How to verify exposure cleanup without turning a ZoomEye count into proof
After an incident, teams often need to show that a public exposure was removed. The evidence can take several forms: a changed firewall rule, a closed public endpoint, a revoked credential or a new audit event. A ZoomEye query can contribute one piece of that evidence, but only when its scope and limits are clear.
CERT-In's advisory on AI agent incidents recommends treating an environment as compromised until a forensic review clears it after credential exposure or confirmed access. It also recommends retesting after remediation and expecting repeat attempts within days or weeks. Those recommendations set a higher bar than a single "not found" result.
What a count records
On November 14, 2026, the event query set recorded:
| Query | Result | Time |
|---|---|---|
app="GitLab" |
1,372,975 | 2026-11-14T15:43:16Z |
app="Jenkins" |
36,840 | 2026-11-14T15:43:33Z |
app="Elasticsearch" |
353,125 | 2026-11-14T15:43:34Z |
app="MinIO" |
263,876 | 2026-11-14T15:43:35Z |
Each value is an all-scope public asset observation for a product fingerprint at a particular time. The count does not identify an owner. It does not prove that an endpoint is vulnerable, that authentication is weak or that a credential is active. It is not a count of affected organizations or victims.
A later query with the same syntax can show that the result changed. The comparison is only meaningful if the scope, normalization and time are recorded. A product fingerprint can change after a software upgrade even when the service remains reachable. A network change can remove one address while another address for the same application remains public.
Verify inside and outside
A complete cleanup record should combine:
- The query and count before the change
- The network or configuration change that was applied
- The query and count after the change, with the same scope
- An authorization test confirming that the old path no longer works
- Logs showing whether the old path was used before and after the change
- The owner, time and approval for the change
External observation is useful for finding a remaining public product surface. Internal evidence is needed to show that a credential was revoked, a role was narrowed or an endpoint was removed from the load balancer. A count that drops is a signal for further checking. It is not proof that no other path exists.
Test the negative case
A negative external test should state exactly what was tested. If the goal is to confirm that a management interface no longer responds from the public internet, record the hostname, address family, request time and response. A generic "site unavailable" message may come from a proxy, a firewall or a routing failure rather than a removed service.
The internal test should be equally concrete. Use the identity that should be denied and perform the action that should fail. Record the policy version and the denied response. Then repeat the test with an approved identity to confirm that the intended service still works.
Avoid a false sense of cleanliness
An asset search cannot inspect every application route, repository history item or cloud policy. It also cannot prove that a secret was erased from a developer's local environment. GitHub's secret scanning documentation shows why history and validity matter: a credential can remain in Git history and its status can determine whether the finding is urgent. That is a different question from whether a public host is visible.
The most useful verification plan uses asset observations to define the external view and configuration, logs and authorization tests to define the internal view. Neither view is complete alone. The plan should also include a review of the detection rule, because the same behavior can repeat after the first cleanup.
Conclusion
ZoomEye is a measurement tool, not a certificate of remediation. Its value comes from a reproducible query, a recorded time and an honest scope. Use the result to find remaining public surfaces and to compare changes. Use access control evidence to show that the risky path has actually been closed.
Top comments (0)