The Inspector panel contains detailed information about one or more selected hosts. It is divided into several sections.

To view detailed information about a host, select the desired host within the topology, Inventory, or External Hosts section.

Selected Host

The Summary section contains a high-level overview of the host type and its corresponding metadata (IP address(es), MAC address(es), hostname(s)).

IPInfo/GreyNoise lookup

IPInfo is an IP address geolocation lookup to include geographic location, company name, domain, and what type of company it is (if applicable).

GreyNoise is a cybersecurity platform that collects and analyzes Internet-wide scan and attack traffic that is integrated directly into Teleseer.

Upon selecting a host, the corresponding IPinfo and GreyNoise metadata will appear if present.

Host Info

The Host Info section contains detailed information about the host, such as manufacturer, form factor, operating system and version. If an analyst has a prior knowledge about a host, they can add/edit the information within this section.

Host Tags

Tags are words or phrases that can be added to a host to help identify and find the host via the search text field.

Adding Tags

• Left-click on the desired host.
• Within the Inspector Panel, scroll down to the Tags section.
• Select the edit button.

• Enter the desired tag value.
• Select the  Add button.
• Enter more tags if desired.
• Select the close button.

‍

This host can now be searched for within the Network, Inventory, and Internet Hosts search text field.

Host Notes

Custom notes that can be added and searched for by users

Host Hostnames

An aggregated table of hostnames existing on the selected host. The hostname, protocol, and domain are displayed for each hostname identified.

Network Interfaces

A host may have one or more network interfaces. An example would be a router containing multiple subnets with each subnet being on its own interface. Each interface detected will be displayed within this section. Each entry will have one or more of the following values: Name, MAC (address), IP (address).

If you have additional information about an interface, you may edit this section accordingly.

Apps

The DPI (Deep Packet Inspection) engines will do their best to identify applications running on a specific host. This section will display the information gathered from the DPI engines. Example values may be: Chrome v#, PBX v#, Safari v#, Thunderbird v#

CVEs

CVEs are publicly disclosed information about common vulnerabilities and exposures. If a host is identified as having a high CVE value, it's best to investigate this host further to determine if it has been or can be compromised.

The Teleseer application will do its best to identify hosts which may have a common vulnerability. When a host does contain a common vulnerability, the host will appear within the Topology in red.

Take a Desktop host for example. See below to learn how to differentiate between a desktop without any CVEs detected and a desktop with one or more common vulnerabilities detected.

CVEs are in the format of CVE-YYYY-NNNN where YYYY is the year and NNNN can be 4 or more arbitrary digits to uniquely identify the CVE. See the following website for more information: https://www.cve.org/

CVEs displayed within the Inspector Panel will contain the name, a description, and a link to any relevant information:

CVE detection

The more specific the Asset Info is, the more refined the CVE list will be.

If an operating system does not contain service pack information, users may receive more CVEs than expected because the system will return all CVEs for the given OS version.

Connections

Selecting one or more blocks within the Timeline displays the Connections panel within the Inspector. This information includes source IP, destination IP, protocol, and bytes transferred.

To view all connections, click on the Show All button.