Dashboard guide
Attack surface
The Attack surface page shows every network service on your hosts, who can reach it, and how urgent that makes its vulnerabilities. It is read-only for every role.
Reachable from internet, or internal
Two tabs (also as tiles at the top):
Reachable from internet
| Label | Code | Means |
|---|---|---|
| Measured | R3 | Proven: the external probe connected to it, or at least 3 different public sources were seen connecting. |
| Likely (not measured) | R3* | Not measured (no probe result, or the probe failed), but the service listens on all addresses or on a public address of a host that has one. |
| Restricted | R2 | Only specific public source ranges are allowed, for example a supplier allowlist. |
Internal
| Label | Code | Means |
|---|---|---|
| Internal | R1 | Bound to a private or link-local address, or only reachable from private ranges, or closed for the probe on every public address, or the host has no public address. |
| Blocked | R0 | The host firewall blocks it. |
| Unknown | R? | Not enough data. |
Services that only listen on the loopback address are counted but not listed (they are not reachable from the network).
Urgency colours
The colour follows urgency, not reachability alone. Each level also has a symbol, so it never depends on colour only.
| Level | Colour | Symbol | When |
|---|---|---|---|
| Critical | red | ‼ | reachable (measured) with a known exploited CVE (KEV) |
| High | orange | ! | reachable (measured) with act now or this week findings, or likely reachable with KEV |
| Elevated | amber | ▲ | reachable (measured) with only lower findings, or likely reachable with act now or this week findings |
| Restricted | purple | ◐ | reachable from specific public source ranges only |
| Watch | blue | ● | likely reachable without urgent findings, or internal with findings |
| OK | green | ✓ | no open findings, or blocked by the host firewall |
| No data | grey | – | loopback or link-local only, or no data |
On the map, a solid line means measured, dashed means likely and dotted means restricted. A thicker line means more findings; a KEV pill marks known exploited services.
Panels
- Public (WAN) addresses: the NAT addresses your agents use towards the internet, and what the external probe found open there. Confirm them under Settings → External probe.
- Public addresses: addresses of kind public on the interfaces of your agents. Only these (and confirmed WAN addresses) would ever be probed.
- Evidence sources: how many sockets were seen, how many listen on loopback only, and how many network services remain.
- Segment matrix: which network segments can reach which.
Evidence per service
Expand a service to see each source of evidence and what it said:
| Source | What it tells |
|---|---|
| Host firewall | The live firewall rules of the host, evaluated for this port (nftables, iptables, Windows Firewall, and managers such as CSF, firewalld, ufw). |
| Inbound traffic observed | Whether public sources were seen connecting (a count of distinct sources only; no addresses are stored). |
| External probe | Whether a probe from the internet could connect, when the external probe is enabled. |
| Edge configuration | Port forwards and filters of the network edge, where known. |
| Internal (peer probe) | Whether another host of your environment could connect. |
A real measurement wins over a calculation. If the firewall evaluation says "blocked" but the probe connected, the service counts as reachable and the page notes the disagreement.
How these probes work, and their limits: External and internal probes.