Finding and event rules
Reference for the conditions and observed changes Asset Intelligence highlights.
Use this reference alongside Triage findings and Investigate events. Match the affected target and observation time, then inspect the finding’s evidence and guidance before making an assessment. Rule severity and applicability can depend on the observed context.
Finding rules
The table below summarizes the main finding types Asset Intelligence can raise today.
These descriptions are intentionally written for product users. They explain what the rule is meant to highlight, not every internal exception, suppression rule, or implementation detail.
For findings based on a missing DNS record, Kantoku requires explicit collection coverage for the relevant record type. An incomplete response is not treated as proof that a record is absent, and an existing finding is preserved rather than considered fixed when the latest collection cannot confirm the state.
Browser-storage findings retain only sanitized detection metadata. Credential values, decoded token content, and value hashes are not retained. Missing, blocked, or incomplete storage coverage does not resolve an existing finding.
| Type | Source | Condition |
|---|---|---|
| Domain expiration | Domain registration data | The monitored domain is expired or close enough to expiry that it should be reviewed. |
| Missing registrar lock | Domain registration data | Expected registrar lock protections are not visible in the observed domain status. |
| DNSSEC not enabled | DNS configuration | The domain does not appear to have DNSSEC enabled. |
| WHOIS status anomaly | Domain registration data | The observed registration status looks unusual enough to merit review. |
| SPF missing or too permissive | DNS email posture | SPF is missing or allows mail-sending behavior that is too open. |
| DKIM missing | DNS email posture | Mail-related DNS signals suggest DKIM should be present, but it was not observed. |
| DMARC missing or monitor-only | DNS email posture | DMARC is missing or left in a monitor-only state where stronger enforcement may be expected. |
| MTA-STS missing | DNS email posture | A mail-receiving domain has MX records, but no _mta-sts TXT or CNAME record was observed. |
| Invalid MTA-STS DNS record | DNS email posture | An _mta-sts TXT record exists, but it does not present exactly one valid policy indicator record. |
| Missing CAA record | DNS certificate posture | No CAA record is present to limit which certificate authorities can issue certificates for the domain. |
| Deprecated DNS record type | DNS records | A deprecated or outdated DNS record type was observed. |
| Sensitive data in TXT record | DNS records | A TXT record appears to expose content that may be sensitive or risky to publish. |
| Reverse DNS missing | Reverse DNS | No PTR record was observed for a monitored IP address. |
| Unexpected reverse DNS | Reverse DNS | PTR records were observed, but they do not appear to align with monitored organization-owned domains or a known provider/service attribution. |
| Weak TLS protocols enabled | TLS configuration | The service still supports TLS versions that are considered weak or outdated. |
| TLS certificate expired or expiring | TLS certificate | The certificate is expired or approaching expiry. |
| TLS certificate name mismatch | TLS certificate | The certificate does not properly match the observed hostname. |
| TLS certificate missing SAN | TLS certificate | The certificate does not include the expected Subject Alternative Name coverage. |
| Self-signed certificate | TLS certificate | The observed certificate is self-signed. |
| Untrusted certificate issuer | TLS certificate | The certificate chain or issuer does not appear to be trusted. |
| Weak key or signature | TLS certificate | The certificate uses a weak key size or weak signature algorithm. |
| TLS 1.2 only | TLS configuration | TLS 1.3 is not available even though TLS 1.2 is supported. |
| Legacy TLS fallback cipher | TLS configuration | Legacy fallback cipher details may remain visible in TLS evidence, but they do not open a finding when modern AEAD support is available and no cryptographically weak suite remains. |
| Weak or outdated cipher posture | TLS configuration | The service presents cryptographically weak cipher options or lacks a modern AEAD-based posture. |
| Incomplete certificate chain | TLS certificate | The certificate chain appears incomplete. |
| CSP in report-only mode | Page headers | A Content Security Policy is present, but it is only reporting and not enforcing. |
| Unsafe CSP directives | Page headers | The Content Security Policy includes directives that materially weaken browser protections. |
| Missing CSP directive without fallback | Page headers | The Content Security Policy omits directives that are expected to be defined directly rather than inherited. |
| Missing HSTS | Page headers | An HTTPS page does not present Strict-Transport-Security. |
| HSTS disabled | Page headers | HSTS is present with max-age=0, explicitly disabling cached HTTPS-only behavior for the host. |
| HSTS max-age too short | Page headers | HSTS is present, but the retention period is shorter than the expected minimum. |
HSTS missing includeSubDomains |
Page headers | HSTS is present, but does not extend to subdomains. |
Invalid X-Content-Type-Options |
Page headers | X-Content-Type-Options is present with an unsupported value. |
| Missing Content Security Policy | Page headers | A document-like page does not present a Content Security Policy. |
| Disabled or invalid COEP | Page headers | Cross-Origin-Embedder-Policy is present with a disabled or invalid value on a document-like browser page. |
| Disabled or invalid COOP | Page headers | Cross-Origin-Opener-Policy is present with a disabled or invalid value on a document-like browser page. |
| Permissive or invalid CORP | Page headers | Cross-Origin-Resource-Policy is present with a permissive or invalid value on a document-like browser page or resource. |
| Missing Permissions-Policy | Page headers | A document-like page does not present a Permissions-Policy header. |
| Missing Referrer-Policy | Page headers | A document-like page does not present a Referrer-Policy header. |
| Referrer-Policy too permissive | Page headers | The Referrer-Policy allows more URL detail to be shared than expected. |
| Missing MIME sniffing protection | Page headers | A page does not present X-Content-Type-Options protection. |
| Missing clickjacking protection | Page headers | A document-like page does not present an anti-framing header such as X-Frame-Options. |
