| name | review-attack-surface |
| disable-model-invocation | true |
| argument-hint | [organization_name] [focus: findings|lookalikes|all] |
| description | Review external attack surface using Zscaler EASM findings, exposed services, and lookalike domains. |
Review Attack Surface
Review attack surface: $ARGUMENTS
Step 1: List Organizations
easm_list_organizations()
```text
If an organization was specified, find its ID. Otherwise, use the primary organization.
## Step 2: Retrieve Findings
```text
easm_list_findings(organization_id="<id>")
```text
## Step 3: Analyze Findings by Severity
Categorize findings:
- **Critical**: Exploitable vulnerabilities, exposed admin panels, default credentials
- **High**: Exposed services (RDP, SSH, databases), expired certificates
- **Medium**: Misconfigurations, information disclosure
- **Low**: Best-practice improvements
## Step 4: Check Lookalike Domains
```text
easm_list_lookalike_domains(organization_id="<id>")
```text
Flag domains that could be used for phishing or brand impersonation.
## Step 5: Get Detailed Finding Info
For critical/high findings:
```text
easm_get_finding(finding_id="<id>")
```text
## Step 6: Present Report
```text
External Attack Surface Report
================================
Organization: <name>
Scan date: <date>
FINDINGS SUMMARY:
Critical: X
High: Y
Medium: Z
Low: W
CRITICAL FINDINGS:
1. <finding_type>: <asset>
Risk: <description>
Remediation: <steps>
HIGH FINDINGS:
1. ...
LOOKALIKE DOMAINS:
- <domain> (similarity: X%) -- potential phishing
- <domain> (similarity: Y%) -- registered <date>
PRIORITY REMEDIATION:
1. <most urgent action>
2. <next action>
```text
