continuous-exposure-monitoring

name	continuous-exposure-monitoring
description	Turns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot -> interval sleep -> re-scan -> asset/finding delta -> threshold-gated webhook alert), the scan-to-scan diff engine (new/removed/changed assets by a tracked-attribute table, new/resolved findings by a stable cross-scan fingerprint), adversary CTI / chatter monitoring across six public feeds (ransomwatch, ransomware.live, HackerNews Algolia search, Reddit security-subreddit RSS, GitHub Gist code-search, public Telegram channel scraping) with a source-kind-aware severity engine (leak-site/forum/telegram/paste tiers, CRITICAL through INFO), literal/glob/regex watchlist pattern matching, full-corpus capture with retroactive rescan on new watchlist entries, infrastructure-tracking-over-time discipline (certificate-transparency, passive-DNS, port/service, and typosquat re-enumeration cadence, and what a genuine 'perimeter drift' event looks like in the diff output), a five-state finding-lifecycle state machine (open/triaged/risk_accepted/resolved/false_positive) with per-severity SLA and fingerprint-based cross-scan dedup and auto-resolve/reopen rules, the alert-fatigue trap where a lifecycle-unaware rule re-fires on an already-accepted finding, a durable retry/backoff alert-outbox pattern ('queued is not delivered'), and copy-paste bash-cron plus PowerShell-Scheduled-Task recipes for a re-scan+diff loop with the Slack-compatible webhook payload shape. Passive OSINT and analysis only -- no new active-intrusion technique. Use when setting up ongoing monitoring for a retainer or MSSP engagement, tuning alert thresholds to avoid fatigue, triaging a finding's lifecycle status, investigating adversary chatter about a brand, building a 'what changed on the perimeter since last week' report, or deciding whether a persisting finding should re-alert.
version	1
sources	asm_reference_impl, public_research
triggers	["continuous monitoring","continuous exposure monitoring","retainer monitoring","MSSP monitoring","scheduled rescan","scheduled scan","scan diff","diff scans","monitor a target","monitor continuously","re-scan and diff","delta alert","alert on delta","drift detection","attack surface drift","perimeter drift","what changed since last scan","ransomware leak site monitoring","leak site monitoring","adversary chatter","dark web monitoring","brand mention monitoring","IAB monitoring","paste site monitoring","telegram brand monitoring","CTI feed","threat intel feed","chatter watchlist","retroactive rescan","infrastructure tracking over time","certificate transparency monitoring","CT log monitoring","[Truncated]"]

Continuous Exposure Monitoring — Loop, Diff, Chatter, Lifecycle

Companion skills: osint-methodology (the 5-stage pipeline this skill loops — see its §7.2 "ongoing weekly diff" profile, which this skill fills in with concrete mechanics), offensive-osint (§29 Threat Intel & IOCs — this skill deepens that section's advisory/IOC-feed directory with the continuous adversary-chatter watch loop and CTI-feed cadence it explicitly lacks; use §29 for indicator enrichment and vulnerability-prioritization data sources, this skill for the standing collection loop), org-attack-surface (the org-first discovery this skill's re-scans re-run on a schedule), exposure-risk-quantification (reads this skill's finding-lifecycle suppression state to compute risk_trend and the FAIR score — see its risk-score model). This skill answers a different question than all four: not "what does the target expose right now," but "is what the target exposes changing, and should anyone be told."

0. When to Use / When NOT

Use this skill when:

• Standing up ongoing monitoring for a retainer, MSSP, or bug-bounty program instead of a one-shot engagement — the client wants to know about new exposure, not to re-read yesterday's report.
• Deciding how often to re-run which recon stage (daily vs. weekly vs. monthly) without either wasting API quota / detection budget on cheap-to-skip stages or missing real drift.
• Building or tuning adversary-chatter monitoring (ransomware leak sites, forum/paste mentions, Telegram brand mentions) for a target's brand/domain.
• Deciding whether a finding that keeps showing up in every re-scan should keep alerting, or has already been triaged/accepted and should go quiet.
• Debugging "the webhook never fired" or "the webhook fired twice" — alert delivery reliability, dedup, and backoff behavior.
• Writing a "what changed on the perimeter since last week" deliverable.

Do NOT use this skill when:

• You need the one-shot discovery methodology itself — that's osint-methodology (5-stage pipeline) and offensive-osint (the per-technique arsenal). This skill assumes discovery already happened at least once and is about the run.