Scans
This page lists the existing scans with their summary information. You can run operations on each scan from here.
The controls above the table are:
Date range: Limits the table to scans started in the selected period: All, Last Week, Last Month, Last 2 Months, Last 3 Months or Last Year.
Search: Searches the scans by name.
Refresh: Reloads the list. The list also refreshes itself every 30 seconds.
Export: Exports the scans in the table as a CSV file.
New Scan: Opens the New Scan page. It requires the WriteScan permission.
Each row has a three-dot menu with the scan operations.
Information
Date: Start date and time of the scan.
Elapsed Time: How long the scan took.
Name: Name of the scan. The name links to the Issues page of the scan. Scans created with Continuous Assessment carry a Main badge on the recurring main scan and a Child badge on each scan it runs.
Policy: The scan policy used by the scan. (See Policies)
Issue Counts: The number of issues found, by severity.
The badge colours are:
Critical
High
Medium
Low
Info
Risk: The overall risk score of the scan, calculated from the severity of the issues found and the number of entities they affect.
Exposure Point: The total exposure points of the issues found in the scan.
Recurring: How often the scan repeats. (See Continuous Assessment)
Status: Status of the scan. Hover over the status badge to see the current stage of the scan. A running scan shows its progress, for example Running (%45).
The Finished badge of a completed Active Directory scan carries a heartbeat icon. It links to the Scan Health page of the scan, which shows how completely each module collected its data.
The Risk column draws the score as a gauge. Scans scored with the current risk model show the value with two decimals, for example 74.90. Scans scored by an older model keep their whole-number score, for example 100.
A scan with remediation scans carries a wrench badge next to its name, with the number of remediation scans. Hovering it reads N remediation scans. Open this scan to review the results. Open the scan to see what each one verified.
While the reports are being rebuilt, Rebuilding reports appears under the status. Package not built appears when the offline report package could not be produced.
The possible status values are:
Scan has been scheduled and going to start in a short period.
Scan is running.
The necessary enumerations and assessments have been done. Currently, generating the output reports regarding scan results.
The Credential Discovery Enumeration module is searching the discovered shares for secrets.
The Tier0 Analysis module is calculating the attack paths toward Tier 0 assets.
The scan has been completed successfully.
The scan has been completed with failure.
The scan has been canceled from the user interface. Graceful shutdown operations for the current scan are continuing.
The scan has been canceled from the user interface. Graceful shutdown operations has been completed. Scan has been completely stopped.
Deletion operations for the current scan are continuing.
The scan cannot run because the license does not allow it.
Operation
The three-dot menu of every row has Edit, Clone and Delete. The report operations appear once the scan reaches the Generating Reports, Credential Discovery, Tier0 Analysis or Finished state.
Edit
On the Edit Scan page, you can change the name and description of any scan. The start time and the policies of a one-time scan are read-only.
For a recurring Main scan, you can also change the start time, the policies and the frequency of the child scans it runs. Once the main scan is stopped, its child scan start time, policies and schedule can no longer be changed.
Clone
Opens the New Scan page filled in with the settings of the selected scan.
Executive Summary (PDF)
Downloads the executive summary report of the selected scan.
Full Report (PDF)
Downloads the full PDF report of the selected scan, including the affected entities.
Report Package (ZIP)
Downloads an archive with the report and its affected-entity evidence. It requires the DownloadReportPackage permission.
Send Report via Email
Sends the report of the selected scan by email. The option is disabled until an active Mail configuration exists.
Regenerate Reports
Rebuilds the reports of the selected scan with the current Report Settings. While the rebuild runs, the download operations are disabled and the row shows Rebuilding reports.
Delete
Deletes the selected scan. It requires the DeleteScan permission.
Stop
Scans in the Scheduled, Running, Generating Reports, Credential Discovery or Tier0 Analysis state have a Stop option. Recurring Main scans have it until they are stopped. Stop tells the scanner engine to stop the scan gracefully.
Last updated
Was this helpful?