{"resources":{"networkdiscovery":{"id":"networkdiscovery","fields":{"domain":{"name":"domain","type":"\u001bnetworkdiscovery.domain","title":"Internet-facing domain and its discovered attack surface","desc":"A single fully-qualified domain name and the external footprint that reconnaissance uncovers for it: subdomains found through passive enumeration (querying external data sources such as certificate transparency logs, passive DNS, and search-engine APIs rather than probing the target), the DNS records the domain resolves to (A, AAAA, CNAME), the domains and hosts referenced by its Content Security Policy, the page title, and the web technologies fingerprinted from a live HTTP GET probe of the name. Together these expose the externally reachable assets and technology stack an attacker could target. The domain is selected by its `fqdn`, for example `networkdiscovery.domain(fqdn: \"example.com\")`. When no argument is given, the domain defaults to the host the connection was opened against.","provider":"go.mondoo.com/cnquery/providers/networkdiscovery","is_implicit_resource":true}},"is_extension":true},"networkdiscovery.domain":{"id":"networkdiscovery.domain","name":"networkdiscovery.domain","fields":{"aRecords":{"name":"aRecords","type":"\u0019\u0007","title":"IPv4 addresses the domain resolves to","desc":"A records resolved for the domain during the HTTP probe, giving the IPv4 addresses that serve the FQDN. Empty when the domain has no A records or does not resolve.","provider":"go.mondoo.com/cnquery/providers/networkdiscovery"},"aaaaRecords":{"name":"aaaaRecords","type":"\u0019\u0007","title":"IPv6 addresses the domain resolves to","desc":"AAAA records resolved for the domain during the HTTP probe, giving the IPv6 addresses that serve the FQDN. Empty when the domain has no AAAA records or does not resolve.","provider":"go.mondoo.com/cnquery/providers/networkdiscovery"},"cnameRecords":{"name":"cnameRecords","type":"\u0019\u0007","title":"Canonical names the domain aliases to","desc":"CNAME records resolved for the domain during the HTTP probe. Dangling or stale CNAME targets (a CNAME pointing at a deprovisioned third-party service) can indicate subdomain-takeover risk. Empty when the domain has no CNAME records.","provider":"go.mondoo.com/cnquery/providers/networkdiscovery"},"cspDomains":{"name":"cspDomains","type":"\u0019\u0007","title":"Registered domains referenced by the Content Security Policy","desc":"Registered (apex) domains extracted from the domain's Content Security Policy, each reduced to its registrable form of second-level plus top-level domain (for example `sub.cdn.example.com` yields `example.com`). Identifies the third-party origins the site is permitted to load resources from or connect to, useful for mapping third-party dependencies and trust relationships. The policy is read from the Content-Security-Policy and Content-Security-Policy-Report- Only response headers, their non-standard X-prefixed variants, and any http-equiv meta tag in the response body. Empty when the domain publishes no CSP.","provider":"go.mondoo.com/cnquery/providers/networkdiscovery"},"cspFqdns":{"name":"cspFqdns","type":"\u0019\u0007","title":"Subdomain hosts referenced by the Content Security Policy","desc":"Fully-qualified hosts extracted from the domain's Content Security Policy, kept at full hostname granularity. Only entries that include a subdomain appear here (for example `cdn.example.com`); a bare registered domain such as `example.com` is reported through cspDomains and not repeated here. Same policy sources as cspDomains (the CSP response headers, their report-only and X-prefixed variants, and http-equiv meta tags). Empty when the domain publishes no CSP or its policy names only bare registered domains.","provider":"go.mondoo.com/cnquery/providers/networkdiscovery"},"fqdn":{"name":"fqdn","type":"\u0007","title":"Fully-qualified domain name under analysis","desc":"The apex or host FQDN this resource enumerates, for example `example.com`. All subdomain enumeration and HTTP probing are performed against this name. Defaults to the connection's host FQDN when no `fqdn` argument is supplied.","provider":"go.mondoo.com/cnquery/providers/networkdiscovery"},"subdomains":{"name":"subdomains","type":"\u0019\u0007","title":"Subdomains discovered for the domain","desc":"FQDNs found by passive subdomain enumeration against the domain (for example `www.example.com`, `mail.example.com`). Discovery queries external sources (certificate transparency logs, passive DNS providers, search-engine and threat-intelligence APIs) and does not send probes to the target itself, so results reflect what those sources have observed rather than a live scan. Each discovered subdomain represents an additional externally reachable asset and expands the domain's attack surface. Empty when enumeration finds no subdomains.","provider":"go.mondoo.com/cnquery/providers/networkdiscovery"},"technologies":{"name":"technologies","type":"\u0019\u0007","title":"Web technologies fingerprinted for the domain","desc":"Technologies detected from the HTTP response using Wappalyzer signatures, for example web servers, application frameworks, CMS platforms, CDNs, or JavaScript and analytics libraries. Identifying the stack helps map the domain to known vulnerabilities and outdated components. Empty when no technologies are recognized or the domain is not reachable over HTTP.","provider":"go.mondoo.com/cnquery/providers/networkdiscovery"},"title":{"name":"title","type":"\u0007","title":"Page title returned by the domain's web server","desc":"Contents of the HTML `\u003ctitle\u003e` element retrieved by a live HTTP GET probe of the domain. Useful for fingerprinting the application or landing page hosted at the FQDN. Empty when the domain serves no title or is not reachable over HTTP.","provider":"go.mondoo.com/cnquery/providers/networkdiscovery"}},"init":{"args":[{"name":"fqdn","type":"\u0007"}]},"title":"Internet-facing domain and its discovered attack surface","desc":"A single fully-qualified domain name and the external footprint that reconnaissance uncovers for it: subdomains found through passive enumeration (querying external data sources such as certificate transparency logs, passive DNS, and search-engine APIs rather than probing the target), the DNS records the domain resolves to (A, AAAA, CNAME), the domains and hosts referenced by its Content Security Policy, the page title, and the web technologies fingerprinted from a live HTTP GET probe of the name. Together these expose the externally reachable assets and technology stack an attacker could target. The domain is selected by its `fqdn`, for example `networkdiscovery.domain(fqdn: \"example.com\")`. When no argument is given, the domain defaults to the host the connection was opened against.","defaults":"fqdn","provider":"go.mondoo.com/cnquery/providers/networkdiscovery"}}}