> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-an-internal-scan.md).

# How to Trigger an Internal Scan

Configure and start an internal discovery or assessment run.

Internal assessment runs through an agent deployed inside the approved environment. The agent supplies reachable subnet inventory and executes work from inside that network.

{% hint style="warning" %}
Assessment intents can execute exploits, change AD/ADCS or host state, capture credentials, deploy callbacks, forge tickets, or copy data. Confirm authorization, exclusions, and cleanup ownership before launch.
{% endhint %}

## Before You Start

1. Install the agent from **Settings -> Agent** or **Download Agent**.
2. Place it on a host that can route to the approved networks.
3. Confirm it is connected and reports the expected subnets and interfaces.
4. Agree which exploit families, relay/intercept behavior, and state-changing actions are allowed.

{% content-ref url="/pages/qJVQdMWQN3SOOKDv02QD" %}
[Download Agent](/enterprise/download-agent.md)
{% endcontent-ref %}

Cloud control-plane work also uses Internal Assessment, but requires an agent on a supported cloud VM with an attached workload identity.

{% content-ref url="/pages/cycdJfiZOF1JvOhhmyH7" %}
[Run a Cloud Assessment](/enterprise/how-to-trigger-a-cloud-assessment.md)
{% endcontent-ref %}

## 1. Choose the Intent

Open **Modules -> Internal Assessment -> Run Assessment**.

| Intent                     | Behavior                                                                                        |
| -------------------------- | ----------------------------------------------------------------------------------------------- |
| **Discovery**              | Enumerates reachable systems, accounts, services, and trust relationships without exploitation. |
| **Assessment**             | Tests inventory already discovered for the selected environment.                                |
| **Discovery + Assessment** | Discovers the environment first, then tests the systems and paths found.                        |

<figure><img src="https://232193438-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwolEZzMm5QD9NoFKutSj%2Fuploads%2Fgit-blob-e07608236d82dfc74fc9c057659d751b140fc7ca%2Frun-assessment-internal-intent.jpg?alt=media" alt="Internal Run Assessment intent choices"><figcaption><p>Use Discovery plus Assessment when inventory should be refreshed before testing.</p></figcaption></figure>

## 2. Select the Agent and Scope

Choose the connected execution agent. Only subnets reported as reachable by that agent are shown.

Select one or more top-level subnets. To narrow execution inside a subnet, enter a partial target as:

* a single IP, such as `10.10.10.25`;
* an IP range, such as `10.10.10.20-10.10.10.50`;
* a CIDR, such as `10.10.10.0/24`.

Partial targets must remain inside their top-level subnet. They narrow the run; they do not create a new root subnet.

For an Assessment-only intent, select previously discovered internal or cloud targets presented by the wizard.

## 3. Configure Scan Settings

### Discovery Controls

Cloud collection uses the selected agent's attached workload identity when one is present.

* **AWS resource name prefixes** are optional. Add them only when AWS collection is in scope and the engagement needs to restrict resources by literal name prefix.
* Azure, GCP, local network, Active Directory, and hybrid environments do not require an AWS prefix.
* Runtime fields set optional discovery and post-discovery assessment limits; `0` disables the corresponding limit.

### Attack Selection

Enable only exploit families approved for the engagement. Defaults can include credential, configuration, privilege-escalation, lateral-movement, code-execution, directory-service, and cloud categories.

The final review shows how many families are enabled. Recheck state-changing categories even if they were selected by default.

### PCE Intercept/Inveigh

Enable intercept/relay behavior only when explicitly approved. Select at least one valid interface on the chosen agent; launch is blocked when intercept is enabled without an interface.

### RCE Safeguards

Use the available skip controls when repeated command execution is unnecessary after the graph already proves that a host or user is compromised.

### Entity Exclusions

Exclude discovered hosts, users, groups, services, or other entities that must not be tested. Refresh the entity list if discovery recently added inventory.

{% content-ref url="/pages/Wo8uaAQGOpoDSX3mEaRZ" %}
[Internal Assessment Destructive Actions](/enterprise/how-to-trigger-an-internal-scan/internal-assessment-destructive-actions.md)
{% endcontent-ref %}

## 4. Choose Automation

Run immediately or configure a one-time or recurring schedule. Scheduled runs store the selected agent, scope, exploit choices, exclusions, interfaces, safeguards, and runtime settings submitted at creation time.

Recreate a schedule when its agent, scope, credentials, or authorization changes.

## 5. Review and Start

Confirm:

* intent, agent, and selected subnets or discovered targets;
* partial targets;
* enabled exploit families and destructive-action warnings;
* PCE Intercept/Inveigh and selected interfaces;
* RCE safeguards and excluded entities;
* runtime limits, estimates, and schedule.

Choose **Start run** or **Schedule run**. Validation messages identify the step that must be corrected before launch.

## Monitor and Triage

* **Activity -> Activity** shows execution status and cancellation controls.
* **Activity -> Attack Logs** contains detailed operational logs.
* **Internal Assessment -> Statistics** summarizes results.
* **Internal Assessment -> Attack Paths** contains validated findings.
* **Reports** generates assessment deliverables.

## Common Blocks

| Problem                                         | Check                                                                                                   |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| No agent can be selected                        | Confirm a compatible internal agent is connected and assigned to the workspace.                         |
| Expected subnet is missing                      | Confirm the selected agent reports and can route to that subnet.                                        |
| Partial target is rejected                      | Keep the IP, range, or CIDR inside its listed top-level subnet.                                         |
| Intercept is enabled but launch is blocked      | Select at least one interface on the execution agent.                                                   |
| AWS prefix validation appears for a non-AWS run | Clear AWS-specific scope; prefixes are optional and should not block local, Azure, GCP, or hybrid runs. |