> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oasm.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Welcome to the Open Attack Surface Management Documentation

OASM is an open-source platform for cybersecurity Attack Surface Management (ASM). It is built to help security teams identify, monitor, and manage internet-facing assets and potential security exposures across their digital infrastructure.

The platform continuously discovers and monitors assets — root domains, IPs, and CIDR ranges — and turns them into an actionable picture of your external attack surface: what is exposed, which technologies run on it, where vulnerabilities were found, and how risk changes over time.

OASM runs as a three-tier system: a **Console** web application for day-to-day operations, a **Core engine** that serves the business logic, and distributed **Workers** that execute security scanning tools. Data is stored in a managed database, with support for geographic lookups and Docker-based deployment.

> [!NOTE]
>
> This page introduces the platform's capabilities. To get hands-on, follow the [Deployment](/deployment) guide. For terminology and architecture, see [Concepts](/concepts).

## Features

* **Asset Discovery & Management**: Discover and manage internet-facing assets — domains, IPs, services, and CIDR ranges — with asset grouping and multi-workspace support.
* **Vulnerability Assessment**: Scan for vulnerabilities and misconfigurations with severity ratings, AI-powered analysis, and dismissal reasons such as false positives, findings used in testing, or issues not going to be fixed.
* **Issue Tracking**: Track findings as issues with Open or Closed states and threaded comments for remediation coordination.
* **Technology Detection**: Identify technologies, services, and certificates running on discovered assets, including TLS monitoring.
* **Distributed Scanning Engine**: High-performance distributed workers that can be scaled out for parallel scanning tasks.
* **Tools & Connectors**: Extensible scanning framework — built-in tools plus connectors that package external scanners (subdomains, URL discovery, HTTP probe, port scanning, vulnerability scanning, screenshots) as container images, configured per workspace with profiles.
* **Workflow Automation**: Automate discovery and scanning with workflow templates (domain discovery, IP address discovery, basic vulnerability scanning) and scheduled runs.
* **Job Registry**: Track the lifecycle of every scan and automation run with Queued, Running, Completed, Failed, and Cancelled states.
* **AI Assistant Integration**: Built-in AI chat assistant, plus an MCP server so external AI assistants can query asset data via natural language.
* **Real-time Monitoring & Notifications**: Event-driven notifications — when a new asset is discovered, a new vulnerability is found, a vulnerability analysis finishes, someone is invited to a workspace, or a workspace is created — keep you informed of changes across your attack surface.
* **Search & Analytics**: Search and filter asset data with analytics for risk trends and reporting, including a statistics dashboard.
* **Reporting**: Generate Summary and Vulnerability reports with preview and export.
* **RBAC & Team Management**: Role-based access control with Owner, Admin, and Read-only permission groups, plus custom groups, member invitations, and a full audit log.
* **Workspace Isolation & API Keys**: Multi-workspace support with isolated attack surfaces and workspace-scoped, rotatable API keys.
* **Integrations**: Connect Cloudflare, Slack, Telegram, and generic webhooks (with Jira integration coming soon).
* **Docker Deployment**: One-command deployment with Docker Compose.

## Getting Started

> **[Deployment](/deployment)**
>
> Run OASM with Docker Compose from the oasm-docker repository.

> **[Concepts](/concepts)**
>
> Understand core terminology: workspaces, targets, assets, and workers.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.