{"versionId":"ba9a7720-0a64-434b-e0be-08dc605b8616","articleId":"10ce77b1-1543-4802-b182-08dc627382d7","title":"Vendor domain scan","tags":["scanning","All articles"],"content":"<p>Keen to get a better understanding of your exposure via technology suppliers and vendors? Use the vendor domain scan to find top level issues and risks for a vendor domain.&nbsp;</p>\n<div class=\"mce-toc\">\n<h2>In this article</h2>\n<ul>\n<li><a href=\"#mcetoc_1hs1tn1fn17v\">How to add a vendor domain to your scan</a></li>\n<li><a href=\"#mcetoc_1hs1tn1fn180\">What does a vendor domain scan look for?</a></li>\n<li><a href=\"#mcetoc_1hs1tn1fn181\">What is not included in a vendor domain scan?</a></li>\n</ul>\n</div>\n<h2 id=\"mcetoc_1hs1tn1fn17v\">How to add a vendor domain to your scan</h2>\n<p>Navigate to the Scanning tab and click Add new entity</p>\n<p><img src=\"https://portal.faqbot.nz/api/images/b7ddc16d2555452e0f9808da01de68e4/files/add%20new%20entity.png?width=1000&amp;height=\"></p>\n<p>Enter the vendor domain you would like to scan, eg github.com</p>\n<p><img src=\"https://portal.faqbot.nz/api/images/b7ddc16d2555452e0f9808da01de68e4/files/add%20vendor%20domain.png?width=1000&amp;height=\"></p>\n<p>If you use a specific URL for the vendor admin portal or for your own subdomain &nbsp;(e.g.&nbsp; portal.vendor.com or mycompany.vendor.com), add this as a <strong>Website</strong> or <strong>Sub domain</strong> type entity.&nbsp;</p>\n<p>&nbsp;</p>\n<h2 id=\"mcetoc_1hs1tn1fn180\">What does a vendor domain scan look for?</h2>\n<p>The vendor scan looks for issues and risks at the top level of the domain - anything that can provide general safety information - &nbsp;like:</p>\n<ul>\n<li>Email security</li>\n<li>Breached accounts</li>\n<li>Website security of the root and www domains only (if you need to look for website security issues for a specific subdomain then add the site as a \"Website\" seed.). &nbsp;</li>\n<li>Certificate expiry on the root and www domains</li>\n<li>Reputation checks</li>\n</ul>\n<h2 id=\"mcetoc_1hs1tn1fn181\">What is not included in a vendor domain scan?</h2>\n<p>The vendor scan does not crawl all sub-domain data or DNS lookups &ndash; because for some vendors this be extensive, causing a heavy load on our platform</p>\n<p>Nor does it generate all the inventory and informational findings that a root domain scan of your own organisation will.</p>\n<p>It will not crawl for related assets or generate findings for things such as:</p>\n<ul>\n<li>Domain email contacts</li>\n<li>Microsoft 365 tenants or other cloud services</li>\n<li>Similar domains or indirect favicons</li>\n<li>Related IP addresses and ports</li>\n<li>The technology stack websites use</li>\n<li>Web application firewall</li>\n</ul>\n<p><span dir=\"ltr\">&nbsp;</span></p>","description":"","isMarkdown":false,"publishedOnUtc":"2024-04-23T20:22:07.4690622","modifiedOnUtc":"2024-04-22T02:25:43.5623455"}