Home / Help centre / Scan profiles
Scan profiles
What's the difference between focus rules and avoid rules?
Focus rules steer a scan toward the parts of your target you care about most. Avoid rules keep it away from parts you want left alone. Both use the same row: a description, a type and a value. You add them in the Scope section of a profile.
The short version
Focus says "look here". Avoid says "stay out of here". The two lists sit one above the other in the Scope section, under the heading Scope rules, and each one starts empty with the text "No rules."
How it works in Cyberlop
Each list has a + Add rule button. A new row asks for three things: a Description in your own words, a Type chosen from a list, and a Value that the type applies to. A trash icon at the end of the row removes it.
| Focus rules | Avoid rules | |
|---|---|---|
| Purpose | Direct attention to a part of the target | Keep the scan away from a part of the target |
| Typical use | A new checkout area you changed this week | A path that sends real emails or a page that must stay untouched |
| Row fields | Description, Type, Value | Description, Type, Value |
The rule types are the same in both lists. They are Url Path, Subdomain, Domain, Method, Header, Parameter and Code Path. Our page on rule types explains each one.
The examples in the table are ours, not taken from the app. The app shows the empty state and the three fields, and it leaves the choice of rules to you.
What to do next
Use focus rules when your time is short or a release touched one area. Use avoid rules to protect anything that should not be exercised, for instance a path that triggers a real payment or an external partner call. A scan should only ever test what you are allowed to test, so avoid rules and the Rules of engagement field in Reporting are a good place to write those limits down.
Step-by-step guides: add a focus rule, exclude a path or subdomain and remove a scope rule. The tutorial is focus and avoid rules.
Related questions
- Which rule types can I use in focus and avoid rules?
- How do I add a focus rule so a scan concentrates on certain paths?
- How do I exclude a URL path or subdomain from a scan?
- How do I delete a focus or avoid rule?
- How do I add rules of engagement, such as no destructive payloads in production?
How to set focus and avoid rules on a scan profile
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.