[devGregA]

Description

Documents three new Pro location types, Domains, IP Addresses and Certificates, which sit behind the External Asset Discovery feature flag:

• a new page, asset_modelling/locations/PRO__attack_surface_locations.md, covering what each type records, how its identity is normalized, how the types relate to hosts, URLs and assets, where they appear (All Locations, the location map, the v3 locations API) and how parsers and connectors report them;
• one line each on the Location Map page (the three new regions) and the Locations overview (the new page).

Test results

Docs only. The page links were checked against the existing page paths in the same section.

Documentation

This PR is the documentation.

Checklist

• Make sure to rebase your PR against the very latest dev.
• Submit all PRs, features and bug fixes alike, against the dev branch.
• Give a meaningful name to your PR, as it may end up being used in the release notes.

🤖 Generated with Claude Code

[devGregA]

Findings

• R1 suggestion this-pr docs/content/asset_modelling/locations/PRO__attack_surface_locations.md:8: the page says the types "are reported by scanners, asset connectors and DefectDojo's own attack surface discovery" (and line 52 says they "are created by imports, connectors and discovery"). The Pro code has the models, the identity rules and the registration, and nothing else: no parser, connector or discovery job emits these types yet, and no attack surface discovery code exists in pro/asset_discovery/ (the builders are in two unmerged PRs). Right: say what is true today, that parsers and connectors can report them through the builders and typed items below, and add the discovery source in the PR that ships it.
• R2 suggestion this-pr docs/content/asset_modelling/locations/PRO__attack_surface_locations.md:56: "Connectors send typed location items of type domain, ip or cert" leaves out the gate on that path. The standalone inventory a connector posts is accepted only while Connector Location Inventory is on; with it off the batch is reported as feature_disabled and nothing is stored (pro/connectors/location_ingest.py). Right: add a sentence naming that flag, as the Container Image page does for its own path.
• R3 suggestion this-pr docs/content/admin/feature_flags/PRO__feature_flags.md:137: the new page sends readers to the Feature Flags page, but the flag has no row there. Every sibling flag does (Connector Location Inventory, Container Image Locations, Unmanaged Devices). Right: add an Attack Surface Discovery (BETA) row between Asset Identity and Calendar, with the registry description, "Requires Locations", default Off and a Docs link to this page.
• R4 nit this-pr docs/content/asset_modelling/locations/PRO__attack_surface_locations.md:29: "internet routable or private" is narrower than the code. is_global is false for private, reserved, documentation and shared-address-space (carrier-grade NAT) ranges, and the model's own help text says "private or reserved". Right: "internet routable, or private or reserved".
• R5 nit this-pr docs/content/asset_modelling/locations/PRO__attack_surface_locations.md:4: weight: 9 ties with PRO__ai_inventory.md (also 9), so the sidebar order of the two is arbitrary. Right: use 11 (Container Images is 8, AI Inventory 9, Exporting an AIBOM 10) or renumber the tail.
• R6 nit this-pr docs/content/asset_modelling/locations/PRO__attack_surface_locations.md:38: the page lists subject alternative names without the limits the code applies: names are de-duplicated, each is cut at 253 characters, and at most 500 are kept per certificate. Right: one sentence, since a certificate with more names will otherwise look truncated for no reason.

Recommendation: changes required (0 blockers, 3 suggestions, 3 nits). Checked clean: no em or en dashes, ellipsis characters, customer or company names, or AI-sounding phrasing. Identity and normalization rules, apex guessing, refresh and fill-only behavior, map grouping and labels, flag gating of lists, map and v3 (?type=), the flag title and the absence of a create form all match the Pro code.

[devGregA]

• R1 fixed in 514d91e: the page says parsers and connectors that support these types report them, and no longer mentions discovery that does not exist yet.
• R2 fixed in 514d91e: the reporting section says standalone connector inventory also needs the Connector Location Inventory flag, and links its page.
• R3 fixed in 514d91e: the feature flag table has an Attack Surface Discovery row between Asset Identity and Calendar.
• R4 fixed in 514d91e: "internet routable" now says private, reserved, documentation and shared address ranges are not.
• R5 fixed in 514d91e: weight 11, after the page at 10.
• R6 fixed in 514d91e: the certificate section states UTC for times without a zone and the SAN limits (deduplicated, 253 characters per name, 500 names).