Desktop
Step-by-step workflow guide for investigators
Network Infrastructure Mapping
Who is this for?
What is on this page?
How to use this page?
Please note that the data returned by Graph is always live, and the results in the video demonstration might not be reproduced at a later time if they disappeared from the public domain.
New to Graph?
A note on results
Data providers used on this page
— Vulners
— Shodan DB
Before you start:
Identify the starting point
- Domain to begin with (recommended starting point).
- Alternate starting points: Website, MX, NS, DNS Name, IPv4 Address, Netblock, or AS Number — pick the earliest you have.
Note: The workflow is designed around a domain input; starting later in the chain means skipping earlier steps.
Access
Note: Basic plan users have limitations in access to data providers within the Data Pass modules and the number of Credits available. Check what you have access to in your plan here.
Credit Management
- Check your organization Credits before starting.
- Monitor Credit usage in the Output Window after each Transform to stay within limits.
Note: This workflow spans multiple data providers and can consume credits quickly on large targets.
Vulners is credit-heavy — narrow to CVEs that matter before running Search for Exploits.
Resources
This guide assumes basic familiarity with Graph (Desktop). Feature names link to the documentation where needed. It helps to have the following pages open before you start:
Video Overview
Watch a real network infrastructure mapping workflow demonstration. Then, follow the step-by-step guide below to build your own, or skip the video and jump straight to the steps.
To enlarge, double-click on the video.
Step-by-Step Guide
Step 1: Add Your Starting Domain and Run DNS from Domain
How to do it:
- Find the Domain Entity type in the Entity palette and drag it to the graph.
- Click on the Entity and change the default text to your target domain.
- Right-click the Domain Entity to open the Transform menu.
- Navigate to Utilities -> DNS from Domain Transform Set. Alternatively, run Farsight DSNDB by typing [CTI] - To DNS Names [DNSDB] into the search bar, but please note that Farsight use is limited to 12 Transform runs per hour.
- Set the Number of Results toggle at the top menu to 4k to maximise the number of results returned.
- Click Run.
What you will find:
Your graph populates with DNS Name Entities (subdomains), MX records (mail servers), and NS records (authoritative name servers) — the domain's declared surface area.
Step 2: Resolve DNS Records to IP Addresses
Select all resulting Entities on the graph and run To IP Address [DNS].
For Red / Blue Teams
When multiple DNS names resolve to the same IP, they share fate — one vulnerability on that host exposes every service on it. Multiple IPs behind one host name typically indicates load balancing or CDN fronting.
Step 3: Map Netblocks, AS Numbers, and owners
- Use Select by Type at the top of the graph to select all IPv4 Address Entities
- Right-click to open the Transform menu and To Netblock (using routing info) [WhoisXML] to group the IPs into the network blocks they belong to.
- Use Select by Type to select all Netblock Entities, then run To AS Number [WhoisXML].
- Use Select by Type to select all AS Number Entities, then run To Company (Owner) [WhoisXML] to resolve each AS to its operating organization.
Step 4: Surface Exposed Services and Vulnerabilities on the IPs
Select all IPv4 Entities and run the following Transforms:
| Transform | Output | What It Surfaces |
| [CTI] To CPEs [Shodan Internet DB] | Phrase / Keyword | Common Platform Enumeration — software and hardware inventory running on the host |
| [CTI] To CVE [Shodan Internet DB] | CVE | Known vulnerabilities associated with the services on the host |
| [CTI] To Hostnames [Shodan Internet DB] | DNS Name | Reverse-DNS hostnames Shodan has observed for the IP |
| [CTI] To Ports [Shodan Internet DB] | Port | Open ports observed on the host |
| [CTI] To Tags [Shodan Internet DB] | Tag | Behavioral tags (e.g., VPN, proxy, cloud, ICS) Shodan assigns to the host |
Large Selections Are Slow
Running these Transforms against many IPs can take time to process. Subset first. For example, focus on IPs sitting in owner-ASNs you actually care about before running against everything.
Null Results Are Not "All Clear"
If Shodan returns no CVEs, it could mean no publicly known vulnerabilities, gaps in Shodan's coverage for that IP, or a new or obscure system that hasn't been analyzed. Treat null as inconclusive, not safe.
Optional Step: Triage CVEs: Severity and Active Exploits
- Use Select by type to grab all Phrase Entities (CVEs are returned as phrase Entities).
- Right-click and run Get CVSS from CVE [Vulners] to get CVSS Entities and a circular severity tag next to each CVE icon.
- Select the CVE Entities again, right-click, and run Search for Exploits [Vulners] to get URL Entities pointing to exploit resources.
- From CVE Entities, run [CTI] Find APTs exploiting the CVE [SOCRadar] to link them to known APTs,
When to stop?
- You have resolved the domain to its DNS records, IPs, netblocks, AS numbers, and owner companies.
- You have run the Shodan Internet DB Transform Set against your IPv4 Entities and surfaced CVEs, CPEs, ports, and hostnames.
- You have attached CVSS scores to CVEs and searched for exploits on the highest-priority ones.
- You have categorized any exploit URLs surfaced by Vulners.
What's next?
-
Check domains and IP addresses for breach exposure with D4 or Constella.
-
Investigate malware hashes that can threaten your organization's infrastructure.
-
Investigate an identified threat actor.
Other guides you might find useful:
Give us your Feedback!
Copyright © 2026
