Asset Discovery Provenance Tree

View the full discovery provenance tree for any domain asset to understand exactly how and why it appears in your attack surface.

The discovery provenance tree shows the complete ancestry of any domain asset in your attack surface — from the root seed that initiated discovery through every intermediate step that led to the asset being identified. Use it to answer the question: why is this asset in scope?

Overview

When Guard discovers a domain asset, it does so through a chain of discovery steps. A root seed (such as a domain you registered) may yield additional domains or subdomains, which may in turn yield further assets. The provenance tree captures that entire chain and surfaces it in the UI for any discovered asset.

This gives security teams a clear, auditable record of how each asset entered the attack surface without requiring any manual trace outside the platform.

Viewing the provenance tree

  1. Navigate to the Attack Surface module in the Guard UI.
  2. Select a domain asset from the asset list.
  3. Open the asset detail panel. The Discovery Provenance section displays the full ancestry tree for that asset.
  4. Review the tree from the root seed at the top down to the selected asset, with each intermediate discovery step shown in order.

Reading the tree

Element

Description

Root seed

The top-level entry point registered in Guard (e.g., an apex domain).

Intermediate nodes

Assets discovered from the root seed that themselves led to further discovery.

Selected asset

The asset currently in view, shown as the leaf of the tree.

Each node in the tree represents a discrete discovery step. Following the path from root to leaf shows exactly which discovery actions were chained together to reach the asset.

Common use cases

  • Scope validation — confirm that an asset is legitimately in scope before authorizing testing or remediation.
  • False-positive triage — determine whether an unexpected asset was reached through a valid discovery chain or may warrant exclusion.
  • Stakeholder communication — provide a clear, traceable explanation of why a particular asset appears in the attack surface.