> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-an-internal-scan.md).

# How to Trigger an Internal Scan

Internal scanning runs through a local agent deployed in your environment. The agent receives jobs from Pentest Copilot, executes tooling from inside your network, and streams results back to the control plane.

{% hint style="warning" %}
Internal assessment can run active exploitation. Some exploit families can modify AD/ADCS, deploy callbacks, collect files, use credentials, forge tickets, or change host state. Review approved scope before launching.
{% endhint %}

## Internal Scan Flow

1. Connect a local AGENT.
2. Run internal discovery.
3. Review discovered subnets, hosts, users, groups, services, and credentials.
4. Select subnets for internal assessment.
5. Configure agents, allowed exploits, exclusions, PCE Intercept/Inveigh, and RCE controls.
6. Review estimates and destructive-action warnings.
7. Run immediately or schedule from the final run review.
8. Review attack paths and cleanup implications.

## 1. Connect a Local Agent

Open **Settings -> Agent** or **Download Agent** and download the installer for your environment.

The agent must be installed on a host that can route to the approved internal subnets. RTCS assigns the concrete agent identity when the agent connects; do not supply your own agent ID.

After connection, confirm the agent appears in **Dashboard -> Agents** or **Settings -> Agent** with a connected status, subnets, and network interfaces.

{% content-ref url="/pages/qJVQdMWQN3SOOKDv02QD" %}
[Download Agent](/enterprise/download-agent.md)
{% endcontent-ref %}

## 2. Run Internal Discovery

Open **Modules -> Internal Assessment -> Discovery Phase**.

1. Select a connected agent.
2. Review the subnets reported by that agent.
3. Select the subnet or subnets to discover.
4. Optionally add **Partial Subnet Testing** values:
   * single IP, such as `10.10.10.25`;
   * range, such as `10.10.10.20-10.10.10.50`;
   * CIDR, such as `10.10.10.0/24`.
5. Set a confidence level if the operator wants to document certainty in scope.
6. Optionally enable **Trigger Internal Assessment automatically after discovery** if the deployment exposes that control and your team wants an unattended discovery-to-assessment run.
7. Review the estimate and runtime limit warning.
8. Click **Run Discovery** to open the final review, then either start immediately or schedule discovery for later.

Discovery populates the graph with subnets, hosts, services, users, groups, credentials, and other internal entities that the assessment phase can use.

## 3. Open Internal Assessment

Open **Modules -> Internal Assessment -> Attack Phase**.

The page lists discovered subnets. Select the subnets in scope for active assessment.

For each selected subnet, configure:

* **Agent**: the agent that will execute the subnet assessment. Agents in the same subnet are prioritized and labeled.
* **Confidence Level**: operator certainty that target and scope are correct. Use `0` when unsure.
* **Settings**: per-subnet attack settings, exploit selection, and entity exclusions.

## 4. Configure Per-Subnet Settings

Click the settings icon for a selected subnet.

### PCE Intercept/Inveigh

Enable **Start PCE Intercept/Inveigh** only when NTLM capture/relay is approved for the engagement.

When enabled:

* choose one or more interfaces on the selected agent;
* the assessment starts PCE Intercept/Inveigh and ntlmrelayx for the subnet;
* if no interface is selected, the run is blocked until fixed.

### RCE Execution Controls

The drawer includes:

* **Skip RCE if host is already compromised**.
* **Skip RCE if user is already compromised**.

Keep these disabled to run every enabled RCE submodule. Enable them when your team wants to avoid repeated command execution after the graph already proves compromise.

### Exploits Tab

The **Exploits** tab lists exploit families returned by the backend. By default, selected subnets start with all exploit families enabled.

Disable any family that is not approved for the engagement.

The UI labels high-impact categories, such as AD write, DC password, ADCS write, host change, credential use, ticket forging, and data copy. The final review includes a destructive-action warning summary.

{% content-ref url="/pages/Wo8uaAQGOpoDSX3mEaRZ" %}
[Internal Assessment Destructive Actions](/enterprise/how-to-trigger-an-internal-scan/internal-assessment-destructive-actions.md)
{% endcontent-ref %}

### Entities Tab

The **Entities** tab shows graph entities connected to the selected subnet, such as hosts, users, groups, and services.

By default, entities are included. To exclude entities:

1. Open the **Entities** tab.
2. Search or page through the entity list.
3. Uncheck entities that should not be tested.
4. Refresh the entity list if discovery has recently added more data.

The exclusion count is shown in the subnet settings and final review.

## 5. Review, Run, or Schedule

Click **Run Assessment** to open the final configuration review.

Review:

* selected subnets;
* assigned agents;
* confidence levels;
* enabled exploit count;
* PCE Intercept/Inveigh status and selected interfaces;
* excluded entity count;
* scan estimate and credit/runtime information;
* destructive-action warning summary;
* max module runtime warning, if configured.

Click **Run assessment** to launch immediately. If scheduling is permitted for your role, use the schedule controls in the same review drawer to run later or create a recurring assessment.

## 6. Schedule Internal Assessment

Scheduling uses the selected subnets and the same module configuration shown in the final review. It captures agent assignment, confidence levels, exploit choices, exclusions, PCE Intercept/Inveigh settings, RCE controls, scan estimates, and the saved scan configuration reference at the time the schedule is created.

Schedules can be one-time or recurring. Manage existing schedules from **Activity -> Schedule**.

{% content-ref url="/pages/LLoc9R3DJqOcKInTTM8W" %}
[Scheduling](/enterprise/activity/scheduling.md)
{% endcontent-ref %}

## 7. Monitor and Triage

Use:

* **Activity -> Activity** for module and submodule execution status.
* **Activity -> Attack Logs** for detailed operational logs.
* **Modules -> Internal Assessment -> Statistics** for aggregate results.
* **Modules -> Internal Assessment -> Attack Paths** for findings.
* **Reports** for executive or comprehensive PDFs.

## Common Blocks

| Block                                      | What to check                                                                                   |
| ------------------------------------------ | ----------------------------------------------------------------------------------------------- |
| No agents available                        | Confirm the AGENT is connected and visible in **Dashboard -> Agents** or **Settings -> Agent**. |
| No subnets shown                           | Confirm the agent reports subnets and can route to your network.                                |
| Intercept enabled but run blocked          | Select at least one valid interface for PCE Intercept/Inveigh.                                  |
| Exploit family not approved                | Disable it in the subnet settings drawer before review.                                         |
| RCE should not repeat on compromised nodes | Enable the RCE skip controls.                                                                   |
| Assessment is too broad                    | Use partial subnet testing during discovery and entity exclusions during assessment.            |