Oftentimes, people are not aware of all the assets (web apps and APIs) their organization has, which leads them to overlook their vulnerabilities and inadvertently have them (and the organization) exposed to potential cyber-attacks. With the Snyk API & Web Asset Discovery, you have a way of identifying your company’s assets so that you can effectively protect them before they become a liability.

This is a common question, and here we will give you an idea of what Snyk API & Web does behind the scenes when performing asset discovery.

The first thing we do is find the domains and sub-domains through the following techniques:

With the first list of domains, Snyk API & Web does the following triage:

The resulting domains/sub-domains for web apps and APIs become assets, and Snyk API & Web gets more detailed information about them:

Assets are listed in the Discovery menu of the Snyk API & Web app. The following sections of this article describe some concepts and common actions available in that page.

When you add a source to your account, Snyk API & Web starts performing regular discovery scans to identify assets in the source’s attack surface.

There are four ways of adding a source:

The assets resulting from discovery scans are listed in the Discovery menu entry of the Snyk API & Web app.

Here, at the top of the page, Snyk API & Web provides valuable information that you can use as quick filters to help you manage your assets and focus your attention on the ones that matter the most:

In addition to the quick filters above, you can use the search box (on the right) and the more generic filters to help you navigate the list.

To view the details of a specific asset, click on its name in the list. This opens a side panel where you can see all associated vulnerabilities (Findings) and begin fixing them.

For more detailed guidance, see our article on how to interpret target scan results.

​

This panel shows the asset's name and URL, and has 3 tabs, each of them with useful information to help you manage your assets:

In the first tab, you can see 3 sections:

In the second tab, you can see the following lists:

Finally, in the third tab, you can see the list of events associated with that asset, namely scans performed, risk or score updates, and detection of new technologies. Here you can also add notes for your team to see.

Note: You can switch between a small side panel and a full page by clicking on the buttons that appear at the top of the panel.

If you decide to, you can add assets as targets to your Snyk API & Web account in order to scan them for vulnerabilities. For that, use the Add target button in the asset’s row.

After adding an asset as a target, the Add target button changes to a Scan button, which you can click to start scanning it for vulnerabilities.

After the target scan has finished, the Risk label of the corresponding asset is updated with the risk identified during the target scan.

To access a target's details, click on the 3 vertical dots that appear next to the Scan button to display the overflow menu and choose View target. From there, you can start analyzing its vulnerabilities (Findings), and start fixing them. Learn more about it in this article on how to interpret target scan results.

​

Clicking on the 3 vertical dots that appear next to the main action button (Add target / Scan / Stop button) shows an overflow menu. The first 2 options, Mark as new / Mark as not new, let you identify the asset as new/not new, respectively. This action, along with the State filter, lets you better organize and prioritize your list of assets.

Clicking on the 3 vertical dots that appear next to the main action button (Add target / Scan / Stop button) shows an overflow menu. The option Hide lets you better organize and prioritize your list of assets by hiding the ones you’re not interested in at the moment. These assets don’t disappear, they’re just filtered out of the default view; you can always filter them by choosing the “Hidden” option in the “State” filter and, if at any point you decide those assets are relevant again, you can get more visibility over them by clicking on the Show option.

Clicking on the 3 vertical dots that appear next to the main action button (Add target / Scan / Stop button) shows an overflow menu. The last option, Rename, opens a modal prompt that allows you to update the asset name.

Since assets and targets are synced together, updating an asset name will also update its matching target’s name. The opposite is also true: by updating the target name, the asset name will also be updated automatically.

You can assign labels to assets the same way you would to targets; in fact, these are synced between assets and targets, so applying a label to an asset will also automatically apply it to the respective target and vice versa.

You can click on the Set labels dropdown to assign one or multiple labels; filter existing labels by typing in the search field, or create new ones and apply them in a single step!

You can assign user labels to assets, to identify their owners. To do so, click on the Set owners dropdown to assign one or multiple user labels; filter existing labels by typing in the search field, or create new ones and apply them in a single step!

You can click on the Log tab that appears on the asset’s details to open the logs of that asset since it was first discovered.

In the expanded view of the side panel, you can search for specific log messages or filter them with the Event Type dropdown, or even add notes like you would for findings.

To improve your asset management, you can take certain actions in bulk. Just check the checkboxes of the assets that interest you, and the bulk actions will become available at the top of the list.

Here you can choose to: