A child asset can be related to more than one root asset, such as via an IP or DNS server. However, it can only be attached to one parent asset — specifically, the one to which Attaxion traces its lineage back.
How Are Root Assets Assigned to Child Assets?
When you add and verify a root asset, Attaxion uses it to find associated assets and then attaches newly discovered assets to that root.
For instance, using asset discovery methods (e.g., reverse DNS lookup and reverse WHOIS lookup) on example.com may lead to the discovery of a.example[.]org. In this case, a.example[.]org will be attached to example[.]com.
Why Is an Asset Related to More Than One Root Asset?
An asset can be related to one or more root assets if it’s discovered through multiple roots. In the above example, if later example[.]org is added or discovered, it might also lead to the rediscovery of a.example.org (previously discovered through example[.]com). This indicates that the asset has a traceable connection to both roots, either via IP, WHOIS, or DNS server.
However, this doesn’t change the fact that a.example[.]org was originally discovered through example[.]com, so Attaxion will attach a.example[.]org to example[.]com as a child asset.
What Happens To An Asset When You Remove One Root?
When a root asset is removed, Attaxion checks if any of the assets connected to it can be reattached to a different root. In our sample scenario above, if the original root — example[.]com— is removed, Attaxion checks if a.example[.]org that has been attached to it can still be connected to something. It knows that it is also associated with example.org, so the asset will be reassigned to the remaining root.
If there are no other roots, the child asset will be deleted together with its root asset that you removed.