> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/scans/scans.md). # Scans This page lists the existing scans with their summary information. You can run operations on each scan from here. The controls above the table are: * **Date range**: Limits the table to scans started in the selected period: **All**, **Last Week**, **Last Month**, **Last 2 Months**, **Last 3 Months** or **Last Year**. * **Search**: Searches the scans by name. * **Refresh**: Reloads the list. The list also refreshes itself every 30 seconds. * **Export**: Exports the scans in the table as a CSV file. * **New Scan**: Opens the [New Scan](/forestall/scans/new-scan.md) page. It requires the **WriteScan** permission. Each row has a three-dot menu with the scan operations.

## Information **Date**: Start date and time of the scan. **Elapsed Time**: How long the scan took. **Name**: Name of the scan. The name links to the [Issues](/forestall/issues.md) page of the scan. Scans created with [Continuous Assessment](/forestall/scans/new-scan.md#continuous-assessment) carry a **Main** badge on the recurring main scan and a **Child** badge on each scan it runs. **Policy**: The scan policy used by the scan. (See [Policies](/forestall/scans/policies.md)) **Issue Counts**: The number of issues found, by severity. The badge colours are: | Colour | Severity | | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :----------: | | ![scan\_list\_colour\_1](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-a6f30d0d9dff98e3d7f9c06e636248d6ae32f152%2Fscan_list_colour_1.png?alt=media) | **Critical** | | ![scan\_list\_colour\_2](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-a0ef3cb4b4aa6119f0f146b06fcc4c88067a1758%2Fscan_list_colour_2.png?alt=media) | **High** | | ![scan\_list\_colour\_3](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-9e681825477ae98d8113cab019f0f9dc4bb141a9%2Fscan_list_colour_3.png?alt=media) | **Medium** | | ![scan\_list\_colour\_4](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-891a9fc1f7094f884fb55f9d39418e4b9b669c61%2Fscan_list_colour_4.png?alt=media) | **Low** | | ![scan\_list\_colour\_5](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-3335451a2853e10cc18ceca8c47da12ad72d5328%2Fscan_list_colour_5.png?alt=media) | **Info** | **Risk**: The overall risk score of the scan, calculated from the severity of the issues found and the number of entities they affect. **Exposure Point**: The total exposure points of the issues found in the scan. **Recurring**: How often the scan repeats. (See [Continuous Assessment](/forestall/scans/new-scan.md#continuous-assessment)) **Status**: Status of the scan. Hover over the status badge to see the current stage of the scan. A running scan shows its progress, for example `Running (%45)`. The **Finished** badge of a completed Active Directory scan carries a heartbeat icon. It links to the [Scan Health](/forestall/scans/scan-health.md) page of the scan, which shows how completely each module collected its data. The **Risk** column draws the score as a gauge. Scans scored with the current risk model show the value with two decimals, for example `74.90`. Scans scored by an older model keep their whole-number score, for example `100`. A scan with remediation scans carries a wrench badge next to its name, with the number of remediation scans. Hovering it reads `N remediation scans. Open this scan to review the results.` Open the scan to see what each one verified. While the reports are being rebuilt, **Rebuilding reports** appears under the status. **Package not built** appears when the offline report package could not be produced. The possible status values are:

Status	Definition
	Scan has been scheduled and going to start in a short period.
	Scan is running.
	The necessary enumerations and assessments have been done. Currently, generating the output reports regarding scan results.
	The Credential Discovery Enumeration module is searching the discovered shares for secrets.
	The Tier0 Analysis module is calculating the attack paths toward Tier 0 assets.
	The scan has been completed successfully.
	The scan has been completed with failure.
	The scan has been canceled from the user interface. Graceful shutdown operations for the current scan are continuing.
	The scan has been canceled from the user interface. Graceful shutdown operations has been completed. Scan has been completely stopped.
	Deletion operations for the current scan are continuing.
	The scan cannot run because the license does not allow it.

## Operation The three-dot menu of every row has **Edit**, **Clone** and **Delete**. The report operations appear once the scan reaches the **Generating Reports**, **Credential Discovery**, **Tier0 Analysis** or **Finished** state.

Scan row actions menu — Actions for Scan

### **Edit** On the **Edit Scan** page, you can change the name and description of any scan. The start time and the policies of a one-time scan are read-only. ![Editing the Scan](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-95c21e5ab0cd68bb3ccc67d1977869b0fcdfe42b%2Fedit-scan.png?alt=media) For a recurring **Main** scan, you can also change the start time, the policies and the frequency of the child scans it runs. Once the main scan is stopped, its child scan start time, policies and schedule can no longer be changed.

### **Clone** Opens the **New Scan** page filled in with the settings of the selected scan. ![Cloning the Scan](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-7eb4fc66c64395931f3688c086fbb8e342eedafa%2FScanClone.png?alt=media) ### **Executive Summary (PDF)** Downloads the executive summary report of the selected scan. ### **Full Report (PDF)** Downloads the full PDF report of the selected scan, including the affected entities. ### **Report Package (ZIP)** Downloads an archive with the report and its affected-entity evidence. It requires the **DownloadReportPackage** permission. ### **Send Report via Email** Sends the report of the selected scan by email. The option is disabled until an active [Mail](/forestall/configuration-center/mail.md) configuration exists. ### **Regenerate Reports** Rebuilds the reports of the selected scan with the current [Report Settings](/forestall/settings.md). While the rebuild runs, the download operations are disabled and the row shows **Rebuilding reports**. ### **Delete** Deletes the selected scan. It requires the **DeleteScan** permission. {% hint style="info" %} With a trial license, **Full Report (PDF)**, **Report Package (ZIP)** and **Delete** are shown with a lock icon and cannot be used. The report files come with a full license, and scan records are kept for the duration of the evaluation. {% endhint %} ### **Stop** Scans in the **Scheduled**, **Running**, **Generating Reports**, **Credential Discovery** or **Tier0 Analysis** state have a **Stop** option. Recurring **Main** scans have it until they are stopped. **Stop** tells the scanner engine to stop the scan gracefully.