An asset in S4E represents any digital resource that you want to monitor and scan for security vulnerabilities. Adding your first asset is the essential step between creating an account and running your first scan.
What Is an Asset?
Assets are the building blocks of your attack surface. S4E supports the following asset types:
| Asset Type | Example | Description |
|---|---|---|
| Domain | example.com |
A root domain. S4E can automatically discover subdomains. |
| Subdomain | app.example.com |
A specific subdomain you want to monitor individually. |
| IP Address | 203.0.113.42 |
A single IPv4 or IPv6 address. |
| IP Range | 203.0.113.0/24 |
A CIDR block representing multiple addresses. |
Adding a Single Asset
- Log in to app.s4e.io.
- Navigate to Assets from the left sidebar.
- Click Add Asset in the top-right corner.
- Select the asset type from the dropdown menu.
- Enter the asset value (domain name or IP address).
- (Optional) Add tags to organize the asset (e.g.,
production,staging). - Click Save.
Tip
Start with your primary domain. S4E will automatically discover associated subdomains during the first scan, and you can promote any discovered subdomain to a tracked asset.
Asset Verification
After adding a domain or subdomain, you may be required to verify ownership before scanning can begin. S4E supports multiple verification methods:
- security.txt (Recommended) -- Place a
security.txtfile containing your verification token at/.well-known/security.txtor/security.txt. - HTML File -- Upload a verification HTML file to your web server's root directory.
- DNS Record -- Add a TXT record with your verification token to your domain's DNS.
- DNS Connect -- Authorize S4E to configure DNS verification automatically via your provider API.
For detailed instructions, see the Asset Verification section above.
Note
IP addresses and URLs that resolve to verified domains may inherit verification status automatically.
Quick Validation
Once your asset is saved, S4E performs a quick validation to confirm:
- The domain or IP is reachable.
- DNS resolution is successful (for domains).
- No duplicate asset already exists in your inventory.
If validation fails, you will see an error message with guidance on how to resolve the issue.
What's Next?
With your first asset added, you are ready to Run Your First Scan.