| Third-party cookie observed | Page cookies | Third-party cookies were observed in browser runtime evidence. |
Cookie missing Secure |
Page cookies | A cookie that should be protected in transit does not use the Secure attribute. |
Cookie missing HttpOnly |
Page cookies | A cookie that should be restricted from client-side JavaScript does not use the HttpOnly attribute. |
SameSite=None without Secure |
Page cookies | A cookie uses SameSite=None without the Secure attribute that modern browsers expect. |
| Excessive cookie lifetime | Page cookies | A cookie persists longer than expected for its apparent purpose. |
| Invalid secure cookie prefix | Page cookies | A cookie uses a __Secure- or __Host- prefix without meeting the expected requirements. |
| Broad cookie path scope | Page cookies | A cookie is scoped more broadly across paths than expected. |
| Persistent non-essential cookie | Page cookies | A non-essential cookie appears to persist longer than expected. |
| Non-essential cookie before consent | Page cookies | An attributed analytics, marketing, or personalization cookie appears before consent is completed. |
| Browser console error | Browser-observed page behavior | Runtime errors or other important console signatures were observed in the page experience. |
| Failed browser network request | Browser-observed page behavior | The browser console showed failed network requests that remained significant after normalization. |
| Browser security warning | Browser-observed page behavior | The browser console showed security warnings that remained significant after normalization. |
| Unhandled promise rejection | Browser-observed page behavior | The browser console showed unhandled promise rejections after normalization. |
| Deprecated browser API warning | Browser-observed page behavior | The browser console showed deprecated browser API warnings after normalization. |
| Missing source map | Browser-observed page behavior | JavaScript assets exposed missing source maps in browser runtime evidence. |
| CSP-blocked tracker request | Browser-observed page behavior | The browser console showed tracker or analytics requests being blocked by Content Security Policy. |
| Third-party identity runtime failure | Browser-observed page behavior | The browser console showed failures from third-party identity widgets. |
| Third-party challenge runtime failure | Browser-observed page behavior | The browser console showed failures from anti-bot or challenge runtimes. |
| Stack trace exposed in browser signals | Browser-observed page behavior | Collector-derived browser signals indicate stack-trace-like console or runtime output that appears to come from the monitored page rather than unrelated third-party noise. |
| Staging environment exposed | Browser-observed page behavior | Collector-derived browser signals indicate that a publicly reachable staging environment is exposed. |
| Infrastructure service exposed | Network-exposed service state | A sensitive infrastructure service port was observed open on the monitored target. |
| Remote admin service exposed | Network-exposed service state | A remote administration service port was observed open on the monitored target. |
| Default page exposed | Page content | The page appears to be an exposed reverse-proxy, framework, server, or placeholder default page rather than intended application content. |
| HTTP served without HTTPS redirect | Page content | A domain root serves successful HTTP content while the same host also has a working HTTPS root, instead of redirecting HTTP traffic to HTTPS. |
| Missing security.txt | Page security contact posture | The apex domain web surface does not return a successful /.well-known/security.txt response over HTTPS. |
| Expired security.txt | Page security contact posture | The apex domain web surface returns a successful /.well-known/security.txt response with an Expires field in the past. |
| MTA-STS policy invalid or weak | Page security contact posture | An MTA-STS HTTPS policy file is unavailable, invalid, not enforced, or does not cover the observed MX hosts. |
| Stack trace exposed in page output | Page content | Collector-derived page signals indicate stack-trace-like application output is being rendered in the page itself. |
| Credential in browser storage | Browser-observed page behavior | High-confidence credential material was detected in the top-level same-origin page's localStorage or sessionStorage. |
Event rules
Snapshot events describe material change over time. They explain what changed between observations, even when that change does not rise to the level of a finding.
| Type | Source | Condition |
|---|---|---|
| DNS change | DNS collector | DNS records were added, removed, or changed in a meaningful way. |
| Reverse DNS change | Reverse DNS collector | PTR records for a monitored IP address were added, removed, or changed after baseline handling. |
| Network registration change | IP network registration collector | Registration details for a monitored IP range changed, such as its range, handle, name, dates, or contact context. |
| WHOIS change | Domain registration collector | Registrar, status, dates, contact details, or other important registration fields changed. |
| Similar-domain change | Similar-domain discovery | A new lookalike or related domain candidate was observed after Asset Intelligence normalization and screening. |
| Open port change | Port and HTTP discovery | Open ports or observed service fingerprints changed on the monitored target. |
| TLS certificate change | TLS collector | The active certificate changed in a meaningful way, such as identity, issuer, SAN, serial, or validity changes. |
| TLS configuration change | TLS collector | The observed TLS posture changed, such as supported features or related configuration details. |
| Page content hash change | HTTP discovery | The tracked page content hash changed on an automatically monitored or custom-monitored page, indicating the page body changed. |
| Page technology change | Technology detection | The set of detected technologies or their versions changed in a stable, meaningful way. |
| Page browser/runtime change | Browser-observed page behavior | Browser-visible page behavior changed, such as headers, metadata, cookies, resources, console signals, or consent-related runtime state. |
| Page service change | Browser-observed third-party footprint | Durable third-party service usage changed based on stable runtime evidence. |
| Page surface instability | Correlated page history | Repeated instability was observed across page behavior, page technologies, or related service exposure, and was summarized as a higher-level instability signal. |