Everything you'veput on the internet.

Watchtower is Parameter's external attack surface management tool. Give it a domain you own and it maps the hostnames, IP addresses, services, and websites exposed under it, then keeps that inventory current as things change.

Each discovery run reads three passive sources: certificate transparency logs, web archives, and passive DNS. It then resolves every hostname those sources turn up and records what is listening on it. You can also import hosts you already know about.

Yes. You add a domain, then publish one DNS TXT record to prove it's yours. Watchtower resolves nothing and records nothing until that record answers, so the surface it maps is always one you're authorized to test.

Usually a few minutes. The run collects from each source, resolves the hostnames it finds, and opens the inventory when it finishes. You don't have to stay on the page while it runs.

Every run is stored as a snapshot. Watchtower compares each new snapshot against the previous one and labels each asset as new, changed, or no longer observed, so a subdomain that appeared overnight or an IP that moved shows up as a change rather than a line in a list you have to re-read.

It means an asset that earlier runs found no longer turns up in the sources or no longer answers. Watchtower keeps it in the inventory with that label and the date it was last seen, rather than deleting it, because a host that stops answering is itself worth knowing about.

No. Watchtower maps what exists and how it's exposed; it doesn't rate findings or exploit anything. When you want an asset tested, you start a penetration test against it from its detail page, and Parameter's agents take it from there.

Most external attack surface tools end at the inventory. Watchtower came out of the discovery stage of Parameter's pentesting harness, so the map it produces is the one our agents test against, and every asset in it is one click from a pentest with a proven finding at the end.

Yes. Each domain is verified and discovered on its own, and you switch between them from the inventory. Counts, changes, and history are kept per domain.