Attack surface inventory board your team triages each morning

Build me an attack surface inventory board that my security engineer works out of each morning instead of a spreadsheet. This is an interactive app, not a scheduled report: nothing runs on a timer. A reviewer opens the board, works the queue of internet-exposed services, and leaves triage decisions behind for the next session. All inventory data comes from Censys, and escalations go to Jira.

Scope configuration. I set the scope once as a list of entries, where each entry is a domain, an IP range in CIDR form, or an ASN, with an optional label like corp or production. Store the scope in the app. Give me a scope management view where I can add entries, edit them, and retire ones that are no longer ours. Retiring marks the entry retired and keeps it on record rather than deleting it, and excludes its services from the inventory going forward, so the board does not rot as infrastructure changes hands. Show how many live services each scope entry currently accounts for, so it is obvious which entries have become dead weight.

Inventory table. Build a CenQL query from the active scope entries and call Censys Run a Search Query to list every internet-exposed service Censys sees for that scope. Page size caps at 100, so paginate using the next_page_token returned in the response and let the reviewer page through or load more. Each row is one service: IP, port, service or protocol name, software and version, hostnames, hosting provider, country, first seen, last seen, and its current triage state. Where rows need fuller host fields than the search result carries, batch the IPs through Retrieve Multiple Hosts, which accepts up to 100 IDs per call, rather than calling Get a Host once per row.

Overview tiles across the top of the board, each built from Aggregate Search Results over the same scope query: services by port, services by software, and services by hosting provider, plus a total service count and host count. Clicking a bucket in any tile filters the inventory table below to that bucket, so noticing 41 things on port 3389 is one click away from the list of those 41 things.

New since last review. Record a reviewed-at timestamp whenever the reviewer finishes a session using an explicit mark review complete action. Any service whose first-seen date falls after that timestamp is flagged as new and pinned to the top of the table in its own section with a count in the header. This is the first thing the reviewer should see when the board opens.

Host detail drawer. Clicking any row opens a side drawer for that host without leaving the board. Load full host detail from Get a Host, the historical service observations from Get Service History for a Host, and the host timeline from Get Host Event History. Render the history as a timeline so the reviewer can immediately tell whether this exposure appeared last week or has been open for eight months, and list every other service on the same host so they can judge the whole box rather than one port at a time.

Persisted triage state is the heart of this app. Censys is read-only, so all of it lives in the app's own storage, keyed by host and port so it survives re-scans. For each finding the reviewer can set a state of known-good, needs-review, or assigned, and when assigning they capture an owner plus a free-text note. Record who set the state and when, and surface that on the row and in the drawer. Anything unresolved stays queued and comes back next session. Default the board to unresolved findings, with filters for everything, known-good only, assigned only, and by owner. Known-good findings stay suppressed from the default view but resurface if the service materially changes, for example a new software version on that port.

Escalation. An Escalate action on any finding files a Jira issue using Create Issue, prefilled from the finding: a summary naming the IP, port, and service, and a description carrying the host, service details, software and version, the first-seen date, how long the exposure has been open, the scope entry it came from, and the assigned owner and note when there is one. Let the reviewer choose the project and issue type and edit the text before it files. Once filed, store the returned issue key against the finding and show it on the row so the same exposure does not get escalated twice.

A few constraints to respect. Censys is read-only, so nothing the reviewer does writes back to Censys. Searches are metered in Censys credits, so fetch on demand, cache the last result set instead of re-querying on every render, and give the reviewer an explicit refresh control. Keep triage state shared across the team rather than per user, so two people working the board see the same queue and the same ownership decisions.