The Map

Part ofMap and test your attack surface

The Map draws an organisation's estate as an interactive diagram. Use it to see which hosts are exposed, who can reach them, which ones matter most, and how an attacker could move from the internet to a crown jewel.

ATLAS opens on the Map. To return to it from another page, choose Map in the header.

The Map of an example organisation in the Constellation layout, with five domain territories, colour-coded hosts and the actors at the centre

Who can do what

Everyone with access can explore the Map. People with the admin or user role can also scan a host, mark crown jewels and criticality, add actors and trust relations, and save the arrangement of the Map.

How to read the Map

Choose Legend at the top right for the full key. In short:

Domains are territories. Each domain is an island labelled with its name and its zone.

Hosts are atoms. Each host is a small circle inside its domain's territory.

The small dots orbiting a host (its "electrons") are its open ports.

The colour of the centre (its "nucleus") is its worst open finding: Critical · exploitable, High, Low / informational, or No open findings.

The size of a host shows its criticality.

A marker shows a Crown jewel, and an icon shows what kind of host it is, such as Web, Mail, VPN / firewall, Database or OT / ICS.

Actors are the people and groups who can reach the estate, such as "Anyone from the internet" and your employees. They sit at the centre.

Lines show relations: what is reachable from the internet, attack paths (with numbered hops), trust relations between hosts, hosts that share a port, vulnerability or misconfiguration, and what is new since the last scan.

Zones

Every domain belongs to one of four zones:

Zone	Meaning
Internet-facing (Public)	Hosted by the organisation and reachable from the internet
Third-party hosted	Reachable from the internet, but run by a supplier
Unmanaged · shadow	Found by ATLAS, but not on the organisation's own list
Internal · via VPN	Reachable only from inside the network

Find a host

Choose the search box Find host, IP, product at the top left.

Type part of a host name, an IP address or a product name. Hosts that do not match fade into the background.

Press Enter to select the first matching host and open its panel. Press Escape to clear the search.

Look at a host

Choose a host on the Map. A side panel opens. Hover over a host first to see a short summary card.

Read the panel:

the host's zone and name;

Open ports with the number of ports;

Findings, with each finding's severity. Choose details › to open the full finding, or Ticket to raise a ticket. A host without findings reads "No findings on this host.";

Threat model: the Crown jewel switch, Criticality, the host's trust relations and the attack paths that run through it.

Choose Focus here to show only this host and its surroundings.

The Map with a VPN host selected and its side panel showing open ports, findings and the threat model

To scan only this host, choose Scan this host. See Scan one host.

Mark crown jewels and criticality

A crown jewel is a system the organisation cannot afford to lose, such as the patient records database or the domain controller. Attack paths are routes from the internet to a crown jewel, so marking them well makes every other view more useful.

Anyone with the admin or user role can mark hosts.

Choose the host on the Map.

Under Threat model, turn on Crown jewel.

Under Criticality, choose Low, Medium or High.

ATLAS saves the change straight away. The marks are stored in the organisation's shared asset register in MESH, so Command and MESH show the same crown jewels and criticality.

Note

This needs an organisation that shares an asset register with MESH. Otherwise ATLAS refuses with "this organization does not contribute to a shared asset registry, so there is nowhere to record the threat model". Ask your Soveryne contact to connect the organisation.

Record a trust relation

A trust relation says that one host trusts another, for example an application server that connects to a database. Attackers use trust to move between hosts.

Choose the host that trusts another host.

Under Threat model, choose Draw trust link.

A banner reads "Trust from <host> — click the host it trusts". Optionally, describe the relation in the label box, for example "DB connection".

Choose the trusted host on the Map. Choose Cancel to stop without recording anything.

To remove a trust relation, choose the remove button next to it in the host's panel, or in the Trust relations view. The relation disappears from the list.

Choose the actor at the centre

Actors are the people and groups who can reach the estate. The actor at the centre is the vantage point for the Exposure view and the Depth layout.

Choose Centre at the top right. The Actors menu opens: "Who can reach this estate."

The table lists each actor with its Reach, a Centre choice and an On map checkbox.

Choose the Centre option of the actor you want at the centre.

Clear On map to hide an actor. At least one actor must stay on the Map.

Every organisation starts with two actors: the general adversary ("Anyone from the internet") and Employees.

Add an actor

Open Centre.

To add a known attacker group, use Add an adversary: search by name, alias or motive, then choose the adversary.

