Investigate observed changes

Use operational and intelligence timelines to understand what changed.

Investigate an event

  1. Open Asset Intelligence → Events, or open Events on an asset.
  2. Check the selected period; the default covers the last 30 days. Use the available 7-day, 30-day, 90-day, or all-time option when needed.
  3. Select Operational for exposure and posture changes, or Intelligence for discovery such as newly observed lookalike domains.
  4. Apply the available target, category, priority, and search filters.
  5. Open the event reference and inspect its observed time, target, and recorded changes or before/after evidence.
  6. Follow the related asset, page, DNS, certificate, or port to compare the event with current state.
Events overview and observed changes for example domains
Events show observed changes within the selected period and stream. The image shows the first rows. Select the image to enlarge it and inspect the details.

Expected outcome

You can explain a recorded change in its original scope and chronology. An event is not automatically a vulnerability, and an older event does not establish the asset’s current state. Use Findings for evaluated issues and assessments.

Some changes are held for confirmation or normalized to reduce transient noise. Similar-domain events record newly observed screened candidates rather than inventing removal events when a later source omits them. A quiet event timeline does not mean all underlying observations are identical.

Rules reference

See Finding and event rules for the conditions and change types covered by Asset Intelligence.

Screenshot

Scroll to inspect the image, or choose Fit image to see the whole screen.