For the complete documentation index, see llms.txt. This page is also available as Markdown.

How to Trigger an Internal Scan

Configure and start an internal discovery or assessment run.

Internal assessment runs through an agent deployed inside the approved environment. The agent supplies reachable subnet inventory and executes work from inside that network.

Before You Start

  1. Install the agent from Settings -> Agent or Download Agent.

  2. Place it on a host that can route to the approved networks.

  3. Confirm it is connected and reports the expected subnets and interfaces.

  4. Agree which exploit families, relay/intercept behavior, and state-changing actions are allowed.

Download Agent

Cloud control-plane work also uses Internal Assessment, but requires an agent on a supported cloud VM with an attached workload identity.

Run a Cloud Assessment

1. Choose the Intent

Open Modules -> Internal Assessment -> Run Assessment.

Intent
Behavior

Discovery

Enumerates reachable systems, accounts, services, and trust relationships without exploitation.

Assessment

Tests inventory already discovered for the selected environment.

Discovery + Assessment

Discovers the environment first, then tests the systems and paths found.

Internal Run Assessment intent choices
Use Discovery plus Assessment when inventory should be refreshed before testing.

2. Select the Agent and Scope

Choose the connected execution agent. Only subnets reported as reachable by that agent are shown.

Select one or more top-level subnets. To narrow execution inside a subnet, enter a partial target as:

  • a single IP, such as 10.10.10.25;

  • an IP range, such as 10.10.10.20-10.10.10.50;

  • a CIDR, such as 10.10.10.0/24.

Partial targets must remain inside their top-level subnet. They narrow the run; they do not create a new root subnet.

For an Assessment-only intent, select previously discovered internal or cloud targets presented by the wizard.

3. Configure Scan Settings

Discovery Controls

Cloud collection uses the selected agent's attached workload identity when one is present.

  • AWS resource name prefixes are optional. Add them only when AWS collection is in scope and the engagement needs to restrict resources by literal name prefix.

  • Azure, GCP, local network, Active Directory, and hybrid environments do not require an AWS prefix.

  • Runtime fields set optional discovery and post-discovery assessment limits; 0 disables the corresponding limit.

Attack Selection

Enable only exploit families approved for the engagement. Defaults can include credential, configuration, privilege-escalation, lateral-movement, code-execution, directory-service, and cloud categories.

The final review shows how many families are enabled. Recheck state-changing categories even if they were selected by default.

PCE Intercept/Inveigh

Enable intercept/relay behavior only when explicitly approved. Select at least one valid interface on the chosen agent; launch is blocked when intercept is enabled without an interface.

RCE Safeguards

Use the available skip controls when repeated command execution is unnecessary after the graph already proves that a host or user is compromised.

Entity Exclusions

Exclude discovered hosts, users, groups, services, or other entities that must not be tested. Refresh the entity list if discovery recently added inventory.

Internal Assessment Destructive Actions

4. Choose Automation

Run immediately or configure a one-time or recurring schedule. Scheduled runs store the selected agent, scope, exploit choices, exclusions, interfaces, safeguards, and runtime settings submitted at creation time.

Recreate a schedule when its agent, scope, credentials, or authorization changes.

5. Review and Start

Confirm:

  • intent, agent, and selected subnets or discovered targets;

  • partial targets;

  • enabled exploit families and destructive-action warnings;

  • PCE Intercept/Inveigh and selected interfaces;

  • RCE safeguards and excluded entities;

  • runtime limits, estimates, and schedule.

Choose Start run or Schedule run. Validation messages identify the step that must be corrected before launch.

Monitor and Triage

  • Activity -> Activity shows execution status and cancellation controls.

  • Activity -> Attack Logs contains detailed operational logs.

  • Internal Assessment -> Statistics summarizes results.

  • Internal Assessment -> Attack Paths contains validated findings.

  • Reports generates assessment deliverables.

Common Blocks

Problem
Check

No agent can be selected

Confirm a compatible internal agent is connected and assigned to the workspace.

Expected subnet is missing

Confirm the selected agent reports and can route to that subnet.

Partial target is rejected

Keep the IP, range, or CIDR inside its listed top-level subnet.

Intercept is enabled but launch is blocked

Select at least one interface on the execution agent.

AWS prefix validation appears for a non-AWS run

Clear AWS-specific scope; prefixes are optional and should not block local, Azure, GCP, or hybrid runs.

Last updated