Playbooks

To help enterprise security teams rapidly convert platform capabilities into operational outcomes, this guide outlines three battle-tested playbooks: Perimeter Reconnaissance & Baseline Construction, Zero-Day Emergency Verification, and Hybrid Multi-Cloud Distributed Probing.

---

Playbook 1: External Perimeter Baseline Construction

Step 1: Create Project and Ingest Root Domains

1. Navigate to "Projects" → "New" and create a project (e.g., Corporate External Perimeter Audit).
2. Switch to this project using the top project selector.
3. Under "Assets" → "Domains" → "New", enter all registered root domains (example.com, example.org).

Step 2: Launch the Asset Discovery Workflow

1. Go to "Automation" → "Workflows" and locate the pre-packaged Full Asset Discovery workflow.
2. Click "Run", selecting your newly entered root domains as inputs.
3. The engine automatically orchestrates the multi-stage pipeline:
   • Subdomain Enumeration: Subfinder runs across passive sources, discovering hundreds of candidates.
   • DNS Validation & IP Aggregation: Wildcard DNS responses are pruned; valid A/AAAA records resolve to distinct IP blocks.
   • Port & Service Discovery: High-speed port probing identifies exposed listening services.
   • Web Signatures: Live HTTP endpoints are crawled for headers, tech stacks, titles, and Favicon hashes.

Step 3: Configure Automated Tagging Rules

1. Under "Asset Config" → "Tag Management":
   • Rule 1: When page title contains Admin or Console, apply tag CoreAdmin.
   • Rule 2: When server header matches Shiro or SpringBoot, apply tag JavaWeb.
2. New assets arriving from scans are immediately categorized for prioritized vulnerability triage.

Step 4: Explore the Topology Graph

Open "Project Management", enter the project workbench and switch to the "Asset Graph" tab to inspect the visual relationship map linking Companies $\rightarrow$ Domains $\rightarrow$ Subdomains $\rightarrow$ IPs $\rightarrow$ Web Endpoints.

---

Playbook 2: Zero-Day Emergency Ingestion & Verification

When a critical remote code execution flaw breaks in widely deployed middleware (e.g., Apache OFBiz or Confluence), security operations must verify exposures within minutes.

Step 1: Query Cyberspace Engines

1. Open "Cyberspace" → "Search".
2. Select your configured engine (e.g., FOFA, Hunter, Shodan) and enter the fingerprint syntax:

   app="Apache-OFBiz" && country="CN"

3. Review matching hosts belonging to your organizational IP/domain allocations.

Step 2: One-Click Asset Ingestion

1. Select the relevant search hits and click "Batch Ingest".
2. Choose your active incident response project. TestNet normalizes addresses, deduplicates entries, and registers them into the active inventory.

Step 3: Dispatch Dedicated Verification PoCs

1. In "Workflows", run the built-in Full Auto Scan workflow (which includes a Nuclei node) or build a dedicated workflow, specifying the emergency 0-day YAML template in the Nuclei node parameters.
2. Target the freshly ingested Web assets and click "Run".
3. Distributed probe nodes execute non-destructive PoC checks in parallel across all candidate hosts.

Step 4: Incident Triage & Alerts

• Confirmed vulnerable endpoints automatically flow into the Vulnerabilities table with severity ratings and PoC evidence.
• Pre-configured notification hooks immediately push formatted incident summaries to Slack, Microsoft Teams, or custom Webhooks.

---

Playbook 3: Distributed Hybrid Cloud & On-Premises Probing

Enterprise attack surfaces frequently span multi-cloud environments, private data centers, and corporate office networks. TestNet orchestrates heterogeneous probe nodes with ease:

                    ┌──────────────────────────────┐
                    │     TestNet Server (Cloud)   │
                    └──────────────┬───────────────┘
                                   │ HTTP Long-Polling Keep-Alive
                  ┌────────────────┴────────────────┐
                  ▼                                 ▼
   ┌──────────────────────────────┐  ┌──────────────────────────────┐
   │ Public Probe (AWS Tokyo)     │  │ Private Probe (On-Prem VM)   │
   │ Whitelist: recon & subdomain │  │ Whitelist: HTTP/TCP probes   │
   │ Role: Cyberspace, OSINT Sub  │  │ Role: 10.0.0.0/8 Port Sweep  │
   └──────────────────────────────┘  └──────────────────────────────┘

Key Deployment Insights

1. Outbound-Only NAT Traversal:
   • Client nodes connect back to TestNet Server via HTTP long-polling. No inbound public ports or complex firewall exceptions are required.
2. Node Workload Separation via Tool Whitelists:
   • Under "Scanning Nodes" → "Configure", assign a tool whitelist per probe to separate workloads: keep recon and subdomain-collection tools on the public probe, and HTTP/TCP probing tools on the internal probe.
   • Once restricted, the dispatcher only assigns tasks for whitelisted tools to the matching probe, preventing internal probes from receiving external scanning jobs.
3. Defense-in-Depth Probe Isolation:
   • Probe nodes enforce a 90-binary whitelist and volume mount restrictions. When deploying to untrusted networks, set allow_ssrf and allow_privileged to false in the probe's config.yaml to enable internal-range blocking and privileged-container defenses. See Node Sandbox & Security Policies.