---
name: explore-target-assets
description: Use when you want to understand a target from data already collected — profile a program and its scanned assets (domains, IPs, ports, HTTP paths, technologies) without launching anything. Read-only. Use this before deciding to scan; to run a new scan instead, use using-sonar-workflow-infrastructure.
category: pull
---

# Explore a target

A "target" is a **program** (optionally narrowed to a **scope**). Assets attach to a
program through its scopes.

## Order of operations

1. **Find the target.** `list_programs` (filter by `search`/`platformName`) to get the
   `programId`. Skip if you already have it.
2. **Map it cheaply.** `get_target_overview` with the `programId` — returns program
   metadata, scopes, and per-type asset **counts**. Read the counts before pulling rows.
3. **Drill in, paged.** Use the counts to decide what to pull. Every list tool takes
   `programId` (and optional `scopeId`/`platformName`) plus `page`/`limit`. Never pull
   thousands of rows blindly — page and filter.

## What each asset type tells you

- `list_http_paths` — **richest signal.** Each row has `statusCode`, `length`, `tool`,
  and the path `value`. Filter to a domain with `domainId`. Live 200s / unusual lengths
  are your first hunting ground.
- `list_ports` — open ports with `service` (http/https/null). Use `ipAddressId` to focus
  one host.
- `list_domains` / `list_ip_addresses` — the surface; join domains→IPs→ports→paths.
- `list_technologies` (+ `get_http_path_technologies` / `get_port_technologies`) —
  fingerprints; pivot to known-vuln tech.
- `list_mobiles` / `list_wildcards` / `list_cidrs` — mobile apps and scope boundaries.

## Discipline

- Respect scope: only assets under the target's scopes are in-bounds.
- Prefer `updatedAfter` to focus on recently-changed assets when re-checking a target.
- If you need the full picture, page each type rather than requesting huge `limit`s.