How to Trigger an Internal Scan

Configure and start an internal discovery or assessment run.

Internal assessment runs through an agent deployed inside the approved environment. The agent supplies reachable subnet inventory and executes work from inside that network.

Assessment intents can execute exploits, change AD/ADCS or host state, capture credentials, deploy callbacks, forge tickets, or copy data. Confirm authorization, exclusions, and cleanup ownership before launch.

Before You Start

1. Install the agent from Settings -> Agent or Download Agent.

2. Place it on a host that can route to the approved networks.

3. Confirm it is connected and reports the expected subnets and interfaces.

4. Agree which exploit families, relay/intercept behavior, and state-changing actions are allowed.

Download Agent

Cloud control-plane work also uses Internal Assessment, but requires an agent on a supported cloud VM with an attached workload identity.

Run a Cloud Assessment

1. Choose the Intent

Open Modules -> Internal Assessment -> Run Assessment.

Intent	Behavior
Discovery	Enumerates reachable systems, accounts, services, and trust relationships without exploitation.
Assessment	Tests inventory already discovered for the selected environment.
Discovery + Assessment	Discovers the environment first, then tests the systems and paths found.

Use Discovery plus Assessment when inventory should be refreshed before testing.

2. Select the Agent and Scope

Choose the connected execution agent. Only subnets reported as reachable by that agent are shown.

Select one or more top-level subnets. To narrow execution inside a subnet, enter a partial target as:

• a single IP, such as 10.10.10.25;

• an IP range, such as 10.10.10.20-10.10.10.50;

• a CIDR, such as 10.10.10.0/24.

Partial targets must remain inside their top-level subnet. They narrow the run; they do not create a new root subnet.

For an Assessment-only intent, select previously discovered internal or cloud targets presented by the wizard.

3. Configure Scan Settings

Discovery Controls

Cloud collection uses the selected agent's attached workload identity when one is present.

• AWS resource name prefixes are optional. Add them only when AWS collection is in scope and the engagement needs to restrict resources by literal name prefix.

• Azure, GCP, local network, Active Directory, and hybrid environments do not require an AWS prefix.

• Runtime fields set optional discovery and post-discovery assessment limits; 0 disables the corresponding limit.

Attack Selection

Enable only exploit families approved for the engagement. Defaults can include credential, configuration, privilege-escalation, lateral-movement, code-execution, directory-service, and cloud categories.

The final review shows how many families are enabled. Recheck state-changing categories even if they were selected by default.

PCE Intercept/Inveigh

Enable intercept/relay behavior only when explicitly approved. Select at least one valid interface on the chosen agent; launch is blocked when intercept is enabled without an interface.

RCE Safeguards

Use the available skip controls when repeated command execution is unnecessary after the graph already proves that a host or user is compromised.

Entity Exclusions

Exclude discovered hosts, users, groups, services, or other entities that must not be tested. Refresh the entity list if discovery recently added inventory.

Internal Assessment Destructive Actions

4. Choose Automation

Run immediately or configure a one-time or recurring schedule. Scheduled runs store the selected agent, scope, exploit choices, exclusions, interfaces, safeguards, and runtime settings submitted at creation time.

Recreate a schedule when its agent, scope, credentials, or authorization changes.

5. Review and Start

Confirm:

• intent, agent, and selected subnets or discovered targets;

• partial targets;

• enabled exploit families and destructive-action warnings;

• PCE Intercept/Inveigh and selected interfaces;

• RCE safeguards and excluded entities;

• runtime limits, estimates, and schedule.

Choose Start run or Schedule run. Validation messages identify the step that must be corrected before launch.

Monitor and Triage

• Activity -> Activity shows execution status and cancellation controls.

• Activity -> Attack Logs contains detailed operational logs.

• Internal Assessment -> Statistics summarizes results.

• Internal Assessment -> Attack Paths contains validated findings.

• Reports generates assessment deliverables.

Common Blocks

Problem	Check
No agent can be selected	Confirm a compatible internal agent is connected and assigned to the workspace.
Expected subnet is missing	Confirm the selected agent reports and can route to that subnet.
Partial target is rejected	Keep the IP, range, or CIDR inside its listed top-level subnet.
Intercept is enabled but launch is blocked	Select at least one interface on the execution agent.
AWS prefix validation appears for a non-AWS run	Clear AWS-specific scope; prefixes are optional and should not block local, Azure, GCP, or hybrid runs.