API Reference
SubdomainsAnalysis
Discovers subdomains using certificate transparency (CT) data and (optionally) verifies whether each discovered name still resolves in DNS.
Inheritance
- Object
- SubdomainsAnalysis
Usage
This type appears in these public API surfaces even when no hand-authored example is attached directly to the page.
Returned or exposed by
- Property DomainHealthCheck.SubdomainsAnalysis
- Property SubdomainsInfo.Raw
Accepted by parameters
- Method Microsoft365TenantAnalysis.Analyze
- Method SubdomainsNarrative.Build
- Method Converters.Convert
Constructors
public SubdomainsAnalysis() #Methods
public async Task AnalyzeAsync(String domain, InternalLogger logger = null, CancellationToken cancellationToken = null) #TaskPerforms CT-backed subdomain discovery for the specified domain.
Parameters
- domain System.String
- logger DomainDetective.InternalLogger = null
- cancellationToken System.Threading.CancellationToken = null
Inherited Methods
public override Boolean Equals(Object obj) #BooleanParameters
- obj Object
Properties
public String Subject { get; set; } #The domain being analyzed.
public DnsConfiguration DnsConfiguration { get; set; } #DNS configuration used for optional resolution verification.
public String CrtShUrlTemplate { get; set; } #CT query template used for fetching candidate subdomains.
public String CertSpotterUrlTemplate { get; set; } #Fallback CT query template used when crt.sh is unavailable.
public Boolean UseCertSpotterFallback { get; set; } #When true (default), queries Cert Spotter when crt.sh cannot be reached.
public TimeSpan PassiveCtRequestTimeout { get; set; } #Per-request timeout for passive/public CT HTTP calls.
public Int32 PassiveCtRetryCount { get; set; } #Maximum retry count for transient passive/public CT HTTP failures.
public TimeSpan PassiveCtRetryBaseDelay { get; set; } #Base delay between passive/public CT retry attempts.
public TimeSpan PassiveCtRetryMaxDelay { get; set; } #Maximum delay between passive/public CT retry attempts.
public TimeSpan PassiveCtSourceCooldown { get; set; } #Cooldown applied to passive/public CT sources after transient failures or rate limits.
public TimeSpan PassiveCtCrtShMinimumSpacing { get; set; } #Minimum spacing between public crt.sh requests when passive/public CT fallback is active. crt.sh publishes conservative shared limits, so the default stays intentionally gentle.
public TimeSpan PassiveCtCertSpotterMinimumSpacing { get; set; } #Minimum spacing between Cert Spotter requests when passive/public CT fallback is active.
public Int32 PassiveCtCrtShMaximumRequestsPerRun { get; set; } #Maximum number of public crt.sh requests issued during one passive CT run. Zero means uncapped.
public Int32 PassiveCtCertSpotterMaximumRequestsPerRun { get; set; } #Maximum number of Cert Spotter requests issued during one passive CT run. Zero means uncapped.
public Boolean EnableNativeCtLogSource { get; set; } #When true, uses direct RFC6962 CT log polling as primary subdomain discovery source.
public Boolean NativeCtLogOnly { get; set; } #When true, only native CT log polling is used (disables crt.sh/Cert Spotter fallback).
public String NativeCtLogListUrl { get; set; } #CT log list URL used by native CT discovery.
public List<String> NativeCtLogUrls { get; } #Optional explicit CT log URLs for native discovery (skips log-list download when provided).
public List<String> NativeCtPreferredLogUrlPrefixes { get; } #Optional native CT log URL prefixes that should be preferred ahead of other eligible logs.
public List<String> NativeCtExcludedLogUrlPrefixes { get; } #Optional native CT log URL prefixes that should be excluded from discovery.
public Int32 NativeCtMaxLogs { get; set; } #Maximum CT logs processed per native run (0 means all).
public Int32 NativeCtMaxEntriesPerLog { get; set; } #Maximum CT entries processed per log in a native run (0 means uncapped).
public Int32 NativeCtEntryBatchSize { get; set; } #Maximum get-entries batch size per native CT request.
public Int32 NativeCtInitialBackfillEntriesPerLog { get; set; } #Initial per-log backfill window when no native CT cursor exists (0 starts at current tree head).
public String NativeCtCursorStatePath { get; set; } #Optional native CT cursor state path used to persist per-domain/per-log progress.
public Boolean NativeCtIncludePendingLogs { get; set; } #When true, includes pending CT logs from the log list during native discovery.
public Boolean NativeCtIncludeRetiredLogs { get; set; } #When true, includes retired CT logs during native discovery to recover older historical certificates.
public Boolean NativeCtExactMatchOnly { get; set; } #When true, native CT discovery only matches the exact requested host instead of only child subdomains. Useful for direct host or subdomain lookups where the caller wants CT data for that exact name.
public Boolean NativeCtPrioritizeLatestExactMatch { get; set; } #When true, exact-host native CT discovery prefers newer CT logs first so the latest certificate metadata can be returned faster for direct host lookups.
public Int32 NativeCtStopAfterMatchedObservations { get; set; } #Optional matched-observation stop target for exact-host native CT discovery. Set to values greater than zero to stop after enough exact-host evidence has been observed.
