You can investigate assets exposed to the internet by reviewing issues detected by Cloud Network Analyzer or by using Graph Search.
### **Investigate internet exposure issues**
Review internet exposure issues to learn which assets are exposed to the internet. You can find internet exposure issues under **Cases & Issues**.
1. Go to **Cases & Issues**.
2. Select the **Detection Method** filter and then select the **Cloud Network Analyzer** as the **Detecting Engine**.
3. Select a specific issue to investigate. You can review:
* Affected asset
* Policy that triggered the exposure
* Exposure details (Public IP, FQDN, protocol, port, and HTTPs response code)
* Exposure path
4. From an issue, you can navigate to a specific affected asset and investigate further by clicking on the **Network** tab. The Network tab provides in-depth visibility over specific network details and internal network reachability:
<div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>NOTE:</strong></p><p>The <strong>Network</strong> tab is currently only available for virtual machines.</p></div>
<div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>NOTE:</strong></p><p>The <strong>Network</strong> tab is only displayed when you have access to the main asset and associated ones, such as security groups, VPCs and subnets. For more information on Scope-Based Access Control (SBAC) for configuring granular scoping, see Manage user scope.</p></div>
* **Networking Details:** Access details such as where the VM is deployed, connected subnets, and associated network security controls. Review a visual representation of the asset and all the private IPs connected to it.
* **Networking Security Rules:** An interface to investigate the network rules associated with the asset.
### **Investigate internet-exposed assets using Graph Search**
You can use What is Graph Search? to search for and investigate internet-exposed assets.
1. Go to **Investigation and Response → Search → Query Builder → Graph Search**.
2. Define a query that finds selected assets where Internet Exposed = True:
1. Select one or more specific asset types that are supported by CNA exposure detection, such as a **Virtual Machine** or a **Kubernetes Workload**.
2. Add a condition **WHERE Internet Exposed = True**.
3. Click **Search**.
4. Click on an object and then click on **View Details** to view details of the asset.
5. Investigate further by clicking on the **Network** tab. The **Network** tab provides in-depth visibility over specific network details and internal network reachability:
<div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>The <strong>Network</strong> tab is currently only available for virtual machines.</p><p>The Network tab is only displayed when you have access to the main asset and associated ones, such as security groups, VPCs and subnets. For more information on Scope-Based Access Control (SBAC) for configuring granular scoping, see Manage user scope.</p></div>
* **Networking Details:** Access details such as where the VM is deployed, connected subnets, and associated network security controls. Review a visual representation of the asset and all the private IPs connected to it.
* **Networking Security Rules:** An interface to investigate the network rules associated with the asset.