To add another kind of actor, go to New actor. Type a name, for example "Cleaning company", and choose its kind: Department, Contractor, Supplier, Customers, Compromised device, Insider threat, Thief, Former employee or Visitor.

Choose Add. ATLAS confirms "<name> added. Use Draw access or relation to connect it."

Work with an actor

Choose an actor on the Map to open its panel. There you can:

choose Put at the centre, or Remove from map and Show on map;

choose Edit name and description, then Save;

for an adversary, read its Profile (motive, skill, how it gets in and its techniques) and choose Show likely attack paths;

for Employees, add departments, such as Finance or IT;

under Reaches, see which hosts the actor can reach. For the general adversary, Employees, a compromised device and an insider threat, reach follows the scan. For other actors, choose Choose hosts, tick hosts, and choose Save access;

choose Draw access or relation to connect the actor to a host or to another actor, with an attack type such as phishing or physical access;

choose Remove actor. ATLAS asks "Click again to remove <name>"; choose it again to confirm.

Change the view

Choose View at the top right to change what the lines and colours on the Map show. Each view is described at the top of the menu.

Group	Views
Surface	Exposure: lines from the centre actor to every host it can reach. Thicker lines mean more open ports.
Threat model	Attack paths: the routes to a crown jewel, with the cut point of each. Adversary: likely routes for one adversary, based on its techniques and skill. Actors and reach: every actor and the hosts it reaches. Trust relations: who connects to whom.
Shared across hosts	Shared ports, Shared CVEs and Shared misconfigurations: hosts with the same weakness, so one fix closes many.
Over time	Since last scan: New hosts, New findings and Fixed compared with the previous scan. Live scan: what the running scan covers.

The View menu open on the Map, listing the views and the host filters

After the very first scan, Since last scan reads "This is the first scan — there is no earlier snapshot to compare with."

Filter hosts

Below the views, Filter hosts narrows the Map. Choose Reset to clear every filter.

Show Everything, Attack paths only, Crown jewels and paths to them or Hosts with open findings.

Set a Minimum severity: Any, Low+, High+ or Critical.

Under Zones, choose which zones to show.

Under Always show, choose which lines and markers stay visible in every view: Actor relations, Attack paths, Trust relations, Port orbits, Severity colour and Domain territories.

Change the layout

The buttons at the bottom right arrange the Map in three ways:

Layout	How it arranges the estate
Constellation	Domains as islands; hosts cluster organically and trust pulls them together.
Orbit	The internet at the centre, with rings by distance: internet-facing, then third-party and shadow, then internal.
Depth	Columns by the number of steps from the internet; rows by domain.

Use − and + to zoom, and the last button to fit the whole Map to the screen.

Move territories and actors

Drag a domain by the grip next to its name, or drag an actor, to place it where you want it. ATLAS remembers the position for each layout. A moved item shows a control to return it to its automatic place.

To put everything back at once, choose Rearrange. ATLAS confirms, for example, "4 items are back in their automatic place." and fits the Map again.

Watch: a tour of the Map (about 1 min)

What you see before the first scan

A new organisation has no hosts yet. The Map reads "No hosts discovered yet" and "Run passive reconnaissance to find this organization's domains and hosts. It reads public records only and sends nothing to the target."

The Map of an organisation without hosts, with the Run passive recon button

Choose Run passive recon to start. See Run passive reconnaissance from the Map.

Follow a scan on the Map

While a scan runs, a pill on the Map shows its name and progress. Choose Watch on map to switch to the Live scan view. It counts the hosts Scanned, Scanning now and Queued, and those that are passive only because ownership is not proved or refused because there is no mandate.

Troubleshooting

Message	What it means	What to do
"this organization does not contribute to a shared asset registry, so there is nowhere to record the threat model"	Crown jewels and criticality are stored in MESH, and this organisation is not connected.	Ask your Soveryne contact to connect the organisation to MESH.
"Trust relations connect hosts — pick a host."	You chose an actor while drawing a trust link.	Choose a host instead.
"<name>'s reach follows the scan. Pick an actor to record a relation."	This actor's reach comes from the scan and cannot be set by hand.	Draw a relation to another actor instead.
"Keep at least one actor on the map."	You tried to hide the last actor.	Show another actor first.
"An actor needs a name."	You tried to add an actor without a name.	Type a name.
"<name> is already a department."	The department exists already.	Use the existing department.
"No route from the internet reaches a crown jewel with the current findings."	No attack path exists with what ATLAS knows now.	Check that the organisation's crown jewels are marked.

← PreviousScans Next →Findings and attack paths