Continuous Attack Surface Monitoring

Description

Scheduled scans, diff detection for new subdomains, ports, CVEs. Real-time alerts via email, Slack, or webhook.

What already exists

• On-demand scanning via recon orchestrator API
• Full recon pipeline (subdomain discovery, port scanning, vulnerability assessment)

What needs to be built

• Scheduled scan engine (cron-based or APScheduler/Celery)
• Baseline storage and diff detection (new subdomains, open ports, new CVEs)
• Alert/notification system (email, Slack webhook, generic webhook)
• Scan history and change timeline UI
• Configuration UI for scan intervals and alert preferences