Attack surface
Garrison only checks and scans targets you have authorized. There is no open-ended scanning.
- Add a target: a host name, an IP or a CIDR range. Detect works out which it is.
- Discover from a domain: looks up certificate transparency logs for names under a domain. Names it finds are added unauthorized; nothing is contacted until you authorize them.
- Each target shows where it came from (added by you, CT logs, a system tag), whether it is authorized, and when it was last checked. Ask Garry asks about that target.
Certificates
Section titled “Certificates”Certificates seen on authorized targets, with their expiry. Expiring certificates become findings.
| Scan | Runs from | Finds |
|---|---|---|
| Certificates only | The appliance | TLS versions, certificate problems, missing security headers |
| External surface (ports and exposures) | The appliance | Open ports and known exposures on authorized targets |
| Internal services | A system with the Scanner role | Services inside your network |
Pick authorized targets (Select all authorized), choose the scan and Start scan. Results appear as findings (See findings).