Run scans

Managing scan execution

Scan History: filtering, rerunning, stopping, downloading reports, exporting to CSV, and what each scan outcome means.

View as Markdown

Scan History (in the sidebar) lists every scan of the team, newest first and grouped by day, with what it ran, what it changed and what it cost. Click a scan's time or target to open its page, where you follow a running scan and see what a finished one changed; see The scan page. New Scan at the top opens the Static Code Analysis form.

ScanSuite scan history
Scan History: every scan with its status, LLM spend and actions

At the top of the page

  • Running now · N shows a card for each scan in progress: its stage and progress where the scan reports them (Stage N of M: <stage> (done/total), for AI SAST and AI Pentest), how long it has run, what it has cost and its product, with a button to stop it. Show all N lists them all when there are more cards than fit.
  • The tiles count the scans of the chosen period, those Running or queued and those that Failed (click either to filter the list), the findings the scans reported first and closed (Findings new / fixed), and the LLM spend.
  • When scans start after the page was opened, a banner says so; Show them reloads the list. When a scan ends, a notice in the corner says Scan <target> finished., failed. Open it to see why. or was cancelled.

Filtering

The list shows the Last 30 days by default. Above it you can:

  • search by target, branch, commit or scan ID (product names, scan types and statuses match too);
  • choose the Period (the last 24 hours, 7, 30 or 90 days, all time, or a custom range), the Product, the Scan type and the Status (Running or queued, Finished, Failed, Cancelled);
  • open More filters for a single Target of the chosen product, the Mode, the From and To dates of a custom range, how the scan was started (Started via: Manually, Schedule, Repository monitor, Rerun or AI resume), who started it (Started by), and Only scans that changed findings.

Each active filter shows as a chip you can remove; Clear filters removes them all. The filters are kept in the page address, so a filtered list can be bookmarked or shared. When older scans fall outside the period, the page says how many and offers Show all time. The footer reads Showing x to y of N results, with the page links. To search across assets, vulnerabilities, scans and credentials at once, use Global search and activity log.

Reading the list

Scans shows one row per scan:

ColumnWhat it shows
StartedWhen the scan started, and how long it ran. Opens the scan's page.
TargetThe repository, URLs or hosts scanned (opens the scan's page), with the scan type; the mode (Full scan, Incremental, Monitor, Custom scope, Custom archive, Verify fixes); an icon when a schedule, a monitor, a rerun or an AI resume started it; the branch and commit; and who started it. The filter icon shows only this target's scans.
ProductThe product the scan belongs to. Click it to show only that product's scans.
StatusQueued, Started, Finishing, Cancelling, Finished, Failed, or Cancelled for a scan someone stopped.
What changedNew, fixed and reopened findings, each opening the Vulnerabilities page filtered to them; No changes when the scan changed nothing; for a failed scan, the reason it failed. A dash means the scan's engines write their findings to the report only.
LLM TokensThe tokens the scan spent; hover for prompt, completion and LLM calls. Once LLM prices are set, the cost shows underneath.
ActionsStop, Report, Scan again with changes and Rerun, see below.

By target switches to one row per target:

ColumnWhat it shows
TargetThe target. Click it for this target's scans.
ProductIts product.
Last scanIts most recent scan.
Recent scansThe outcome of its recent scans.
ScansHow many scans it had in the period.
What changedWhat those scans changed, and N failed when some failed.
LLM spendWhat they spent.
ActionsThis target's scans, and Rerun the last scan.

