Understanding Attack Surface Management Seeds

What are Seeds?

Seeds are entities that Mandiant Advantage Attack Surface Management (MA-ASM) uses to start a data collection run. MA-ASM takes each Seed as a starting point and recursively analyzes all other Entities that are related to that Seed, adding each Entity that is encountered to the Collection.

When adding a Seed to a Collection, both the value and the type must be provided. MA-ASM uses this pairing to determine how to analyze this Seed and enumerate Entities from it. For example, if you add the domain mandiant.com as a Seed, then select Domain as the Seed type. If you want to refer to a website, you must provide the full URL of http://www.mandiant.com (including the prefix http://) and select the Seed type Uri.

For more specific information about the Seeds available in MA-ASM, see Seed Examples.

The best Seeds for starting a new Collection

Domains and netblocks are the best types of Seeds to start with. This is because many child Entities can be discovered through enumeration. If resources and time allow, adding all known entities that belong to your organization is even better.

The more known entities that are provided to start, the better the scoping works. MA-ASM assigns a confidence rating to each Entity that is found, and automatically determines whether it is in scope or out of scope. By having more defined data points (in this case, Seeds that are in scope) the accuracy of the system goes up.

For more information about Seeds, see Collections Tips and Tricks.

Seed Examples

The following tables list the name, the description, and a sample value for each Seed type in MA-ASM. All sample entries are in the format that you'd enter them, unless you see or, which means there are two samples provided.

Active Seeds