Advanced Settings
Configure retest mode, regional monitoring coverage, and rollback when an assessment requires them.
Most assessments can leave these settings at their defaults.
Validate Pre-existing Vulnerabilities
Enable Validate pre-existing vulnerabilities only for a controlled retest of stored findings under the selected cloud scope.
Retest mode runs supported validation steps from eligible stored findings and filters them by the selected test categories. It does not run the normal host and service assessment.
Before enabling it, confirm the finding still belongs to the selected scope and the attached cloud identity remains approved.
Regional Monitoring Coverage
This setting supports the unused-region defense-evasion test. Leave it empty unless a current customer or provider monitoring inventory identifies an approved unmonitored region.
Required fields are:
Authority type
customer_monitoring_inventory or provider_monitoring_inventory
Coverage source ID
Stable identifier of the monitoring inventory
Coverage source version
Exact version used for the assessment
Observed at
ISO 8601 timestamp with timezone
Valid until
Future ISO 8601 timestamp with timezone
Selected unmonitored region
Region approved for the controlled test
Unmonitored regions
Unique list containing the selected region
Monitored regions
Unique list that does not contain the selected region
The provider and cloud scope ID must match the selected target. Expired, contradictory, or incomplete coverage information is rejected.
Provider dependencies are also required:
AWS: AMI ID, subnet ID, security group ID, availability zone, and an owned termination-probe EC2 instance.
Azure: approved resource group and an immutable container image reference using
image@sha256:digest.Google Cloud: approved zone, public image URL, image numeric ID, and exact subnetwork URL.
Do not infer monitoring coverage from missing resources or graph nodes.
Rollback
Rollback supported changes after attack phase is disabled by default. Some state-changing tests do not run unless it is enabled.
When enabled, supported tests record restoration data and queue rollback after assessment work finishes. Rollback does not cover every provider action, exposed credential, external effect, or concurrent resource change.
Confirm the attached identity can perform the required restoration actions, then verify provider state after the assessment even when rollback reports success.
Use Safety and Cleanup for post-assessment verification.
Last updated