Data enrichment

Red Kite discovers resources automatically, and not everything it finds belongs to you. A domain may resolve to a shared hosting IP, a third-party service may answer on one of your subdomains, an IP range may have been reassigned. Enriching your data is how you turn these raw results into an accurate picture of your attack surface, and it makes every other feature, such as intel, more relevant.

Red Kite gives you four ways to enrich your resources:

Tool	What it tells	Learn more
Verify ownership	This resource is yours.	Verifying ownership
Block	This resource is not yours, and you do not want to see it.	Blocking
Tags	A label to group and find resources, ex: pentest-2026.	Tags
Custom fields	Structured information, ex: the owner or the business unit.	Custom fields

Each resource also has a confidence score, Red Kite's own estimate of how likely it is to belong to the project. It is the best place to start.

Where to start

Start with the resources that are most likely yours, and go down from there:

1. Filter on confidence.gte:likely and verify what you recognize.
2. Then move to confidence:suspected, and finally to confidence:unlikely.
3. Block what is clearly not yours along the way.

Domains are usually the easiest to start with, since you recognize your own domain names. With cascading changes, verifying or blocking a domain will also take care of its hosts, ports and websites.

Understanding where a resource comes from

When you are not sure about a resource, look for context:

• Found by / Last seen by. A resource's page shows whether it was added manually or which job found it, as well as the job that saw it last. Click the job to open its execution and read its logs to understand the detection.
• Job executions. In Automation > Executions, filter on a job name with job: and read the logs of the job runs.
• Findings. A resource's page lists the findings attached to it, such as the services, technologies, certificates, geolocation or the organization that owns the IP.
• Topology. The topology view shows the resource and its links to other resources as a graph. Seeing that a host is only linked to a domain you do not know, for instance, gives you visual context.

Verifying ownership

To verify resources, select them in a resource table and click Verify ownership. On a resource's page, use its Verify ownership button. The same button lets you unverify resources if you made a mistake.

Verifying a resource:

• shows a Verified tag in the confidence column, and the resource matches confidence:verified;
• includes it in the automation, regardless of its confidence score;
• makes it a good target for actions you only want on your own assets, such as heavier scans, see Launching a job.

Blocking

To block resources, select them in a resource table and click Block. Blocked resources:

• stay in the database, so Red Kite remembers them and does not recreate them;
• are hidden by the default -is:blocked filter, use is:blocked to see them;
• are ignored by the subscriptions, so no more jobs run on them;
• are excluded from the default intel.

Prefer blocking to deleting for a resource that is not yours. A deleted resource is removed from the database, and will reappear if Red Kite finds it again. Delete a resource only when it does not exist anymore and you would like to see it again if it comes back. See Interacting with resources.

Bulk changes

Combine filters with bulk selection to review many resources at once:

1. Filter the table, for instance domain:*.legacy-brand.com or host:203.0.113.*.
2. Click Select all N elements to select every resource matching the filter, across all the pages.
3. Click Verify ownership, Block or Tag.

warning

With Select all N elements, the action applies to every resource matching the filter and the date range, not only to the visible page. Double-check your filter before confirming.

Cascading changes

The Verify ownership, Block and Tag buttons have a cascade variant: Cascade verify, Cascade block and Cascade tag. A cascading change is applied to the selected resources and to all the resources linked to them, following this order:

domain → hosts → ports → websites

For example, cascade blocking old-campaign.example.com also blocks the hosts it resolves to, the ports of those hosts and the websites on those ports.

warning

Be careful with cascades on shared infrastructure. If a domain you do not own resolves to a host that also serves your own domains, cascade blocking that domain will also block the shared host and everything below it. In doubt, block the domain without cascading, and review the host separately.

Tags

Tags are colored labels that you put on resources to find them again later with the tag: filter.

• In a resource table, select resources and click Tag, or Cascade tag to also tag the linked resources.
• On a resource's page, use Manage tags.

Some ideas of tags: pentest-2026 for the targets of an upcoming penetration test, production or legacy to describe environments, waf-protected to describe the protections in place. See Tags and Managing tags.

Custom fields

Custom fields hold structured information about a resource, such as its owner, its business unit, its criticality or a ticket number. On a resource's page, use the + button of the Custom fields section, pick a field and fill its value.

The available fields are defined by your team. See Custom fields and Managing custom fields.