An overview of the Service Discovery page in the watchTowr Platform.
The Service Discovery page shows every network service running across your attack surface. The watchTowr Platform enumerates every open port, interrogates them for banner and technology information, and classifies each by type, so you can see exactly what your organization has exposed to the internet.
Service Discovery also captures the raw responses and banners from each service, identifies the technologies running behind them, and flags service types that carry an elevated level of risk when publicly accessible.
To access Service Discovery, click Adversary Sight in the left sidebar of the Platform, then find Service Discovery in the pop-up bar.
Network Services Breakdown Bar
At the top of the page, the Network Services Breakdown bar shows a summary of every network service type detected across your attack surface.
Each color represents a different service protocol, such as HTTP, HTTPS, SMTP, FTP, SSH, LDAP, DNS, SNMP, and more. The count of discovered instances shown is shown below the bar chart, next to the corresponding color for each label.
Concerning Types of Network Services Found Panel
The watchTowr Platform flags some service types as "Concerning" because they may be unnecessarily exposed publicly. In most circumstances, these services are common targets for attackers, or indicative of a misconfiguration. If the Platform reports some services on your external attack surface, consider investigating further.
The Concerning Types of Network Services Found panel lists how many of these services have been identified, and groups them by category. The categories may vary depending on deployment. The following list contains examples of Services that the watchTowr Platform may flag as concerning:
Management Interfaces: Administrative and management services that should not be publicly reachable, such as SSH. Exposed management interfaces can be a primary target for brute-force attacks and exploitation of unpatched vulnerabilities.
File Sharing: Services that expose file transfer capabilities to the internet, such as FTP. These protocols can be used to exfiltrate data or deliver malware, and often lack modern authentication controls.
Directory Services: Services that expose directory and authentication infrastructure, such as LDAP. Public exposure of directory services can leak organizational structure and user data, and may enable credential attacks.
Network Management: Protocols that expose internal network management capabilities, such as SNMP. These protocols were not designed for internet exposure and can reveal detailed network topology information to an attacker.
Click Show results to filter the service list to show only the Concerning services, allowing you to triage and act on them immediately.
Note: Not every identified Concerning Service is a problem. Some may be intentionally exposed, and are already accepted as a known risk.
Use the Service Discovery page to review each service, and determine whether it needs remediation. Use the buttons for Convert to Finding and Suppress buttons to either raise it as a finding or suppress it as a known risk.
Convert to Finding: Escalate the service as a security finding for formal tracking, assignment, and remediation. Use this when a service represents a confirmed risk your team needs to act on.
Suppress: Remove the service from the default view. Use this for services that are intentionally exposed and represent an accepted risk.
Note: Suppressed services can be shown again at any time by enabling the Include suppressed network services filter.
Filters and Search
The Filter panel on the left lets you narrow the discovered services to only services relevant to your current needs. Filters can be combined.
Available filters include:
Include closed ports: Show services on ports that are no longer open.
Include open ports with an unidentified network service: Show ports that are open but where the service type could not be determined.
Include suppressed network services: Show services that have been suppressed.
Last Seen Date: Filter by the date range in which a service was last observed active.
Country: Filter services by the geographic location of the underlying asset.
Network Service: Filter by protocol: HTTP, HTTPS, SMTP, FTP, SSH, LDAP, DNS, SNMP, and more.
Port: Filter by specific port number and transport protocol (e.g. 443/TCP, 22/TCP, 161/UDP).
Type: Filter by service category: Web Servers, Mail Servers, File Sharing, Directory Services, Management Interfaces, or Network Management.
Technology: Filter by a detected technology such as NGINX, Envoy, Istio, OpenSSH, or Cloudflare.
Business Unit: Scope the view to services belonging to a specific business unit.
You can also use the search bar to find services by IP address, CIDR range, domain, subdomain, or network service name.
Results can be sorted by Latest seen to surface the most recently active services first.
Service Entries
Each entry in the list represents a single network service observed on a specific asset and port.
The following information is shown for each service:
Asset: The IP address or hostname the service was discovered on. Clicking the asset opens a full asset detail page, where you can review findings, points of interest, DNS records, and more.
Port: The port number and transport protocol (e.g. 443/TCP), with an Open or Closed status indicator.
Network Service: The protocol identified on the port, for example HTTP, HTTPS, FTP, SMTP, SSH, LDAP, or SNMP.
Type: The service category (Web Servers, Mail Servers, Management Interfaces, etc.). Services awaiting classification are shown as Pending.
Last Seen: The most recent date the service was confirmed active.
Network Service Information: The raw banner or HTTP response captured from the service, giving insight into service version, configuration, and behavior.
TLS/SSL Data: For HTTPS services, the certificate common name and organization details, with a See more link for the full certificate information.
Technologies: Technologies identified on the service, such as NGINX, Cloudflare, Envoy, OpenSSH, or Ubuntu.
Banner: The server or service banner string, which can reveal software versions and underlying infrastructure detail.
Each entry also has Convert to Finding and Suppress buttons, as described in the “Filters and Search” section. Use them to either raise the asset as a finding, or suppress it to keep your view clean.
Clicking the IP address or hostname at the top of each entry brings up the Asset overview. For more information, see [Exploring an Asset].
If you need assistance, don't hesitate to contact the watchTowr team. Our knowledgeable team is ready to help you navigate the watchTowr Platform and address any questions or concerns.