DEV Community

facilishz
facilishz

Posted on

Using Change and Novelty Filters for Continuous Monitoring

#zoomeye #monitoring #isnew #ischanged

Using Change and Novelty Filters for Continuous Monitoring

The timeline gap in this incident is its most instructive detail. Solar detected the intrusion in December 2025 and traced it back to early 2024. The Cyber Partisans claimed entry in 2023. Under either version, the defenders did not notice for a year or more.
Detection that lags by a year is not a detection problem in the usual sense. It is a monitoring cadence problem, and cadence can be addressed with data that refreshes on its own.

What ZoomEye's time-scoped fields return

ZoomEye supports is_new (assets first seen within seven days) and is_changed (assets added or updated within seven days), along with after and before for explicit date bounds. On 13 October 2026 the article ran three time-scoped queries.
| Query | Matching assets |
| --- | ---: |
| country="RU" && is_new=true && industry="healthcare" | 0 |
| country="RU" && is_changed=true && industry="healthcare" | 0 |
| country="RU" && service="http" | 25,229,702 |
Both time-scoped sector queries returned zero. Read together with the 896 assets the plain sector query returns, the zeroes show that no Russia-tagged healthcare asset entered or changed within the seven days before the run. Coverage of that sector is stable rather than growing in the index, at least over a one-week window.

Why a zero is worth recording

A zero from a successful query is a measurement, and it stays meaningful as a baseline. Running the same two queries weekly turns them into a series, and a series can show when a sector starts producing new externally visible assets. Change in that series is the signal; a single zero is the starting point.

Limits

A zero here means the scan recorded no new or changed assets under that label during the window. It does not mean the sector is static, because the underlying systems change without necessarily changing what the scan indexes, and it does not mean the labelled subset represents the whole sector. Neither query reaching a non-zero result would by itself indicate a security event.

References

Top comments (0)