ROOTVIELROOTVIEL
← Capability catalog

Infrastructure & systems

Partial

Network

Observed network posture: active service mapping, active TLS, and passive analysis of a capture.

Family facts

Code
FAM-NETWORK
Status
beta — code maturity
Availability
partial — whether it is offerable
Ingest
upload, live — how a target enters
Rules of Engagement
Required (acts on a live target)
Kind
Family (a selectable assessment)

What it decides

Whether the observed network posture exposes an insecure protocol, an unauthenticated datastore, or a weak TLS configuration.

How it works

It drives external tools for active service mapping, active TLS testing and passive capture analysis, distinguishing an inventory (reported as a note) from a demonstrated problem (a finding).

It is beta because its members are thin drivers over external binaries without end-to-end-verified findings in CI; active discovery is a curated, closed set and is opt-in.

Declared limits

Partial

Active discovery requires explicit opt-in and is limited to a curated set; the port inventory is a note, never a finding; passive analysis is limited to cleartext traffic and active TLS is refused by default. Requires external binaries on the worker.

References

  1. [1]MITRE ATT&CK — Discovery

References point to public, well-known technical sources for further study.

Related articles