For the complete documentation index, see llms.txt. This page is also available as Markdown.

Advanced Settings

Configure retest mode, regional monitoring coverage, and rollback when an assessment requires them.

Most assessments can leave these settings at their defaults.

Validate Pre-existing Vulnerabilities

Enable Validate pre-existing vulnerabilities only for a controlled retest of stored findings under the selected cloud scope.

Retest mode runs supported validation steps from eligible stored findings and filters them by the selected test categories. It does not run the normal host and service assessment.

Before enabling it, confirm the finding still belongs to the selected scope and the attached cloud identity remains approved.

Regional Monitoring Coverage

This setting supports the unused-region defense-evasion test. Leave it empty unless a current customer or provider monitoring inventory identifies an approved unmonitored region.

Required fields are:

Field
Required value

Authority type

customer_monitoring_inventory or provider_monitoring_inventory

Coverage source ID

Stable identifier of the monitoring inventory

Coverage source version

Exact version used for the assessment

Observed at

ISO 8601 timestamp with timezone

Valid until

Future ISO 8601 timestamp with timezone

Selected unmonitored region

Region approved for the controlled test

Unmonitored regions

Unique list containing the selected region

Monitored regions

Unique list that does not contain the selected region

The provider and cloud scope ID must match the selected target. Expired, contradictory, or incomplete coverage information is rejected.

Provider dependencies are also required:

  • AWS: AMI ID, subnet ID, security group ID, availability zone, and an owned termination-probe EC2 instance.

  • Azure: approved resource group and an immutable container image reference using image@sha256:digest.

  • Google Cloud: approved zone, public image URL, image numeric ID, and exact subnetwork URL.

Do not infer monitoring coverage from missing resources or graph nodes.

Rollback

Rollback supported changes after attack phase is disabled by default. Some state-changing tests do not run unless it is enabled.

When enabled, supported tests record restoration data and queue rollback after assessment work finishes. Rollback does not cover every provider action, exposed credential, external effect, or concurrent resource change.

Confirm the attached identity can perform the required restoration actions, then verify provider state after the assessment even when rollback reports success.

Use Safety and Cleanup for post-assessment verification.

Last updated