Logging

Logs record scan and system events that are useful for troubleshooting. They are separate from final findings: a scan can produce useful logs even when it produces no vulnerabilities.

When to Use Attack Logs

Use Activity -> Attack Logs when:

• a module or submodule failed;

• a scan is stuck or slower than expected;

• a browser session stopped working;

• a target blocked or rate-limited requests;

• an internal agent disconnected;

• an internal host or service was unreachable;

• a scheduled run did not start;

• you need scan evidence for review or escalation.

What to Look For

Symptom	Log evidence to check
Browser session failed	validation errors, replay failures, expired auth, missing storage, verification URL mismatch.
Target blocked scanner	HTTP 403/429 patterns, WAF pages, captcha loops, rate-limit calibration failures.
Internal agent issue	disconnects, heartbeat gaps, job pickup failures, route or interface errors.
Module timeout	max runtime cancellation, submodule timeout, long-running job status.
Queue delay	scheduled/running state with delayed worker pickup.

Filtering

Filter logs by time range, module, severity, and text search. Start with the module reference from Activity -> Activity, then narrow to the failing time window.