Company groups

Summary

A group brings several domains and related companies together in a single external scan, for example Meccanica Adda and its subsidiary Adda Servizi. This lesson shows how to spot a group, open its aggregated view, and how the group's assets, risk score and vulnerabilities are calculated.

Chapters

Key points

• Groups are created for you. When you start an external scan with more than one domain, RECON creates a group scan with one child scan per domain. The same happens when a single domain is linked to more than one company.
• How to spot one. In the scan list, the name is followed by the word Group. Use the row's arrow to expand the scans of the individual domains.
• Assets add up, risk is averaged. On the group row, subdomains, ports and technologies are the sum across domains. The group Risk Score, on the other hand, is the simple average of the domain scores: if one domain scores 7.4 and the other 7.2, the group scores 7.3.
• Not the same as a probe group. Company groups only apply to external scans. A probe group is used for internal scans and is something else entirely.
• The aggregated view. Click the group name. On the Overview tab, open the Domains (2) and Companies (2) in This Scan panel (the numbers depend on your group) and choose View by Domain or View by Company. The Group Entry Points and Group Scan Metrics cards add up the results of all domains, and a single map shows every main domain with its subdomains, IP addresses, ports and technologies.
• Group vulnerabilities. On the Group Vulnerabilities tab, a vulnerability found on more than one domain is counted once, with the highest severity found. Further down, Domain Risk Breakdown lists each domain with its CVEs and its own score.
• The other tabs. They follow the same logic: in Group Information, for example, each company has its own card with its own data.

Transcript

The full transcript of the video (in Italian) is in the player's Transcript tab.

Related articles