devGregA · Oct 29, 2026 · Oct 26, 2026 · Oct 26, 2026 · Oct 29, 2026 · Oct 29, 2026
@@ -146,6 +146,7 @@ Features under **MCP** appear on the Feature Flags page beneath the MCP server s
 | **Customizable Page Layouts** | Customizable widget-grid layouts for the Organization, Asset, Engagement, Test, Finding, and Risk Acceptance view pages. | On | [Docs](/pro/page_layouts/) |
 | **Dashboards 2.0** | The redesigned customizable widget dashboard. | Off | [Docs](/metrics_reports/dashboards/custom-dashboards/) |
 | **EU Evidence Packs** (BETA) | Assess product evidence against authored CRA and DORA obligation catalogs, preserve assessor overrides, and generate dated evidence packs. Requires **Compliance**. | Off | [Docs](/federal_compliance/eu_evidence_packs/) |
+| **External Asset Discovery** (BETA) | Show the domains, IP addresses and certificates your scans and connectors report as Locations, on the location map and in the location lists. Locations that arrive while this is off are still stored and appear when it is turned on. Requires **Locations**. | Off | [Docs](/asset_modelling/locations/pro__attack_surface_locations/) |
 | **FDA Cyber Device Pack** (BETA) | Assess a cyber device against an authored catalog for section 524B of the Federal Food, Drug, and Cosmetic Act, and generate an evidence pack carrying the component inventory, the lifecycle metrics and the exported bill of materials. Requires **Compliance**. | Off | [Docs](/federal_compliance/fda_cyber_device_pack/) |
 | **Framework Presets** (BETA) | Apply a published framework's patch windows and scan cadence as one preset: preview the plan, apply it, revert it, and see when the applied settings drift. Ships with UK Cyber Essentials and the Australian Essential Eight. | Off | [Docs](/asset_modelling/pro_hierarchy/framework_presets/) |
 | **Global Component Deduplication** | Deduplicate Components globally across the instance instead of per Asset. | Off | [Docs](/triage_findings/finding_deduplication/pro__global_component_deduplication/) |

