Exposed surface
External attack surface (EASM)
Your domains as seen from the Internet: subdomains, exposed services and risky certificates.
What the connector does
Starting from a domain, TechWatchAlert builds a passive inventory: subdomains published in certificate transparency logs, DNS resolution, SPF, DMARC and CAA checks. Once ownership is verified and you have attested your authorization, a light check of exposed services reads the certificate and banner of common ports, and cross-references announced versions with the CVE database.
What comes into TechWatchAlert
- Subdomains (crt.sh, Certspotter) and their IPv4 and IPv6 addresses, including those hosted by third parties
- DNS findings: missing SPF, permissive DMARC, missing CAA
- Exposed sensitive ports and certificates that are expired, expiring soon, self-signed or name-mismatched
- Exposed vulnerable services, with their CVEs and the KEV flag
Setup
- Add an apex domain (for example example.com): the passive inventory starts
- Add the displayed TXT record to your DNS zone to verify ownership
- Click “I added the TXT”
- Attest that you are authorized to have the domain's systems tested: service checks are enabled
In the same family
Connectors
Plug in your tools in minutes
Start with a repository, a fleet or a scan report: your first targeted alerts arrive with the first sync.
Free plan, no credit card · hosted in France