A collection only becomes useful once assets are associated with it. SpartanX supports a broad range of asset types — from URLs and IP addresses to mobile app binaries — and the process of adding them is fast, with built-in validation to catch errors before an engagement runs.
Navigating to Assets
From the left-hand navigation, click the Assets tab. At the top of the asset view, select the collection you want to add assets to from the dropdown. If a collection has no assets yet, it will show zeros across all asset type counts.
Adding Assets
Click "Add Assets" and select your target collection. Enter the asset you want to add — this can be a domain, IP address, API endpoint, or URL. After entering the address, click "Validate."
Validation only needs to happen once per asset. The platform checks:
DNS resolution — confirms the address resolves correctly
Format validity — catches typos such as double dots or invalid top-level domains
Top-level domain legitimacy — ensures the domain structure is valid
You can add multiple assets at once. In real environments, it's common to add dozens or even hundreds of assets to a collection in a single session.
How SpartanX Classifies Assets
SpartanX automatically classifies assets based on how you enter them. For example:
A full domain URL (e.g., https://example.com) is classified as a web application, which includes API coverage
A path-specific URL (e.g., /graphql) is classified as an API endpoint only
This distinction matters for engagement scope — a web application classification will include both web and API testing, while an API-only classification focuses the engagement narrowly.
Mobile App Assets
For mobile applications, add the binary file rather than a URL:
iOS apps: drag and drop the IPA file
Android apps: drag and drop the APK file
Once uploaded, the mobile binary becomes an asset in the collection and can be included in static analysis (SAST) and dynamic analysis (DAST) engagements.
What's Next
With assets added and a collection ready, you're set to run an engagement. The next section provides an overview of all engagement types available in SpartanX — from full-scope red team operations to targeted attack validation and remediation verification.





