Asset acquisition

Asset acquisition is the boundary that turns external observations into Inventory records. Sonar accepts observations from scheduled crawlers, distributed workflow results, and an allow-listed external synchronization API.

Crawling

Crawler workflows collect program and scope data from supported platforms. The combined crawler covers HackerOne, Bugcrowd, Intigriti, and YesWeHack; Synack uses its separate operator-machine path.

A successful crawl upserts the records it observed and refreshes their updated_at values. This is a crawl refresh, distinct from the pulse workers send to report liveness.

platform crawler
      │ structured output
      ▼
workflow result ingestion
      │ upsert
      ▼
programs · scopes · assets

Workflow results

A workflow step may declare that its JSON or JSONL output should be saved to an approved output table. The engine streams that output through the same bulk-upsert pipeline used by other acquisition paths.

Workflow authors choose the physical output contract; Inventory owns the meaning and relationships of the resulting records. See the workflow engine's output-schema reference for the exact table contract.

External synchronization

The authenticated asset-ingest boundary accepts only discovered asset data. Its allow-list includes domains, IP addresses, domain/IP links, ports, HTTP ports and paths, verification rows, technologies and their bindings, and mobile apps.

It explicitly rejects programs and scopes. An external agent may contribute observations but may not redefine an engagement boundary.

External synchronization uses the same streaming upsert processor as workflow output, without a MinIO round-trip. Parent observations must exist before child observations can be linked:

domains · IP addresses
          │
          ▼
ports · HTTP paths · technologies · domain/IP links
          │
          ▼
verification rows · technology bindings

Guarantees and limits

• Re-sending the same canonical observation updates it instead of creating a duplicate.
• Every accepted write refreshes updated_at.
• A write does not create scope membership by itself; AI resolution performs that association under existing scope rules.
• A missing parent can prevent a child from being materialized. Synchronization clients must compare sent and accepted counts.