Enumeration Workflow & Writing the Conclusion

What is it?

An enumeration workflow is the loop from a question to a conclusion: choose the scan the question needs, run it in scope, read hosts → states → services/versions, compare to baseline, and write what to do about the exposure.

Why it matters

A scan without a conclusion is wasted. The value is the sentence at the end: 'FIN-07 exposes an outdated SSH to the user VLAN; restrict and patch.'

Where you see it

An admin's change-audit note, an analyst's exposure finding, a responder's segment map — each ends in a recommended action tied to specific evidence.

What normal looks like

A tidy conclusion: which host, which service/version, why it matters, and the recommended action — all traceable to the scan output.

What suspicious looks like

In your own work: a pile of scan output with no decision, or a conclusion not supported by the evidence you captured.

How analysts investigate

Pick the narrowest scan that answers the question, capture the output as evidence, compare hosts against each other and the baseline, and end with one defensible recommendation per finding.

Common beginner mistakes

Running the biggest, noisiest scan instead of the one the question needs.
Ending at raw output instead of a written, evidence-backed conclusion.

Question → scan → evidence → conclusion

  Q: does any user-VLAN host expose remote admin?
    discover live hosts → scan admin ports → version-detect
  finding: FIN-07  22/tcp OpenSSH 7.2p2  reachable from 10.20.4.0/24
  conclusion: outdated SSH exposed to users → restrict source + patch
  every conclusion cites the exact evidence line

The workflow ends in one evidence-backed recommendation per finding.

Quick check

You found FIN-07 exposing OpenSSH 7.2p2 to the user VLAN. What is a defensible conclusion?

A quick self-check — it doesn't affect your XP or progress.