Border Asset Discovery
Asset discovery is a core capability of Attack Surface Management. It automatically detects and inventories cloud platform assets and their associated internet-exposed assets. By identifying cloud products, related domain names, IP addresses, and certificates, it analyzes exposure risks and maps attack paths, providing a complete asset inventory, identifying "shadow assets," and narrowing the overall attack surface to support risk assessment and remediation decisions.
Key Concepts
Cloud Assets: Instances of cloud products enabled in your Alibaba Cloud account that are supported by asset discovery, such as Elastic Compute Service (ECS), Server Load Balancer (SLB), and Elastic IP (EIP).
Shadow Assets: Assets not directly created by your account. The system discovers them through association analysis of public information, such as Certificate Transparency logs and DNS records.
Asset Status: The ownership and status of an asset in the system, which directly affects subsequent scanning and risk analysis logic.
Ownership Status
Description
Effect on Scanning
Attributed
Assets confirmed as belonging to the current account.
Continuously scanned for vulnerabilities and exposure, and used as starting points to discover associated Shadow Assets.
Unconfirmed
Discovered by the system but ownership not yet confirmed; awaiting manual review.
Not included in vulnerability scanning or attack path analysis.
To Be Investigated
Asset ownership is under investigation and temporarily unclear.
Not included in vulnerability scanning or attack path analysis.
Ignored
Confirmed as non-corporate assets, or excluded from scanning scope.
Excluded from all scanning and risk analysis.
Scope
Edition requirements: Attack Management already purchased.
NoteAttack Management is an independently sold feature. Go to the Attack Surface or purchase page to purchase it. For more information, see Purchase and unsubscribe Security Center - Independently sold features.
Supported cloud products: Web Application Firewall, Elastic Compute Service (ECS), public-facing Server Load Balancer (SLB), and more. For more information, see Supported cloud products.
Sync assets
Step 1: Add an allowlist (optional)
If Web Application Firewall (WAF), Cloud Firewall, or other security access control policies are deployed in your network environment, add the Security Center scanner IP address ranges to your allowlist.
Outside Chinese Mainland: 43.106.35.0/24.
Chinese Mainland: 47.102.22.128/25.
Step 2: Create an asset sync task
Log on to Security Center console. At the top of the left side of the page, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland, click in the left-side navigation pane .
On the Border Asset Discovery tab, click Sync Assets in the upper-right corner.
After the task is started, the system immediately scans all Alibaba Cloud products supported by Attack Surface Management. You can follow these steps to view the scan progress:
Click Task Management in the upper-right corner of the page.
On the Synchronization Task tab, view the progress of the current asset sync task.
When you run Quick Scan on the Attack Risk tab, or configure a Scan Policy, the system also triggers a Refresh Cloud Assets to sync assets. For more information, see Attack risks.
Asset inventory and status change
After the scan, review newly discovered Shadow Assets and confirm their ownership.
The system only runs vulnerability scanning and attack path analysis on Attributed assets, using them as new scan starting points to discover more associated Shadow Assets.
Go back to the Border Asset Discovery tab. On the Domain Name, IP, and Certificate subtabs, filter assets by Unconfirmed status.
After confirming the asset ownership (for example, by consulting the business owner or checking your internal CMDB), click Change Status in the Actions column for the target asset.
NoteYou can also select multiple assets and click Change Status at the bottom-left of the list for batch processing.
In the Change Status dialog box, select an appropriate Handling Method:
Attributed: Assets confirmed as belonging to the current account.
To Be Investigated: Asset ownership is under investigation and temporarily unclear.
Ignored: Confirmed as non-corporate assets, or not required to be included in the scanning scope.
As needed, enable Update: Once enabled, the system applies status changes in batches based on association logic (for example, applying the same status to all domain names under the same certificate).
Next steps: scan and handle attack risks
On the Attack Risk tab, you can analyze the links and security risks of exposed assets. For discovered attack risks, you can perform the following actions:
View Attack Path: Address risk points along the path one by one.
Use AI Analysis for repair suggestions: Remediate risks based on the recommendations provided.
Add to Whitelist: Add paths confirmed as risk-free to the Add to Whitelist.
For detailed remediation steps, see Attack risks.
FAQ
What causes scan failures or timeouts? How can I resolve them?
The scanner IP may be blocked by WAF, Cloud Firewall, or host security policies. Check and ensure all official scanner IP addresses have been added to the scan allowlist.
Ensure the asset is powered on and network-reachable during the scan.
Why wasn't an asset discovered?
Check the following:
The asset type must be within the scope of Supported cloud products.
Asset discovery starts from Attributed assets in the current account. Ensure that the starting assets have completed Asset Status ownership confirmation.
If the asset is a Shadow Assets, it may not have been detected automatically because its association with existing assets is too weak for the system's detection rules.