Scans

This page explains how ATLAS scans an organisation, how to start and follow a scan, and how to tune what a scan does. It also explains what each kind of scan touches, so you know exactly what reaches your systems and when.

Open Scans in the header. The page reads "Reading the scan configuration…" for a moment while it loads. Its subtitle shows the organisation, the number of active schedules and the number of scans on record.

Who can do this

People with the admin or user role can start, pause, resume and cancel scans, and edit scan profiles. Demo organisations are never scanned: every scan you start for one is refused.

Passive and active: what reaches your systems

ATLAS works in three kinds of steps, called stages. A scan runs the stages of its profile in a fixed order.

The stages

Three more stages are intrusive: Default credential verification, Authorization matrix and Web cache poisoning. They need a separate intrusive-testing authorisation and only run against the hosts it names. No built-in profile contains them. See Authorise intrusive testing.

Check whether scanning is allowed

The top of the Scans page always shows whether active scanning may run. The headline reads, for example, "Active scanning is authorized for every domain in scope", "Active scanning is authorized for 4 of 5 domains", or "Active stages are blocked for <organisation>". Five cells explain why:

When there is no mandate, the strip reads "No signed mandate on file. Passive stages still run; every active stage is refused and logged." To fix this, see Record the scanning mandate. Unproved domains get passive stages only until ownership is proved.

Run passive reconnaissance from the Map

The quickest way to start on a new organisation:

ATLAS reads public records and adds the hosts it discovers to the Map. Nothing is sent to the organisation's systems, so this needs no mandate and no proved ownership.

Start a scan

ATLAS confirms "<profile> requested for <organisation>." The scan appears on the Activity tab.

The scan covers only the scope you chose. For selected domains, a filter or a single host, passive discovery and the third-party lookups are also limited to the chosen domains, or to the domains of the chosen hosts.

Changed since last scan needs at least two completed scans and at least one change. Otherwise the scan is refused with the reason, for example "Nothing changed in the last scan, so there is nothing to scan again."

If every stage would be refused, the footer reads "Every stage would be refused. The attempt is still logged." You can still start it: ATLAS records the refused attempt in the scan history, with the reason.

Scan one host

To scan a single host for its ports, versions, technologies and CVEs:

The button changes to "Scan queued" and then "Scanning · NN%". If a scan of that host is already running, ATLAS says "<host> is already being scanned."

Follow a running scan

While a scan runs, the Activity tab shows it at the top: "Running · <profile>", the scope and number of hosts, who started it and when, the progress, and the stage running now. The counters show Hosts in scope, Stages done, Open ports on record and Findings reported.

Under Progress, choose how to show it:

Choose Watch on map → to follow the scan on the Map.

Pause, resume or cancel

When no scan runs, the tab reads "No scan running", with Start a scan.

Read the scan history

Scan history on the Activity tab lists every scan, with these columns: Status, Profile · scope, Started, Duration, What it found and Actions.

To run a scan again with the same settings, choose Re-run. The Start a scan dialog opens with the same profile and scope.

Compare two scans

A table compares the Scope, Stages run, Hosts, Open ports, Open findings, New findings, Fixed, Duration (min) and Stages only in one. The older scan is on the left, the newer on the right. Choose Hide comparison to close it.

Schedules

The Schedules tab shows a calendar and the organisation's planned scans, with blackout dates on which "No scan starts on these days".

Scan profiles

A profile decides which stages a scan runs and how hard it works. Each organisation starts with four built-in profiles:

Edit a profile

1

Open Scans and choose the Configuration tab.

2

Under Scan profiles, choose a profile. Built-in profiles carry BUILT-IN. Each card shows how many stages it runs and how many schedules use it.

3

Change the name or "What this profile is for".

4

Turn stages on or off. They are grouped as Passive ("Public records · nothing sent to the target"), Active and Enrichment ("Runs on what the scan observed"). Each stage shows a label saying what it needs: | Label | Meaning | |---|---| | NAMED SCOPE | Needs a domain in scope. | | MANDATE + OWNERSHIP | Needs the mandate and proved ownership. | | API KEY | Needs a key for a third-party source. | | CATALOGUE | Needs the vulnerability catalogue. | | NO GATE | Works on what earlier stages recorded. | | NEEDS AUTHORISATION / INTRUSIVE AUTHORISED | An intrusive stage, and whether the organisation has authorised it. | | REFUSED HERE | An active stage that this organisation refuses, because no mandate is on file. |

5

Optionally, change a stage's settings. A changed value shows "Overrides default <value> · reset"; choose reset to go back.

ATLAS saves your changes automatically. The summary at the top shows the number of stages, how many are active, and the estimated time for the whole estate.

Create, delete or run a profile

Settings that apply to every profile

The Deployment · applies to every profile block shows settings that Soveryne manages for the whole service: whether private targets are allowed, the scanning tools installed, which Third-party lookups are configured, and the vulnerability catalogue. Checks that would make your hosts call out to an outside service are always off and cannot be turned on.

How ATLAS keeps scanning safe

Troubleshooting