easm-review-attack-surface

EASM: Review Attack Surface

Keywords

attack surface, external exposure, easm findings, exposed services, vulnerabilities, lookalike domains, external risk, shadow IT discovery, internet-facing assets, security posture, easm audit

Overview

Review the organization's external attack surface by retrieving EASM findings, analyzing exposed services and vulnerabilities, checking for lookalike domains (phishing indicators), and generating a prioritized risk report. EASM provides visibility into internet-facing assets that may not be known to the security team.

Use this skill when: A security administrator wants to review the organization's external exposure, check for new findings, investigate specific vulnerabilities, or detect lookalike domains used for phishing.

---

Workflow

Follow this 5-step process to review the external attack surface.

Step 1: List EASM Organizations

zeasm_list_organizations()
```text

EASM can monitor multiple organizations or business units. Note:

- Organization ID and name
- Monitored domains/assets
- Last scan date

If multiple organizations exist, confirm which one to review.

---

### Step 2: Retrieve Findings

```text
zeasm_list_findings(organization_id="<org_id>")
```text

This returns all findings across the attack surface. Each finding includes:

- Finding type (exposed service, vulnerability, misconfiguration, certificate issue)
- Severity (Critical, High, Medium, Low, Informational)
- Asset affected (domain, IP, subdomain)
- Discovery date
- Current status

**For detailed information on a specific finding:**

```text
zeasm_get_finding_details(organization_id="<org_id>", finding_id="<finding_id>")
```text

**For scan evidence:**

```text
zeasm_get_finding_evidence(organization_id="<org_id>", finding_id="<finding_id>")
```text

**For complete scan output:**

```text
zeasm_get_finding_scan_output(organization_id="<org_id>", finding_id="<finding_id>")
```text

---

### Step 3: Check for Lookalike Domains