Reconnaissance

← All KQL categories

MITRE ATT&CK Tactic

Reconnaissance

3 queries tagged with this tactic.
View on MITRE ATT&CK →

• Posture Inventory Exposed Spring Boot Actuator Endpoints

  Inventory of Spring Boot Actuator endpoints that answer 200 anywhere in your estate — flips the entity from "who scanned us" (infinite) to "which of my services answer" (finite and fixable). Recovers the real management base path from traffic.

• Posture Which Devices Are Internet Facing

  Identify internet-facing devices — walks through what "public" actually means for both IPv4 and IPv6 before matching.

• Posture Which Devices Or Software Are EOL

  Devices running at least one end-of-support / end-of-life software title or version, from `DeviceTvmSoftwareInventory`.