//THE ACADEMY IS GROWING DAILY. CHECK OUT THE FIELD NOTES FROM TECHS HERE AT THE ACADEMY
>_DAEMONCORE // ACADEMY
← FIELD NOTES

Why EASM inventory fluctuates between scans

2026.09.20//12 MIN READnetworkingred-teampenetration-testingmethodology

// Observing Inventory Changes in EASM Scans

In the realm of External Attack Surface Management (EASM), it's not uncommon to observe fluctuations in inventory counts between scans. These inconsistencies can stem from various factors, including network changes, misconfigurations, or even hostile activities. Understanding these variables is crucial for a precise vulnerability assessment and security posture.

// Common Causes of Fluctuations

1. Dynamic IP Assignments: DHCP can cause IP addresses to change frequently. If your assets are not using static IPs, this could lead to inconsistencies between scans.

2. Infrastructure Changes: Deployments, decommissions, or reconfigurations of systems can result in assets appearing or disappearing from the EASM inventory.

3. Misconfigured Scanning Tools: If your scanning tool is misconfigured, it might fail to detect all active assets.

4. Assets Under Attack: An attacker might be able to make assets appear and disappear by altering their states or configurations.

5. Network Segmentation: Changes in network segmentation or firewall rules can affect scan results. For instance, an asset may become unreachable due to a newly applied firewall rule.

// Diagnosing Fluctuations

To diagnose the reasons behind these changes, a systematic approach is necessary. Here’s a workflow you can execute today:

1. Collect Prior Scan Data

First, gather data from previous EASM scans. Use a logging method that allows you to compare historical data easily. For instance, if you're using a CSV file to store scan outputs:

cat scan_results_YYYYMMDD.csv

2. Identify Changes

Next, use a tool like diff to compare the latest results with the previous scan.

diff scan_results_YYYYMMDD_previous.csv scan_results_YYYYMMDD_latest.csv

This will highlight which assets have been added or removed between scans. Pay attention to patterns and anomalies.

3. Validate IP Assignments

If you suspect IP changes due to DHCP, check your DHCP server's lease history to verify IP assignments. On a Linux-based DHCP server, you might use:

cat /var/lib/dhcp/dhcpd.leases

Look for entries corresponding to your EASM assets. If you see rapid changes in lease times or unexpected reassignments, that could point to your issue.

4. Review Configuration Changes

Examine your infrastructure for any recent changes. If you're using a cloud provider, check the change logs or activity feed for the last few days. For example, on AWS, you can leverage CLI commands:

aws cloudtrail lookup-events --start-time 2023-10-01T00:00:00Z --end-time 2023-10-05T23:59:59Z

This command allows you to filter events in a specified time range, letting you pinpoint any relevant modifications made to your resources.

5. Assess Firewall and Network Rules

Evaluate any recent changes to firewall rules or network configurations. You can use tools like iptables for Linux systems:

iptables -L -n -v

Make sure to check if rules were altered, added, or removed that would impact connectivity to your assets.

6. Monitor for Unusual Activity

If you suspect malicious activity affecting your asset visibility, set up monitoring for changes to your systems. A simple auditd configuration can help you track file changes and system calls. For instance:

sudo auditctl -w /path/to/your/asset -p wa -k asset-modifications

This will alert you whenever changes are made to the specified asset, helping you catch potential intrusions.

// Mistakes to Avoid

  • Neglecting Historical Data: Skipping historical comparisons can lead to misinterpretation of current changes.
  • Ignoring Environmental Changes: Not considering external changes such as ISP alterations can mislead assessments.
  • Failing to Validate Configurations: Assuming tools are always configured correctly can result in missed assets.

// Checklist for Assessing Inventory Fluctuations

  • [ ] Collect and compare historical scan data.
  • [ ] Review DHCP assignments for dynamic IPs.
  • [ ] Check infrastructure change logs.
  • [ ] Validate firewall rules and network configurations.
  • [ ] Monitor for unusual system activity.

By systematically following this checklist, you can critically assess and understand fluctuations in your EASM inventory. Each of these steps builds on a practical understanding of your network environment, aiding in securing your assets against external threats.

--- // FIELDOPS REPORT AUTHORIZED BY: Rachel H. //