public TimeSpan NativeCtRequestDelay { get; set; } #Optional delay between native CT HTTP requests.
public TimeSpan NativeCtRequestTimeout { get; set; } #Per-request timeout for native CT HTTP calls.
public Int32 NativeCtRetryCount { get; set; } #Maximum retry count for transient native CT HTTP failures.
public TimeSpan NativeCtRetryBaseDelay { get; set; } #Base delay between native CT retry attempts.
public TimeSpan NativeCtRetryMaxDelay { get; set; } #Maximum delay between native CT retry attempts.
public Int32 NativeCtCircuitBreakerFailureThreshold { get; set; } #Consecutive native CT failures required before opening circuit breaker for a log.
public TimeSpan NativeCtCircuitBreakerDuration { get; set; } #Base native CT circuit-breaker duration per log after repeated failures.
public Boolean NativeCtEnableCatchUpMode { get; set; } #When true, native CT polling automatically expands caps when cursor lag is large.
public Int32 NativeCtCatchUpLagThreshold { get; set; } #Cursor lag threshold at/above which native CT catch-up mode is activated.
public Int32 NativeCtCatchUpMaxEntriesPerLog { get; set; } #Maximum CT entries processed per log while native CT catch-up mode is active.
public Int32 NativeCtCatchUpBatchSize { get; set; } #Maximum get-entries batch size used while native CT catch-up mode is active.
public Func<String, CancellationToken, Task<String>> QueryOverride { get; set; } #Optional override returning the JSON payload for a given CT URL. Used by tests and offline callers.
public Boolean QuerySucceeded { get; set; } #True when CT query succeeded and parsing produced results.
public String FailureReason { get; set; } #If QuerySucceeded is false, this may contain a short reason.
public Int32 CertificateObservationCount { get; set; } #Total number of CT rows observed (may include duplicates).
public Boolean ResultsCapped { get; set; } #True when processing was capped to protect performance.
public Int32 MaxCtRowsToProcess { get; set; } #Maximum number of CT rows to process.
public Int32 MaxSubdomains { get; set; } #Maximum number of distinct subdomains to retain.
public Nullable<DateTimeOffset> FirstSeenUtc { get; set; } #Earliest CT entry timestamp observed.
public Nullable<DateTimeOffset> LastSeenUtc { get; set; } #Latest CT entry timestamp observed.
public Int32 DistinctIssuerCount { get; } #Distinct issuer count observed in CT data.
public IReadOnlyDictionary<String, Int32> IssuerCounts { get; set; } #Issuer name → count (best-effort).
public IReadOnlyList<SubdomainDiscoveryEntry> Subdomains { get; set; } #Discovered subdomains ordered by last-seen descending.
public Boolean ResolutionReduced { get; set; } #When true, DNS resolution checks were capped and not all subdomains were verified.
public Boolean VerifyStillResolves { get; set; } #When true (default), attempts to verify whether discovered subdomains still resolve.
public Int32 MaxResolutionChecks { get; set; } #Maximum number of subdomains to verify for DNS resolution. Remaining entries will have Unknown.
public Int32 ResolutionConcurrency { get; set; } #Maximum number of concurrent DNS checks for subdomain resolution.
public TimeSpan ResolutionMinInterval { get; set; } #Minimum interval between DNS queries performed during subdomain resolution verification. Set to Zero (default) to disable rate limiting.
public Boolean DetectSensitiveSubdomains { get; set; } #When true (default), flags discovered subdomains with sensitive/admin-sounding labels.
public Boolean DetectAiInfrastructureExposure { get; set; } #When true, flags discovered subdomains with AI/ML tooling labels (best-effort).
public Boolean ScanSensitiveSubdomainTxt { get; set; } #When true (default), scans TXT records on sensitive subdomains for suspicious content.
public Int32 MaxSensitiveSubdomainTxtScans { get; set; } #Maximum number of sensitive subdomains to scan for TXT content.
public HashSet<String> SensitiveHighLabels { get; } #High-risk labels (exact label match) used for sensitive subdomain detection.
public HashSet<String> SensitiveModerateLabels { get; } #Moderate-risk labels (exact label match) used for sensitive subdomain detection.
public HashSet<String> AiInfrastructureLabels { get; } #AI/ML tooling labels (exact label match) used for exposure detection.
public HashSet<String> SensitiveIgnoreLabels { get; } #Labels excluded from sensitive detection (exact label match).
public virtual List<Assessment> Assessments { get; } #Assessment collection for report-friendly output.
public IReadOnlyList<String> NativeCtLogDiagnostics { get; set; } #Native CT per-log diagnostics captured during this analysis run.
public IReadOnlyList<NativeCtLogDiagnosticEntry> NativeCtLogDiagnosticEntries { get; set; } #Structured native CT per-log diagnostics captured during this analysis run.
public IReadOnlyList<String> PassiveCtWarnings { get; set; } #Passive/public CT source warnings captured during this analysis run.
public IReadOnlyList<PassiveCtDiagnosticEntry> PassiveCtDiagnosticEntries { get; set; } #Structured passive/public CT source diagnostics captured during this analysis run.