Controlling scans

ActionWhat it does
StopAsks first, then cancels a running or queued scan and stops its containers. The scan becomes Cancelled.
ReportDownloads the report archive. Greyed out as Report unavailable when the scan wrote none.
Scan again with changesOpens the scan form filled from this scan, to change something and run it. Not offered for scans of an uploaded archive.
RerunRuns the scan again the same way: a Custom Scope scan with the same patterns, a Verify Fixes scan with the same findings, an Incremental or Monitor scan as one. A rerun of a monitor that was deleted becomes a full scan. Web and infrastructure targets are checked against the team's allowed targets again. If the rerun is refused, for example a repository with no new commits, a target no longer allowed or the team's concurrent-scan limit, the message says why. Greyed out as Rerun unavailable when the scan cannot be rerun.
Resume AI analysisReplaces Rerun for an AI SAST scan that stopped part-way; the hint names the stage it stopped during. The analysis continues from its last checkpoint instead of starting over.

Scan outcomes

A scan can end without covering everything it was given. The scan's page and its log say which case applies:

OutcomeWhat you seeWhat to do
Scanner not set upScanner skipped: <reason> warning in the log, for example Acunetix or OpenVAS not set up for the team, or Nessus not set up on the server. The other scanners run; the scan fails only if none is left. A scanner that is set up but cannot be reached, or refuses the sign-in, still fails the scan.Set the scanner up (Teams, Scanning tab, Scanner engines card; Nessus in System Settings) or switch it off.
Scanner image not installedThe form marks an engine whose scanner images this server lacks: Not installed on this server. (switched off and greyed out), or Runs without <names>: not installed on this server. when some are missing. A scan that still needs a missing image logs the warning Scanner image appsec4u/<name> is not installed on this server; that step was skipped. and runs the other steps.Choose an engine that is installed, or ask an administrator to add the scanner images to the server, see Installer options in Install ScanSuite Teams.
No custom rule appliesCustom Rules is skipped for that product; the form said so before you started.Add or activate rules on the Rules page, or switch Custom Rules off.
Target unreachableA warning in the log for that target. The scan ends Finished with what the reachable targets returned.Check that the target is up and reachable from the ScanSuite server, then rerun.
AI DAST stopped by a budgetAI DAST stopped before it covered the target: the request budget (800 requests), the LLM call budget (200 calls) or the time budget (one hour) was used up. Findings it confirmed are kept, but the run counts as not completed, so the scan shows Failed.Scan a narrower URL, such as one section of the application.
AI Pentest stopped by a budgetThe engagement card shows Finished in … · cycle budget used or time budget used, and the log names the planned steps that did not run. Findings proven so far are kept.Narrow the targets or focus the instructions, then run again.
Model unavailableThe AI provider stopped answering (AI Pentest shows model unavailable). Findings found so far are kept.Check the provider on the Teams AI tab, and the Monthly token budget, then run again.
Refused targetThe scan does not start, or a rerun is refused, naming the target and the reason.See Targets on Web App Scanning.
Refused at startThe scan does not start, and the form says why: the team is running its limit of concurrent scans, the target policy does not allow a target or a chosen scanner, or the product no longer exists.Wait for a running scan to finish, change the targets or scanners, or choose another product.

For a CI job, a target that was unreachable is not a failure: the gate decides on what the reachable targets returned. See CI/CD and automation.

Acting on several scans

Tick scans to act on several at once. When every scan on the page is ticked, you can also select all the scans the filters match.

  • Stop selected stops the running ones.
  • Rerun selected runs each ended scan again with its own settings, up to 50 at a time; running scans are skipped.
  • Download reports downloads one ZIP holding each scan's report as <scan id>-report.zip, up to 200 scans at a time.
  • Delete selected deletes the records of ended scans; running scans are left alone.

Export CSV downloads every scan the filters list, one row each: when it started and ended, its type, mode, target, product, status, how and by whom it was started, the branch and commit, what it changed and what it cost. The export is recorded in the team's activity log.

Clear History deletes every scan record of the team, after a confirmation.

Deleting a scan record does not delete the findings it produced; they stay on the Vulnerabilities page.

ScanSuite Teams

Scan History shows the team's scans. Every role can read them and download reports; stopping, rerunning and deleting scans, and Clear History, are for operators and team admins. See Teams and roles.

Last reviewed 2026-10-19