois-history
IP DNS (PTR)The name an IP address resolves back toipdns-history
DNSA, AAAA, MX, NS, SOA, TXT and other record typesdns-history
SSLThe certificate served: issuer, validity and the names it coversssl-history
Port scanTCP and UDP ports with their state and protocolport-scan-history
Web dataPage content, technologies, headers, login pages and screenshotswebdata-history
HTTPResponse headers and status codeshttp-history

Paths sit under /easm/assets/{asset_id}/. Each list returns snapshot ids and check dates, newest first, and each snapshot can be retrieved by its id.

Changes a Static Inventory Never Shows.

An exposure often starts as a change nobody reviewed. These are the changes the Deepinfo Platform raises as their own events or tracks as trends.

Certificate Changes

A new issuer, a name added to or dropped from the certificate, a new expiry date. Raised as asset_ssl_changed.

WHOIS Changes

A new registrar, new name servers or a moved expiry date, sometimes an early sign of a transfer or a lapsing registration. Raised as asset_whois_changed.

DNS Changes

A new MX host, an edited TXT record, a different set of name servers. Raised as asset_dns_changed.

Newly Open Ports

A service answering on a port that was not open on the previous scan. Raised as new_open_port_detected.

Technology Changes

A framework added, removed or running a different version, visible between web data snapshots. The technology count timeline tracks the total per asset.

New Subdomains

Hosts appearing under a monitored domain, raised as new_asset_discovered and counted in the subdomain count timeline.

Scan Now or Read Any Past State.

Your team never has to schedule a scan, but any asset can be scanned on demand from the asset view or through the API. An open-port scan can also run immediately and return its result in the same response, which is useful for confirming a firewall change before the ticket is closed.

For the past, list an asset’s SSL snapshots, pick a check date and read the certificate it served that day. Each history works this way. Timelines return the security score, issue and vulnerability severity, and the technology, website, subdomain and open-port counts over time.

Asset SSL History referencePlatform guide: Asset details
# Start an on-demand scan of one asset
curl -X POST \
  "https://api.deepinfo.com/v1/easm/assets/ASSET_ID/instant-scan" \
  -H "apikey: YOUR_API_KEY"

# pending, queued, monitoring, issue_queued, finished or failed
curl "https://api.deepinfo.com/v1/easm/assets/ASSET_ID/instant-scan-status" \
  -H "apikey: YOUR_API_KEY"

Where Scanning’s Output Goes Next.

EASM Asset Discovery Where the assets being scanned come from. Read EASM Risk Detection How snapshots become issues with a severity. Read EASM Remediation Every issue, from first seen to verified gone. Read

Query This Data Through the API

The subdomains, DNS records, certificates, ports and technologies this module finds come from Deepinfo’s own index. Your developers can query it through the API.

Questions About Continuous Scanning

Do we have to schedule scans?

No. An asset is scanned automatically once it joins the monitored inventory, whether discovery proposed it or your team added it, one by one or in bulk through the API. You can still scan any asset on demand.

How often is an asset rescanned?

On a recurring schedule that Deepinfo sets, without anyone on your team triggering it.

Can a change slip through between two scans?

It shows up at the next check. Monitoring is periodic, and each layer’s history records when each check ran; when a change can’t wait, scan the asset on demand.

Can a scan disrupt our hosts?

Standard monitoring runs no authenticated scans, no exploit attempts and no load tests, from infrastructure Deepinfo operates. It reaches only what a host already exposes to the internet.

Can we see what an asset looked like on a past date?

Yes. Each history lists its snapshots with their check dates, and any snapshot can be retrieved in full by its id through the API.

Which changes can send a notification?

Certificate, WHOIS and DNS changes, newly open ports and newly discovered assets each have their own event, alongside new and reappeared issues, new vulnerabilities and security score changes. Each rule picks its recipients and a frequency: instant, hourly, daily, weekly or monthly.

What happens when we remove an asset from monitoring?

Its scans stop, and it moves to a list of deleted assets with the date it was removed, which the EASM API can search.

Watch Your Attack Surface Change Over Time.

Book a demo and we’ll walk through an asset’s history with you.

Request demo