How to manage targets in Cyberlop: list, export, change and delete

To manage targets in Cyberlop, open Targets: the list shows every application with its latest findings, and each row lets you scan it, download its latest PDF report or delete it. A target is the application under assessment. You cannot edit one, because targets are immutable. To change a URL, repository, branch or environment, delete the target and create it again.

What can you do from the Targets page?

The Targets page is the working list of applications under assessment, your registered attack surface. From here you can search the list, scan a target, download its report, export the list or delete a target, and the severity dots give you each target's results at a glance. Opening a row takes you to the target detail page.

Across the top are three controls: Export JSON, Export CSV and + New target. The search box beneath them reads "Search targets by name, URL, or tag...", so any of those three finds a target. For adding targets, see Add a target.

What does each column in the Targets list mean?

The document icon appears only on a target that has a completed scan. Its tooltip reads "Download the latest report (PDF)". The trash icon's tooltip is "Delete target (targets are immutable — delete and recreate to change settings)".

Why keep your list of targets tidy?

An accurate target list is an asset inventory for the applications you test, and you can only test what you have registered. Public guidance treats inventory as routine work, not a one-off. The US CISA Binding Operational Directive 23-01 requires federal agencies to run automated asset discovery every 7 days and to begin enumerating vulnerabilities across the assets they find every 14 days.

You do not need a federal cadence, but the idea carries over. Retire targets that no longer exist. Register new apps when they ship. Set a clear environment on each one, so nobody mistakes a Dev copy for production. A stale list wastes scan effort and buries the apps that matter. To keep scanning regular, use scheduled scans.

How do you read a target detail page?

The target detail page is one scrolling page of cards, with no inner tabs. It shows how the target is configured, whether black-box scans are allowed, and which scan profiles belong to it. Click a row on the Targets list to open it.

What does the Target details card show?

The card lists Name, Main URL, Backend URLs, Repository, Branch, Environment and Team. A note under it tells you what the target can do. A white-box target says "Scans clone the latest from this repository at launch." A target without a repository says "No repository configured — add a Git repository URL to run a scan."

The header carries the target name, the repository URL as a subtitle (or "No repository configured") and a ▷ Scan button.

What does the Ownership verification card show?

This card appears on black-box targets only. A confirmed target shows a Verified badge and the text "Ownership confirmed via Cyberlop staff on <date>. Black-box scans can run." A white-box target with a repository has no such card. The full process is in Verify target ownership.

What does the Scan profiles card show?

Each row shows the profile Name, its Vuln classes, whether Exploit is Enabled and how many Auth roles it holds. Row actions are Edit and ▷ Scan, and + New profile starts a profile with this target already chosen. See Create a scan profile.

How do you scan a target or download its latest report?

Click ▷ Scan on a target row or on the detail page, or use ▷ Scan on one of the target's profile rows. Click the document icon to download the latest PDF report. Both actions are one click from the Targets list.

1. Open Targets.
2. Find the target by name, URL or tag.
3. Click ▷ Scan to run a scan, or the document icon for the latest report as a PDF.
4. Follow the run from Recent Scans. See Run a scan.

The scan starts straight away and keeps going if you leave the page. A black-box target must show Verified before its scans can run.

How do you export your list of targets?

Click Export JSON or Export CSV at the top of the Targets page. Use JSON for scripts and CSV for spreadsheets. Do this before any delete, so you keep a record of names, URLs and environments.

This guide could not confirm which columns the export holds. Open your first export and check it before you treat it as a backup. Findings have their own exports on the Issues page, covered in Export findings as JSON or CSV.

Why can't you edit a target?

Targets are immutable: Cyberlop does not let you change a target once it is created. The API reference describes targets as "Immutable once created", and the trash tooltip says to delete and recreate to change settings. Name, Main URL, Backend URLs, Repository, Branch, Environment and Team all fall under this rule.

The rule protects your history. Every profile, scan and finding hangs off a target, so if a target could change, an old finding might point at a different application or repository than the one that produced it. Because it cannot, each finding keeps referring to the same app and the same code.

What the immutability rule does not cover

Scan profiles are editable, with one exception: a profile's target is fixed after creation. Profile settings such as vulnerability classes, authentication roles and reporting rules can be changed. See Edit a scan profile.

How do you change a target?

Delete the target and create it again with the correct details. Deleting also removes the target's profiles, schedules, scans and findings, so export what you need and note your settings before you start.

1. Open Targets and click Export JSON or Export CSV.
2. Download any PDF reports you want to keep with the document icon, and export findings from Issues.
3. Open the target and write down its details and each profile's settings. Stored credentials are never shown again, so have them ready from your own secret store.
4. Click the trash icon on the target row and confirm.
5. Click + New target and enter the corrected details. See Add a target.
6. Re-create the scan profiles, schedules and tags you need on the new target.
7. Run a first scan and check the result.

A black-box target needs its ownership verified again, so allow time for that. A profile cannot move to another target, because its target is fixed.

Which changes need a delete and recreate?

What happens when you delete a target?

Deleting a target cascades: it removes the target's scan profiles, schedules, scans and findings. The API reference describes DELETE /api/targets/:id as deleting a target that "cascades to profiles, schedules, scans, findings". The app describes no undo, so treat deletion as permanent.

What is removed and what is kept?

Before you click the trash icon

The confirmation dialog shown after you click the trash icon was not captured, so this guide does not describe its wording. Read it carefully when you see it.

Who can delete a target?

Permissions involved

The API reference lists the permission target:delete for deleting a target, target:create for creating one and target:read for listing. If the trash icon does not work for you, your role may lack the permission. An administrator manages roles in Administration, which this guide does not cover. Keep delete rights to least privilege: see API tokens and permissions.

How do you audit target changes?

Open Activity. The audit-style feed records Create · Target with Name, MainUrl and, for white-box, RepoUrl, and Delete · Target with Name and MainUrl. Each entry shows the actor, a timestamp and a short ID. Search by actor, action or entity.

It answers "who removed this target, and when?" Details are in Activity feed. Scan data also follows the retention period in Settings → Organization, so find out how long your organisation keeps it before you rely on old results.

How should you organise targets for a team?

Name targets consistently, fill in the Environment field, add the optional Team field and use tags. Keep one target per application and environment, and let the search box do the rest.

A naming convention that scales

• Name: application plus environment, for example "Orders web (Staging)". The URL shows under the name, but the name is what people scan.
• Environment: Dev, Staging or Prod. Prefer a test environment without real customer data for first scans.
• Team: the owning team in plain words, such as "Platform".
• Tags: profile tags such as prod appear as chips in the list and in search.

Plan limits

How many targets you can hold depends on your plan and is shown in Settings → Plan & usage. Deleting retired targets frees that room.

Troubleshooting: target management problems

What are the common mistakes when managing targets?

• Deleting without exporting. The findings go with the target.
• Looking for an Edit button. There is none. Delete and recreate.
• Deleting the wrong environment. Check the badge and URL, not just the name.
• Testing something you do not own. Register and scan only applications you own or are authorised to test.
• Forgetting follow-up work. A recreated target has no profiles, schedules or verified ownership yet.

Next step: create a scan profile for the target. New here? Getting started walks the full path, and Key terms explains the vocabulary. See also how it works.