Configuration

Some incidents handled by the Stoïk CERT could have been avoided if public IP addresses other than those associated with their domains had been provided.

To address this issue, the External Scan is listed as Not configured until these two conditions are met:

• At least one domain name is provided, or it has been confirmed that none exists.

• At least one public IP address is provided, or it has been confirmed that none exists.

To configure the External Scan, go to External Scan > Settings. You can add assets one by one, or import a large list at once.

Add assets one by one

On the Domains or IP addresses card, click Add and type the domain name or IP address you want to include. The asset is validated and added to your scan perimeter immediately.

It is also recommended that you add domain names that you do not use or that you have purchased as extras. These may also be targeted by attackers, particularly for attempts at impersonation or malicious use.

Bulk import domains and IP addresses

If you have a long list of domains or IP addresses to add, you can import them all at once.

How to bulk import

1. Go to External Scan > Settings.

2. On the Domains or IP addresses card, click Import in bulk.

3. Paste your list in the text area. One entry per line. Copy-pasting a column directly from Excel or a CSV works as-is.

4. Each line is validated in real time:

   • : valid entry, will be submitted.

   • : invalid format, must be removed.

   • The counters under the field show how many entries are valid vs invalid.

5. Click Import.

You can import up to 500 entries in a single batch.

Reading the import summary

After submitting, a summary screen breaks down the result into three groups:

• Added: entries accepted and immediately included in your scan perimeter. They will appear in the next External Scan run.

• Pending: entries received but flagged for manual review by the Stoïk SOC. This typically happens for domains with a high internet reputation, where we double-check that you actually own or are entitled to scan them. They are added to the scan perimeter once approved.

• Rejected: entries refused. The most common reasons are:

  • already in your perimeter (duplicate);

  • on Stoïk's blacklist (e.g. public services we never scan);

  • invalid format on the server side.

Close the modal once you have reviewed the summary. To import another batch, simply reopen Import in bulk.

Good to know

• Results remain visible even if only domains or IP addresses are entered. However, warning banners will prompt you (on Stoïk Protect and in the monthly summary) to complete the setup.

• The External Scan can also be run on IP addresses only.

• If you purchased your cyber insurance policy via a questionnaire, the IP addresses entered in the questionnaire are automatically imported into Stoïk Protect.

• If you don't have an additional domain name or IP address, check that your infrastructure has no domain name or public IP address. This will prevent you from receiving unnecessary reminders.