Findings and exposure policy
How problems are found, opened and resolved, and how the exposure policy and segmentation judge what is reachable.
Findings
Analyzers look at every result and keep a set of findings per scope (a host’s certificate on a port and name, a domain’s mail setup, a service in a zone, …). A finding
- opens when the analyzer reports it for the first time —
finding.newis sent for warnings and criticals, - stays open with an updated last seen while it is reported,
- resolves automatically when the next result of the same scope no longer reports it.
Findings of a product that is switched off are hidden, not deleted.
All finding types
| Type | Severity | Meaning |
|---|---|---|
caa.missing | info | No CAA record: any certificate authority may issue certificates for the domain. |
cert.expired | critical | The certificate an endpoint serves has expired. |
cert.expiring | warning | The certificate expires within the warning period (plan parameter Certificate warning, default 21 days). |
cert.name_mismatch | warning | The certificate does not cover the name it was requested for (SNI). |
cert.revoked | critical | OCSP or the CRL says the certificate is revoked. |
cert.unreachable | info | A TLS port that should present a certificate did not answer the handshake. |
cert.untrusted | warning | The chain does not lead to a trusted root (self-signed, private CA, missing intermediate). |
ct.new_issuer:port | warning | Certificate Transparency shows a certificate for the domain from a CA not seen for it before. The suffix is the issuer. |
dkim.not_found | info | No DKIM key found under the known or common selectors. |
dkim.weak:port | warning | A DKIM key has fewer than 2048 bits. The suffix is the selector. |
dmarc.missing | warning | The domain has no DMARC record. |
dmarc.monitor_only | info | DMARC is p=none: reports only, no protection. |
dmarc.multiple | critical | More than one DMARC record: receivers ignore all of them. |
dns.udp_intercepted | info | From the network of a satellite, DNS over UDP to the authoritative servers is blocked or intercepted while TCP works. |
dns.wildcard | info | The zone answers every name (wildcard). Names only answered by it are marked and never used to correlate hosts. |
dnssec.unsigned | info | The zone is not DNSSEC-signed (no DS record at the parent). |
ftp.anonymous | warning | The FTP server accepts an anonymous login (only tested when the plan enables it). |
ftp.cert_untrusted | info | The certificate of FTP over TLS is not trusted. |
ftp.plaintext | warning | FTP without TLS: passwords travel unencrypted. |
mx.implicit | info | No MX record: mail goes to the A/AAAA address of the domain (implicit MX). |
mx.missing | info | The domain receives no mail (no MX and no address). |
mx.unreachable | warning | A mail server of the domain did not answer on port 25. |
mx.unresolvable | critical | An MX name does not resolve: mail to the domain fails. |
ns.lame:port | warning | A delegated name server does not answer authoritatively for the zone. The suffix is the server. |
ns.serial_mismatch | warning | The name servers report different SOA serials: they are out of sync. |
ns.single | warning | Only one name server: no redundancy. |
policy.review:port | info | A service the exposure policy has no rule for, or whose identity is unknown: review it. The suffix is the port. |
policy.violation:port | warning | A service the exposure policy forbids in the zone of the satellite that saw it, confirmed by two scans in a row. The suffix is the port. |
smtp.cert_expiring | warning | The STARTTLS certificate of a mail server expires soon. |
smtp.cert_mismatch | warning | The mail server’s certificate matches neither its MX name nor its PTR name. |
smtp.cert_untrusted | warning | The STARTTLS certificate of a mail server is not trusted. |
smtp.helo_ptr_mismatch | info | Banner or EHLO name differs from the PTR name of the address. |
smtp.no_starttls | warning | The mail server offers no STARTTLS. |
smtp.open_relay | critical | The server accepted a recipient in a foreign domain from a foreign sender (open relay test, never sends a message). |
smtp.ptr_unconfirmed | warning | The PTR name of the mail server does not resolve back to its address. |
smtp.relay_inconclusive | info | The relay test could not decide (the server refused the test recipient early). Set a real foreign recipient in the plan. |
smtp.starttls_failed | warning | STARTTLS is offered but the handshake fails. |
spf.missing | info / warning | No SPF record. Warning when the domain receives mail. |
spf.multiple | critical | More than one SPF record: SPF fails for every message. |
spf.no_all | info | SPF has no all mechanism at the end. |
spf.pass_all | critical | SPF ends with +all: everyone may send as the domain. |
spf.too_many_lookups | warning | SPF needs more than 10 DNS lookups: receivers treat it as an error. |
tls.outdated | warning | The endpoint negotiated SSLv3, TLS 1.0 or TLS 1.1. |
Exposure policy
The exposure policy says which service may be reachable in which zone. It judges the service that really runs on a port — nmap’s name, or a short probe (TLS, HTTP, SMB negotiate, RDP request; never a login) when nmap had none or only guessed from the port number.
Which rule applies — the most specific wins:
- a rule for the host, else for its group, else for the tenant,
- within those, a rule for the satellite’s zone before a rule for all zones.
Verdicts
| Verdict | When |
|---|---|
| ok | the rule allows the service |
| violation | the rule forbids it — a finding after two scans in a row (policy.violation) |
| review | no rule, or the service could not be identified (policy.review, info) |
| accepted | an active exception covers it |
Exceptions cover one port and one service on one host, optionally per zone and until a date, always with a reason. Another service appearing on the same port alerts again.
Templates (Baseline external, Web server, Mail server, DNS server, Three-tier DMZ, …) are copied after a preview and then belong to the tenant. They are starting points to review, not proof of compliance.
Service details
The Service details check looks closer at what discovery found: SSH algorithms, SMB version and signing, database versions, TLS on PostgreSQL, open DNS recursion. It reads what the protocol reports and never logs in. Test access without a password (Redis, Memcached, Elasticsearch, SNMP public) is off by default and never runs from external satellites.
Segmentation
A zone matrix on the exposure policy page: per pair of zones the allowed ports, none, or empty to skip. Polaris creates one hourly plan per source zone, run by the satellites in that zone. They try a TCP connection to the allowed and to common ports of everything in the destination zone.
- A connection that opens without being allowed is a finding.
- An allowed connection that fails is a finding too.
A network in a zone stands for the hosts known in it when the matrix was saved; it is not swept.