Find the assets your inventory does not know about

short · 40 min · Objective 4.2

Task

Build an inventory by hand, then enumerate the network to find what is actually there. The gap between the two is the interesting part, and it is where the unpatched, unmonitored machine always lives.

Steps

  1. Write /tmp/inventory.csv from memory and from your notes: every host you believe is on the lab network, with columns hostname,address,owner,purpose,last_patched.
  2. Now add something without updating the inventory — start a container with a published port, or bring up a second address on one VM. This is the 'somebody deployed a thing' case, and it is how it really happens.
  3. Enumerate what is actually there, on the network you own: a host sweep of your own lab range with nmap -sn 10.99.0.0/24 -oG /tmp/discovered.txt.
  4. Diff the discovered set against the inventory and list what is present but unrecorded.
  5. For each unrecorded host, note what you cannot say about it: who owns it, whether it is patched, whether anything is monitoring it.
  6. Update the inventory, and write in /tmp/gap.md how you would detect the next one automatically rather than by running this by hand.

Verify

awk -F, 'NR>1 && NF>=5 {n++} END {print n" host(s) in the inventory"}' /tmp/inventory.csv
grep -c "Status: Up" /tmp/discovered.txt
python3 - <<'PY'
import csv,re
inv={r['address'].strip() for r in csv.DictReader(open('/tmp/inventory.csv'))}
found=set(re.findall(r'Host: (\S+)', open('/tmp/discovered.txt').read()))
extra=found-inv
print('discovered:',len(found),'| inventoried:',len(inv),'| unrecorded:',sorted(extra))
assert extra, 'the sweep found nothing the inventory missed - add the unrecorded host and re-run'
PY
grep -ciE "automat|alert|discovery" /tmp/gap.md

The assertion requires the sweep to have found something the inventory did not know about. If it passes on the first attempt without you adding anything, that is a more interesting result than the lab intended — investigate it.

Notes

The detection question in the last step is the one that scales. Running a sweep by hand finds today's gap; an alert on a host appearing that has never been seen before finds every future one, and it is the monitoring rule the lesson calls one of the most valuable an organisation can build.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.