NYX cross-references scan data, DNS records, and asset tags in navi.db to surface hosts that exist on the network but have never appeared in a scan result — shadow deployments, rogue instances, and forgotten infrastructure that carry real risk with no visibility.
Capabilities
- Queries navi.db for assets present in DNS or tag data but absent from scan results
- Cross-references last-seen dates against expected scan cadence
- Flags assets with no scan history in configurable look-back windows
- Proposes discovery tags — gated, previewed, written only on confirm
What NYX Hunts
NYX looks for the absence of evidence — hosts that appear in navi.db asset records but carry no findings, assets whose last scan date predates your retention window, and infrastructure that was deployed and forgotten before the scanner could reach it.
Why It Matters
You can't protect what you don't know exists. NYX works entirely from navi.db — no separate scanner, no external feed — surfacing the dark corners of your estate before an adversary finds them first.
Gate Model
All proposed discovery tags are previewed before any write. NYX requires explicit per-call confirmation. Works entirely from navi.db — no external feeds.