Automated Asset Discovery

FortWatch combines multiple passive and active techniques to enumerate subdomains: certificate transparency logs, public DNS datasets, search-engine indexes, reverse DNS, NSEC/NSEC3 walking where applicable, and brute-force resolution against curated wordlists. Every candidate is then validated with live DNS resolution and HTTP probing so your inventory only contains subdomains that actually exist and respond.

That's exactly the problem asset discovery solves. Marketing spins up a landing-page subdomain, an engineer ships a staging environment on a personal cloud account, a contractor provisions a tool on your root domain — FortWatch surfaces these the next time certificate transparency or passive DNS sees them. You get a feed of newly discovered assets with provenance, so you can decide whether to take them over, secure them, or shut them down.

Continuously. Discovery runs on a schedule per root domain, and passive sources (certificate transparency, DNS telemetry) are monitored in near real time for new hostnames. When a new subdomain appears, it's added to your inventory, fingerprinted, and queued for vulnerability scanning — usually within minutes of the underlying change.

Yes. In addition to DNS-based discovery, FortWatch looks for cloud-hosted assets linked to your domains and brand: S3 buckets, Azure storage endpoints, Google Cloud Storage buckets, and other common cloud surfaces. These are fingerprinted, checked for public exposure, and flagged when they accept anonymous access or list contents.

FortWatch watches public code and paste sites for references to your domains, subdomains, and identifiers. When a new repository or gist mentions your infrastructure, it's linked to the relevant asset so you can investigate leaked credentials, exposed internal hostnames, or code referencing shadow systems before attackers find them.

Certificate transparency (CT) logs, passive DNS datasets, public DNS zone files, search engines, reverse DNS lookups, WHOIS and RDAP records, ASN ranges, cloud provider metadata, and active DNS brute-forcing with curated wordlists. The combination matters — no single source is complete, and attackers use all of them, so FortWatch does too.

Every discovered host is validated before it lands in your inventory: DNS must resolve, and the host must respond on at least one protocol. Wildcard DNS is detected and filtered so a single wildcard record doesn't inflate your inventory with thousands of phantom subdomains. You can also mark assets as out of scope, and FortWatch will suppress them on future discoveries without forgetting they exist.

Yes. You can mark any discovered asset as out of scope, exclude entire subdomain patterns, or restrict discovery to specific IP ranges and ASNs. Excluded assets are still tracked so you see them on the inventory, but they're skipped for active probing and vulnerability scanning until you bring them back in scope.