Onboarding
This page takes you from your first login to an attack surface under control. It covers your first login, then a roadmap of what to do during your first week, your first month, and on an ongoing basis. Each step links to a more detailed page.
Red Kite's goal is to help you reduce your exposure to the internet and keep it under control. Early on, most of the work is about separating what is yours from what is not, and fixing the basic hygiene issues. Over time, the work shifts to watching for changes and automating your own checks.
Your first login
When a teammate adds you to Red Kite, you receive an email with a link to set up your account. Open it, enter your first name, your last name and a password of at least 12 characters, then click Get started. The link is valid for 7 days: if it expired, ask an administrator to resend it.
Then, sign in and take a minute to secure your account:
- Enable two-factor authentication from your profile. See MFA.
- Choose your theme and language from the menu under your avatar, at the top right.
Forgot your password? Click Forgot password on the login page to receive a reset link. The link is valid for one hour.
A quick tour of the interface
The left navigation bar is split in four sections:
| Section | Pages | What you do there |
|---|---|---|
| Visualization | Dashboard, Topology, Intel, Tables | Get the big picture, triage intel, build your own views. |
| Resources | Domains, Hosts, Ports, Websites, IP Ranges | Browse, filter, verify, block and tag what Red Kite found. |
| Automation | Subscriptions, Jobs, Launch, Executions | Control what Red Kite scans, launch jobs manually, read the job logs. |
| Management | Projects, Tags, Custom fields, Secrets, Intel definitions, Users, Groups | Configure Red Kite and decide who can see what. |
At the top of the page, the project selector lets you focus on a single project. When a project is selected, every table, metric and graph is pre-filtered for that project.
First week: set up and get a first picture
1. Create your projects
Create one project for each target that you want to scan and keep logically separated. Projects usually follow business needs, for instance different subsidiaries, business units or stakeholders.
If some stakeholders should only see part of the data, you can give them restricted access to specific projects only. See Inviting teammates and Onboarding clients.
2. Add your seed data
Add the data you already know about to each project: domain names, IP addresses and IP ranges. This seed data is the starting point of Red Kite's automation. From there, Red Kite will resolve domains, scan hosts and ranges for open ports, detect services and websites, and keep discovering new resources. See My first scan.
3. Triage the intel
Intel are the issues Red Kite detects on your attack surface, such as an exposed database or an exposed remote desktop server. The default intel covers the basic hygiene that should be in place on any attack surface.
Go to Visualization > Intel, sort by severity and handle the most critical items first. The objective is to reduce what you expose on the internet to limit your risks.
4. Look for non-standard ports
Non-standard ports can be obscure and little known, which sometimes prevents them from being recognized as a known service, and therefore from being caught by an intel. It does not mean they are not worth a look once in a while.
On the Ports page, use negative filters to hide the usual suspects. For instance, this filter excludes the blocked ports and the HTTP(S) ports:
-is:blocked -port:80 -port:443
5. Start sorting out what is yours
Start identifying the low-hanging fruits as being yours or not:
- Block a resource when it is not yours and you do not want to see it anymore.
- Verify a resource when it is yours and you want to mark it as such.
Start with the resources that have a high confidence score, using a filter like confidence.gte:likely. Use the
topology view to get visual context, and look at a resource's Found by information and job history to
understand where a detection comes from. See Data enrichment.
First month: take control of your attack surface
1. Verify and block in bulk
Keep sorting your attack surface by verifying the resources that belong to you and blocking the ones that do not. Filters are very handy to apply changes in bulk: filter, select all the matching resources, then verify, block or tag them all at once.
You can also apply changes in cascade, so that a change on a resource is propagated to the resources linked to it, following this order: domain → hosts → ports → websites. See Data enrichment.
2. Merge your websites
Red Kite creates one website for every combination of domain, IP, port and path it finds. The same site is therefore often found
several times. Merging lets one main website represent all of its variations. For instance, https://red-kite.io can represent
http://red-kite.io, https://www.red-kite.io and http://www.red-kite.io.
Website scans then go from four scans to one, which reduces the number of requests sent to your websites. Your WAF team will thank you. Use the list view of the Websites page to make the selection and the bulk operations easier. See Website duplicates.
3. Start watching the changes
Once the initial sorting is done, start looking at what changes, even if there may still be frequent changes for a while. On any resource page, use the date picker at the top right to only show the resources that were first seen during a given period. What is new may require your attention. See Finding what changed.
Ongoing: keep your attack surface under control
Once your attack surface is under control, Red Kite becomes part of your routine:
- Watch for new resources. From time to time, check what was first seen recently using the date filters. See Finding what changed.
- Keep your posture under control. Keep verifying new resources and addressing new intel. Use the intel statuses to track what was resolved, what needs a retest and what regressed. See Managing intel.
- Assess new vulnerabilities. When a new vulnerability such as a new CVE is published, use the filters (service, product, version, finding data) to quickly identify the impacted targets that need to be validated.
- Identify targets of interest for your future penetration tests, such as services, websites or entities, and tag them.
- Create your own jobs and intel for recurring issues or for pentest results that you want to detect everywhere. See Implementing a job and Configuring intel.
- Enrich your resources with custom fields to identify owners or any other information useful in your daily work.
- Share the information with other stakeholders by giving them access to the platform so they can collaborate. See Working with teammates.
- Integrate third-party systems, as data sources, as outputs (ex: Jira tickets) or for orchestration (ex: Nessus scans launched from Red Kite on the verified assets). See API.