What is a Scan?
A Scan is a single execution that tests a specific Asset once.
Scan Types
Section titled “Scan Types”There are two types of scans:
- Comprehensive: The default scan, which tests the entire Asset across all registered vulnerability categories.
- Retest: A scan that re-checks a single Finding to verify the result of a remediation. See Retest Scans for details.
Scan Configuration
Section titled “Scan Configuration”A single Scan holds the following configuration values.
- Asset: The Asset that this scan targets.
- Authentication: The test credentials to use for this scan.
- API Document (optional): An OpenAPI document for the service, uploaded for more accurate results.
- Scan mode: Settings that control how the scan runs.
What a Scan Stores
Section titled “What a Scan Stores”When a scan finishes, its results are preserved. Even when subsequent scans are run against the same Asset, the previous scan’s results stay available for point-in-time comparison.
- Vulnerabilities: The list of vulnerabilities detected in this scan. Each vulnerability is stored together with its severity, category, affected endpoints, and the request/response evidence used to verify it.
- Endpoints: The URLs identified while this scan was analyzing the site.
- Threat scenarios: The attack scenarios Xint AI generated and attempted for this scan. You can trace which scenario was used to test for and discover each vulnerability.
- Scan information: The configuration values that were applied for this scan.