> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management.md).

# Learn about Attack Surface Management

Before you get started with Cortex XSIAM Attack Surface Management, review the topics in this section to better understand what attack surface management is, what the key use cases are, and how it works.

## **What is attack surface management?**

The ASM add-on module for Cortex XSIAM brings industry-leading Attack Surface Management (ASM) capabilities to the XSIAM platform. ASM helps you discover and manage your public attack surface, providing visibility into all of your digital assets, including on-prem and cloud. With Attack Surface Management, you can identify and remediate vulnerabilities, enforce compliance policies, and reduce the risk of cyberattacks.

ASM data and insights are viewable and actionable in several different places in the Cortex XSIAMinterface.

* External Surface Assets—In the Inventory, Cortex XSIAM provides a searchable, filterable view of all the external internet-facing assets that have been attributed to your organization, including certificates, domains, services, and websites.
* Dashboards & Reports—Cortex XSIAM provides out-of-the-box and customizable dashboards and reports on the current and historical state of your organization's inventory, services, and issues. This reporting delivers insight into trends and helps leaders identify key topics and business units to focus on to improve the security posture of the organization.
* Cases & Issues—Cortex XSIAM generates issues based on a flexible attack surface rules engine that identifies security and configuration risks within your organization's assets and services, and provides a workflow in which analysts can investigate, prioritize, track efforts to remediate outstanding problems, and independently confirm that issues have been corrected.
* Attack Surface Management module—Cortex XSIAM provides 800+ attack surface rules and hundreds of attack surface tests to identify actionable, risky and vulnerable assets and confirm exploitability. In this location you'll also find a list of your External IP Address Ranges with key contextual information about each range.

## Attack surface management use cases

Cortex XSIAM Attack Surface Management gives security and IT operations teams the visibility they need to reduce risk to the business by focusing remediation efforts on critical exposures and assets out of compliance with policy. Cortex XSIAM automatically updates your asset lists and processes, providing a single source of truth about assets that tie to your organization, including on-prem, through partners, and in cloud providers.

Use cases include the following:

1. **Asset discovery and inventory management**: Discover all of your internet-facing assets, including cloud instances, web applications, and IoT devices, and maintain an up-to-date inventory of those assets.
2. **Vulnerability management**: Identify and remediate vulnerabilities in your internet-facing assets, reducing the risk of cyberattacks.
3. **Compliance**: Enforce compliance policies by identifying and tracking changes in your attack surface, ensuring that all assets are properly secured and in compliance with industry standards.
4. **Incident response**: Gain real-time insights into security incidents, so you can quickly respond to and mitigate potential threats.
5. **Certificate hygiene**: Manage your SSL/TLS certificates by identifying expiring or vulnerable certificates and providing automated workflows to renew or replace them.
6. **DNS hygiene**: Monitor your DNS records and ensure that they are properly configured, reducing the risk of DNS-related attacks.
7. **Mergers and acquisitions**: Assess the security risks and identify potential vulnerabilities associated with mergers and acquisitions through visibility into the target company's internet-facing assets.

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.