Home / Help centre / Scan profiles
Help centre
Scan profiles
Scope, vulnerability classes, rules and reporting settings for each scan. 45 answers.
How to
- How do I create a scan profile?
- How do I add tags to a scan profile?
- How do I choose which vulnerability classes a profile tests?
- How do I make a profile test all vulnerability classes?
- How do I turn off the exploitation phase?
- How do I make a profile run on a self-hosted scan agent instead of the cloud?
- How do I add a focus rule so a scan concentrates on certain paths?
- How do I exclude a URL path or subdomain from a scan?
- How do I stop a scan from testing a certain HTTP method?
- How do I focus a white-box scan on one part of my codebase?
- How do I keep the scanner away from a particular parameter or header?
- How do I delete a focus or avoid rule?
- How do I set a minimum severity for a profile's report?
- How do I leave low-confidence findings out of the report?
- How do I steer how the final report is written?
- How do I add rules of engagement, such as no destructive payloads in production?
- How do I fill in the Application context for a profile?
- How do I auto-generate the Application context from my repository?
- How do I preview the YAML config a profile generates?
- How do I edit an existing scan profile?
- How do I delete a scan profile?
- How do I find a profile by name, target or tag?
- How do I filter the profiles list by tag?
- How do I move between Scope, Authentication and Reporting in a profile?
Fix a problem
- Why does the profiles list show "All" under Vuln classes?
- Why can't I change the target on my scan profile?
- Why won't a profile set to my scan agent start a scan?
- Why doesn't my scan agent appear in the Scan location list?
- Why doesn't the YAML preview show my passwords or tokens?
- I typed a tag but it wasn't added to my profile. What did I miss?
- Why can't I save a new profile without choosing a target?
- The target picker in my new profile is empty. Why?
- Why can't Auto Generate from Repo fill the context for my black-box target?
- Why is the exploitation phase turned on in my new profile when I didn't tick it?
Understand it
- Can I have more than one scan profile for the same target?
- What is a scan profile?
- What does the exploitation phase do?
- Which vulnerability classes can Cyberlop test for?
- What does the Business-logic class cover?
- What's the difference between the Auth and Authz classes?
- What does the Config class look for?
- What kinds of injection does the Injection class cover?
- Does Cyberlop check for exposed secrets and vulnerable dependencies?
- What's the difference between focus rules and avoid rules?
- Which rule types can I use in focus and avoid rules?
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.