Vulnerability scans

Vulnerability scans (under Systems, behind "More", for organization administrators) scans the hosts your systems are reached at for known vulnerabilities, now or on a schedule. It is listed in the sidebar only once a vulnerability scanner is set up on your installation; until then the page says so and nothing can be queued.

Targets

A target belongs to a system in your Systems register: a public IP address, a range of at most 256 addresses (a /24 in IPv4, a /120 in IPv6), or a host name, up to 50 targets in all. Private and reserved addresses are refused, and so is a range that includes one. A host name is scanned at the public IPv4 addresses it resolves to when the scan is sent, and checked again then: a host name that no longer resolves to a public address is left out of that scan, and the scan says so. Scan only what your organization owns or is authorized to test.

Scanning

Start a scan scans every target of a system that is not closed. A schedule runs once per period (daily, weekly or monthly), inside a four-hour window starting at the hour you choose, in the time zone you choose. A schedule acts with the authority of the administrator who set it up: if that person is no longer an administrator, it does not run until someone adds it again. Your organization may run a few scans at once.

When a scan finishes, its report is kept with the scan (download it from the scan's row), and each new critical or high vulnerability is opened as a finding, for you to confirm, remediate or record as an accepted risk; a scan opens at most 50 and says how many more it found. The same vulnerability on the same host is one finding across scans: one still open is not opened again, one you accepted or called a false positive is never opened again, and one you resolved is opened again if a later scan finds it. Whoever started the scan (for a scheduled scan, whoever set the schedule up) is notified when it completes or fails.

Cancel stops the scan at the scanner as well; if the scanner cannot be reached, the page says so and the scan may still finish there.

A scan is not a penetration test and does not prove a system secure: it reports what the scanner found on the hosts you named, on the day it ran.