Keep a target monitored
A scan is a photograph of a target on one afternoon. Most of what you want to know is what changed since, and that is a different thing to read.
Contents
Before you start
- A node online, and at least one scan you have already run by hand.
- Routines unlock on Pro. On Free the change feed still works; you re-run the scan yourself.
1Create a routine
Operations, then Routines, then New. The wizard walks through domains, nodes, wordlists, caps and a name. A routine chains the recon stages so each one feeds the next: new subdomains get their ports scanned, new endpoints get crawled, and you do not have to remember any of it.
You should seeA routine listed with its schedule and its next run.
2Set the caps deliberately
The caps step is the one worth slowing down for. A schedule with no ceiling on hosts is how a routine that was reasonable in March becomes a fleet-saturating job in June, when the domain has grown and nobody is watching it run. Pick a number you would be happy to see repeated weekly.
You should seeA host cap and a content-discovery cap you chose rather than inherited.
3Point the results somewhere you read
Set up notifications so a run that finds something reaches you instead of waiting in a dashboard. A monitoring job nobody opens is worse than no monitoring job, because it feels like coverage.
You should seeA notification when a run finishes, and when it finds something new.
4Read the change feed, not the whole result
Intel, then Assets, then Asset changes. Because everything is content-hashed at ingest, a re-run produces a typed diff rather than another pile of rows: hosts that are new, endpoints that disappeared, a service whose version moved, a response shape that is not what it was. This is the page to open on a Monday.
You should seeA short list of what the target did since you last looked.
5Move to a mission when stages need to pass data
A routine runs stages on a schedule. A mission chains them with the output of one becoming the targets of the next, with per-stage node assignment and a full run history you can go back through. Compose one in the Planner, which is also where you launch work across a set of targets rather than one at a time.
You should seeA run history you can compare across weeks.
When it does not work
The routine keeps finding the same things
That is the feed doing its job, and it is a filtering problem rather than a scanning one. Work from the change list, and close out what is not going to be fixed so it stops competing for your attention.
A run overlapped with the previous one
Lengthen the interval or lower the caps. A routine that takes longer than its own schedule is a sign the surface grew, which is itself worth knowing.
What is the difference between a routine and a mission?
A schedule versus a schedule with a memory. Routines repeat stages; missions pass the output of one stage into the next and keep the history. Missions are a Reaper capability.
That is the path. The docs cover everything it left out.