Before
A security engineer would likely have to run domain and network searches repeatedly, inspect subdomain records and exposed ports, and check certificate algorithms separately for each network. The findings would then need to be regrouped into a spreadsheet before being handed off through a Jira issue and a team notification.
How it works
- On schedule, retrieve type A subdomains and their hosting details for each configured domain, then group related findings by network.
- Search every discovered network for hosts using weak SSL signature algorithms and associate any matches with the corresponding subdomains and ports.
- Build a formatted spreadsheet report, create a Jira issue, and notify the team with a link to the completed report.
Workflow details
- Scheduled discovery: On a predetermined schedule, the workflow processes the configured list of target domains and retrieves discovered subdomain records, narrowing the results to type A records that include hosting and port information.
- Network grouping: The workflow extracts the relevant subdomain and IP data, calculates the associated network for each address, and combines subdomains that belong to the same network so related exposure can be reviewed together.
- Certificate analysis: Each identified network is searched for hosts using weak SSL signature algorithms, including legacy MD5- and SHA-1-based algorithms, and the results are associated with the relevant subdomains and networks.
- Report generation: The findings are curated into structured records containing subdomains, networks, exposed ports, and weak-certificate information, then written into a newly created spreadsheet with organized sheets, headers, and formatted columns.
- Operational handoff: After the report is prepared, the workflow creates a Jira issue and posts a Teams notification containing the target-domain context and a direct link to the spreadsheet, allowing the security team to review and track the findings.
What changed
Each scheduled run now performs discovery, network grouping, certificate checks, report preparation, issue creation, and team notification as one automated sequence. The security team receives a consistent spreadsheet link and tracking handoff after the scan instead of assembling and distributing the results manually.
Work removed
Running recurring subdomain searches, filtering type A records, calculating network groupings, checking certificate signature algorithms network by network, copying findings into spreadsheet rows, formatting report sheets, creating Jira issues, and manually posting the report link to the team.
Expected outcome
A repeatable scan-and-report cycle is completed without the usual manual searches, spreadsheet preparation, and notification handoffs, giving the team a consistent view of subdomain exposure and weak certificate findings after each scheduled run.
