Abstract: Introduced here are security management platforms configured to identify, assess, and monitor organizational vulnerability to security threats. By monitoring netflow data regarding the traffic traversing the Internet, a security management platform can identify security threats that would otherwise go undetected. Such action can be performed instead of, or in addition to, monitoring netflow data regarding the traffic traversing a local network (also referred to as an “internal network”) associated with an organization under examination. Thus, rather than monitor the traffic leaving public-facing Internet Protocol (IP) addresses residing on the local network, the security management platform can instead monitor traffic traversing the Internet and then filter the traffic to identify flows originating from the local network, flows destined for the local network, or any combination thereof.

Abstract: A system for an event driven query includes an input interface and a processor. The input interface is configured to receive an indication from an external system. The processor is configured to determine a scanning query based at least in part on the indication; and perform the scanning query.

Abstract: A system for network mapping includes an interface and a processor. The interface is configured to receive an indication to scan a set of addresses using a fingerprint. The processor is configured to for an address of the set of addresses: receive a response associated with the address; determine whether the response matches the fingerprint; and store the address in a client network database in the event the response matches the fingerprint.

Abstract: A system for detecting network assets or attributes related to a network entity includes an input interface and a processor. The input interface is to receive a seed. The seed is associated with the network entity. The processor is to determine a first set of network assets or attributes associated with the seed and to determine a second set of network assets or attributes based at least in part on the first set of assets or attributes.

Abstract: A system for hierarchical scanning includes an interface and a processor. The interface is to receive an indication to scan using a payload; provide the payload to a set of addresses on a set of ports; and receive a set of responses. Each response is associated with an address and a port. The processor is to: for each response of the set of responses: determine whether a follow-up probe exists associated with the response; and in the event the follow-up probe exists associated with the response: execute the follow-up probe on the address and the port associated with the response; and store the set of data received in response to the follow-up probe in a database.