Workflow: Onboarding a Target#

Goal#

Register a new domain in SilentBolt, verify ownership, and authorize it for scanning so that security scans can be executed against it.

Prerequisites#

  • An active SilentBolt account with login access.
  • A domain you own or are authorized to test.
  • DNS management access (for DNS verification) or email access to a standard admin address on the domain (for email verification).

Steps#

1. Navigate to Targets#

Click Targets in the main navigation bar.

2. Click "Add Target"#

Click the Add Target button in the top-right corner of the Targets list page.

3. Fill in Domain Details#

Field Action
Domain Enter the fully qualified domain name (e.g., example.com)
Environment Select production, staging, or development
Tags (optional) Add organizational labels (e.g., client-a, pci-scope)

Click Save.

4. Initiate Verification#

After saving, the domain appears in your Targets list with verification_status = pending. Click the domain to open its detail page.

Choose a verification method:

  1. Copy the verification token displayed by SilentBolt.
  2. Go to your DNS provider's management console.
  3. Add a TXT record:
    • Name/Host: _silentbolt-verify (or _silentbolt-verify.example.com)
    • Value: The token string (e.g., sb-verify=abc123xyz...)
  4. Save the DNS record.
  5. Wait for DNS propagation (typically 5–30 minutes, up to 24 hours in rare cases).
  6. Return to SilentBolt and click Verify.

Option B: Email Verification#

  1. Click Send Verification Email.
  2. SilentBolt sends an email to a standard admin address (e.g., admin@example.com).
  3. Open the email and click the verification link.
  4. The verification status updates automatically.

5. Authorize the Domain#

Once verified, the domain needs admin authorization before scanning is permitted.

  • If you are an admin: click Authorize on the domain detail page.
  • If you are not an admin: contact your team's admin to approve the domain.

After authorization, the domain shows:

  • verification_status = verified
  • authorization_status = approved
  • is_allowed = true

6. Confirm Readiness#

The domain is now ready for scanning. You can:

  • Start a manual scan from the domain detail page.
  • Navigate to Scans → New Scan and select this domain.
  • Set up a scheduled scan for recurring assessments.

Expected Outcome#

The domain appears in your Targets list with a green/verified status indicator, is_allowed = true, and is available for selection when creating new scans.

Common Issues#

Issue Cause Resolution
DNS verification fails DNS record hasn't propagated Wait 15–30 minutes and retry
DNS verification fails Wrong TXT record name or value Double-check the record matches exactly
Email never arrives Email address doesn't exist on the domain Use DNS verification instead
Cannot authorize You lack admin privileges Ask your company's admin to approve
Domain rejected Domain format is invalid Ensure you're entering a valid FQDN without protocol prefix
Wildcard domain rejected Entered *.example.com Enter the base domain only; subdomain discovery handles the rest

Related Pages

TargetsScansWorkflow: Running a ScanGlossary
PreviousWorkflow: Launching an Attack Session
NextWorkflow: Reviewing Findings