@@ -0,0 +1,60 @@
+---
+title: "Domain, IP Address and Certificate Locations"
+description: "Domain, IP address and certificate locations describe an organization's internet-facing attack surface: the DNS names, addresses and TLS certificates that parsers and connectors report"
+weight: 11
+audience: pro
+---
+
+Three location types describe what an organization exposes to the internet: **Domains**, **IP Addresses** and **Certificates**. They sit beside URLs, Dependencies, Source Code, Cloud Resources and Container Images, and parsers and connectors that support them report them.
+
+> These location types require the Locations feature and are enabled as the **External Asset Discovery** flag (beta) on the [Feature Flags page](/admin/feature_flags/pro__feature_flags/). Domains, IP addresses and certificates reported while the flag is off are still stored, and they appear as soon as the flag is turned on.
+
+## What Each Type Records
+
+### Domains
+
+A domain location is a DNS name: an apex domain such as `example.com`, a subdomain such as `api.example.com`, or a wildcard such as `*.example.com`.
+
+- **Identity** is the name in lowercase, without a trailing dot, with internationalized names in their ASCII form. `WWW.Example.com.` and `www.example.com` are one location, and so are `bücher.example` and `xn--bcher-kva.example`.
+- A wildcard is its own location. A certificate for `*.example.com` covers something different from one for `example.com`.
+- **Apex domain** is the registrable domain the name sits under. When the reporting source knows it, that value is used. Otherwise DefectDojo takes the last two labels of the name, or the last three under a country code such as `co.uk`. The apex groups names on the location map and does not decide ownership.
+- An IP address is never stored as a domain.
+
+### IP Addresses
+
+An IP location is a single IPv4 or IPv6 address, with no port or scheme.
+
+- **Identity** is the address in canonical form, so `2001:DB8::1` and `2001:db8:0:0::1` are one location. An IPv4 address written in IPv6 form, such as `::ffff:198.51.100.7`, is stored as the IPv4 address.
+- Loopback, link-local, unspecified and multicast addresses are not stored, because they do not name a machine anyone can reach.
+- Each address records whether it is **internet routable**. Private, reserved, documentation and shared address ranges are not. When the source knows them, each address also records the **ASN** that announces it, the ASN's **organization**, the registry **network** it belongs to, and the cloud or CDN **provider** that serves it. These details change when a provider reassigns an address, so the most recent report that includes a detail replaces the stored value.
+
+A web service on an address is still a URL location. An IP location is for sources that report bare addresses, such as cloud inventories, DNS answers and recon tools.
+
+### Certificates
+
+A certificate location is one X.509 certificate.
+
+- **Identity** is the SHA-256 fingerprint of the certificate, shown as `sha256:` followed by 64 hex characters. Fingerprints with colons or in upper case are accepted and stored in one form.
+- Each certificate records its **subject common name**, **issuer**, **serial number**, **validity window** and **subject alternative names**. Validity times without a time zone are read as UTC. Subject alternative names are kept once each, up to 253 characters per name and 500 names per certificate.
+- A certificate does not change, so a later report only fills in details an earlier one did not have.
+
+## How They Relate to Other Locations and Assets
+
+- **Domains and hosts.** A host location is a machine known by the name it reports, stored exactly as reported. A domain location is a DNS name, normalized. The same text can be both, and DefectDojo does not merge them.
+- **IP addresses and URLs.** A URL keeps its own host. DefectDojo does not create an IP location for every URL host.
+- **Assets.** Connectors that model each internet-facing host or domain as its own asset keep doing so. These location types describe the names, addresses and certificates themselves, and an asset can carry any number of them.
+
+## Where to Find Them
+
+- **Domains**, **IP Addresses** and **Certificates** under **Explore > Attack Surface** in the sidebar each list the locations of one type.
+- **All Locations** lists domains, IP addresses and certificates with their type, alongside every other location.
+- The asset **location map** draws three regions: **Domains** grouped by apex domain, **IP Addresses** grouped by network, and **Certificates** grouped by issuer and named by their common name. A group the source did not report, such as an address with no known network, collects under a placeholder.
+- The general locations resource returns them at `/api/v3/locations?type=domain`, `?type=ip` and `?type=cert`.
+
+These locations are created by imports and connectors. There is no form to add one by hand.
+
+## Reporting Them from a Parser or Connector
+
+Parsers build them with `LocationData.domain()`, `LocationData.ip()` and `LocationData.cert()`, and a finding carries them like any other location. Connectors send typed location items of type `domain`, `ip` or `cert`, either on a finding or as standalone inventory for an Asset; the standalone inventory also needs the **Connector Location Inventory** flag. See [Connector Location Inventory](/connectors/upstream/location_inventory/).
+
+A value that cannot name a location, such as a malformed fingerprint or an address in a domain field, is skipped and the rest of the import continues.
@@ -29,6 +29,7 @@ Each dashed region holds one kind of location:
 - Dependencies
 - Cloud Resources
 - Container Images, when the **Container Image Locations** flag is also on. See [Container Image Locations](/asset_modelling/locations/pro__container_image_locations/).
+- Domains, IP Addresses and Certificates, when the **External Asset Discovery** flag is also on. See [Domain, IP Address and Certificate Locations](/asset_modelling/locations/pro__attack_surface_locations/).
 
 Chips at the top of the page count the locations in each type, for example "11 URLs".
 

@@ -23,6 +23,7 @@ Locations fix all three by introducing a **base `Location` object** with a typed
 - **Dependency Locations** — software libraries identified by [Package URL (pURL)](https://github.com/package-url/purl-spec), used to model SBOM contents.
 - **[Source Code Locations](/asset_modelling/locations/pro__source_code_locations/)** — where a static-analysis finding lives in source, identified by file path and line number. Scan-managed, and the substrate for [tracking findings as their code moves](/triage_findings/finding_deduplication/pro__location_drift_matching/).
 - **[Container Image Locations](/asset_modelling/locations/pro__container_image_locations/)**: the container image a finding was found in, identified by registry, repository and digest, together with the assets that run it and the repository that built it. Scan-managed, behind its own flag.
+- **[Domain, IP Address and Certificate Locations](/asset_modelling/locations/pro__attack_surface_locations/)**: the DNS names, IP addresses and TLS certificates that make up an organization's internet-facing attack surface. Scan-managed, behind the **External Asset Discovery** flag.
 - **Host Locations**: a machine identified by its name (a system name, NetBIOS name or DNS name), stored exactly as the scanner reports it. Scan-managed. Qualys VMDR imports create one from each finding's Asset Name, and the Qualys connector creates one from each host's DNS or NetBIOS name when **Create Endpoints From Hosts** is on. The host's IP addresses stay URL Locations beside it.
 
 Cloud provider resource IDs (AWS ARN, Azure Resource ID, GCP Full Resource Name) arrive as Cloud Resource locations from cloud posture scans, and from asset connectors when **Connector Location Inventory** is on. **Cloud Resources** under **Explore > Attack Surface** in the sidebar lists them. Container images arrive as [Container Image Locations](/asset_modelling/locations/pro__container_image_locations/).