Security monitoring
Continuous watch of your verified domains and IP networks: the software each host runs, the known vulnerabilities that affect it, and alerts when something is found.
Security monitoring follows every domain and IP network your organization has verified, continuously. It identifies the software and versions each host exposes, matches them against known vulnerabilities, and tells you when something is found.
Security monitoring is available on the Team and Enterprise plans. It covers only assets you verified, and its results are visible to members of your organization only.
What is watched
- Every verified domain, with the subdomains found under it
- Every verified IP network, with the hosts and services your IP range scans found on it
- The software and version each host exposes, matched against published vulnerability records: CVE, NVD, OSV and WordPress advisories, the CISA and ENISA catalogues of vulnerabilities exploited in the wild, and EPSS
Hosts are checked again as new vulnerabilities are published. Only the current state is kept: a vulnerability that no longer applies, because the software was upgraded or removed, leaves the list by itself.
Getting started
There is nothing to switch on. Monitoring starts the first time a member opens a verified domain that is not followed yet, and results show up within the hour.
Where to see it
The Security monitoring card appears in two places:
- On the domain report of a verified domain, under the RedKit recap, for members of the organization
- In Organization → Infrastructure, on the detail of each verified domain or network
The card gives a verdict, the number of hosts and software followed, the open findings and what is exploited in the wild. The hosts and the full software inventory are one click away.
When nothing is found, the card says how much could actually be checked. It shows no green light when no software version was identified, since nothing could then be compared with vulnerabilities.
Reading a finding
Each finding names:
| Field | What it tells you |
|---|---|
| Host | Where the software was seen |
| Software and version | What was identified, and how it was matched |
| CVE | The vulnerability, with its CVSS score |
| Exploited in the wild | Whether it is in a catalogue of exploited vulnerabilities |
| Fixed versions | The versions that fix it, when known (long lists show the first few, the rest on hover) |
Software found without a version, whose product is known to be exploited in the wild, is reported as an exposure to verify.
To keep false findings out:
- Truncated version banners are never matched against vulnerabilities, so a vague version cannot raise a wave of findings.
- Linux distribution builds are never compared with upstream versions, so backported fixes do not raise false alerts.
A match rests on the version a service discloses. It does not prove the issue is exploitable on your setup: check each finding before acting on it.
Triage
Mark a finding right from the card:
- False positive: not a real issue here
- Accepted risk: known and accepted
The finding moves to a Set aside list, its ticket in a linked tracker is closed, and it is not emailed again. Reopen it from the Set aside list at any time: it goes back to the open findings and its ticket reopens.
Owners, Admins and Members can triage findings. Viewers see them.
Alerts
In Organization settings → Monitoring, the owner and admins pick which members receive monitoring emails. Until someone is picked, nobody is emailed and findings only show on each asset's page.
Each email lists every finding with where it was seen, how it was matched, its scores, the fixed versions and links to all its sources.
A finding is emailed once, and again only if it becomes exploited in the wild or more severe. A finding marked false positive or accepted risk is not emailed again.
Webhooks
Your organization's webhooks receive two monitoring events:
| Event | Sent when |
|---|---|
monitoring.finding.new | A new finding appears on a monitored domain or network |
monitoring.finding.escalated | A known finding got worse: now exploited in the wild, or a higher severity |
Issue trackers
Link a domain or network to a GitHub repository or a Jira project and monitoring findings open and close tickets there, like RedKit findings. See RedKit alerting.