Watch mode is used for continuous asset change monitoring: it periodically rescans the seed assets, diffs against the previous result, outputs newly added/disappeared assets, and optionally pushes alerts via Webhook. It suits "delta + network hang-up alerting" scenarios.

Startup¶

python main.py -d example.com --watch

• Seeds only support domain and url (not ip)
• Each round uses a brand-new engine instance to run a full scan
• Ctrl+C exits gracefully

Main Configuration¶

monitoring:
  interval: 3600      # polling interval (seconds); e.g., 0 = exit right after completing the first baseline round
  webhook_url: null   # change alert Webhook URL (POST JSON)

Workflow¶

Each round of the loop:

1. Check the global stop flag; if set, exit
2. engine.run() runs the full scan for this round
3. Collect the current asset UID set as cur_uids
4. First round establishes the baseline: if prev_uids is empty → record the baseline, log Baseline established: N assets, wait one interval, then move to the next round (no changes are reported in the first round)
5. Delta comparison:

added   = cur_uids − prev_uids   # newly added assets
removed = prev_uids − cur_uids   # disappeared assets

1. Change report:

changes = {
    'timestamp': <ISO8601>,
    'added': [...],
    'removed': [...]
}

• When there are changes, write changes to <output_dir>/changes_YYYYMMDD_HHMMSS.json and log Changes detected: +N added, -N removed
• When webhook_url is configured, POST json=changes (10-second timeout) and log by status code; on exception, log Webhook notification failed

• When there are no changes, log No changes detected

• Interval scheduling: sleep = max(0, interval − elapsed time of this round), i.e., subtract the scan duration before waiting

Example Change File¶

output/changes_20260812_231800.json:

{
  "timestamp": "2026-08-12T23:20:00",
  "added": ["domain:new.example.com", "ip:93.184.216.35"],
  "removed": ["url:https://old.example.com/"]
}

Webhook Alerts¶

Configure monitoring.webhook_url to receive a POST JSON request whenever changes are detected. The payload is the changes structure above. Typical webhook receivers include WeCom (WeChat Work) bots, Slack, self-hosted services, etc.