> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/cloud-assessment-reference/advanced-cloud-assessment-settings.md).

# Advanced Settings

Configure retest mode, regional monitoring coverage, and rollback when an assessment requires them.

Most assessments can leave these settings at their defaults.

## Validate Pre-existing Vulnerabilities

Enable **Validate pre-existing vulnerabilities** only for a controlled retest of stored findings under the selected cloud scope.

Retest mode runs supported validation steps from eligible stored findings and filters them by the selected test categories. It does not run the normal host and service assessment.

Before enabling it, confirm the finding still belongs to the selected scope and the attached cloud identity remains approved.

## Regional Monitoring Coverage

This setting supports the unused-region defense-evasion test. Leave it empty unless a current customer or provider monitoring inventory identifies an approved unmonitored region.

Required fields are:

| Field                       | Required value                                                     |
| --------------------------- | ------------------------------------------------------------------ |
| Authority type              | `customer_monitoring_inventory` or `provider_monitoring_inventory` |
| Coverage source ID          | Stable identifier of the monitoring inventory                      |
| Coverage source version     | Exact version used for the assessment                              |
| Observed at                 | ISO 8601 timestamp with timezone                                   |
| Valid until                 | Future ISO 8601 timestamp with timezone                            |
| Selected unmonitored region | Region approved for the controlled test                            |
| Unmonitored regions         | Unique list containing the selected region                         |
| Monitored regions           | Unique list that does not contain the selected region              |

The provider and cloud scope ID must match the selected target. Expired, contradictory, or incomplete coverage information is rejected.

Provider dependencies are also required:

* **AWS:** AMI ID, subnet ID, security group ID, availability zone, and an owned termination-probe EC2 instance.
* **Azure:** approved resource group and an immutable container image reference using `image@sha256:digest`.
* **Google Cloud:** approved zone, public image URL, image numeric ID, and exact subnetwork URL.

Do not infer monitoring coverage from missing resources or graph nodes.

## Rollback

**Rollback supported changes after attack phase** is disabled by default. Some state-changing tests do not run unless it is enabled.

When enabled, supported tests record restoration data and queue rollback after assessment work finishes. Rollback does not cover every provider action, exposed credential, external effect, or concurrent resource change.

Confirm the attached identity can perform the required restoration actions, then verify provider state after the assessment even when rollback reports success.

Use [Safety and Cleanup](/enterprise/cloud-assessment-reference/cloud-assessment-safety-and-cleanup.md) for post-assessment verification.