defender-easm

Microsoft Defender EASM

Defender External Attack Surface Management (EASM) builds and maintains a continuous, outside-in inventory of an organization's internet-facing footprint and surfaces risks on those assets — expired SSL certs, exposed admin interfaces, end-of-life web tech, and known CVEs — without any agent or credentials.

When to use

• You don't have a complete list of internet-facing assets (most orgs don't).
• M&A: rapid discovery of an acquired company's internet footprint before integration.
• Subsidiary / shadow IT discovery — assets registered to anyone, deployed anywhere.
• Continuous monitoring of certificate expiration, exposed services, deprecated software.

Do not use this skill for internal asset posture (defender-for-cloud-hardening), endpoint vulnerability management (defender-for-endpoint), or generic SOC hunting (sentinel-detection-engineering).

How discovery works

EASM starts from seeds — known domains, IPs, ASNs, contacts (WHOIS), or organization names — and walks outward through DNS, WHOIS, certificate transparency logs, ASN data, and web crawling to discover related assets. Findings are placed in:

State	Meaning
Approved Inventory	Confirmed yours; counts toward pricing
Candidate	Discovered but unconfirmed; review and approve/dismiss
Dependency	Used by your assets but not owned (CDN, third-party API)
Monitor Only	Tracked but not yours (e.g., a partner)

Rule of thumb: Start with 5–10 high-confidence seeds. Trust the discovery chain; don't try to add every domain manually — you'll miss the unknown unknowns.

Approach

1. Seed selection. Start with primary brand domains, top-2 ASN numbers, and a few key email-domain WHOIS contacts. Avoid generic CDN domains as seeds (massive false positives).

2. Initial discovery run (24–72 hours). Review Candidates weekly for the first month. Approve real ones; dismiss false positives with a reason (used to refine discovery).