v3.0
Products and assets management, scan history and replay, incremental scanning, authentication for every scan type.
Where ScanSuite stopped being a way to launch scans and became a place that remembers them. Products, assets and scan history turned individual runs into a record you can work against over time.
Products management
Products became first-class: create a product, and every scan result and every discovered asset is filed under it. Deleting a product removes its scans from history and its results from DefectDojo, so cleaning up a decommissioned application is one action rather than a hunt.
Because products carry the repository URL, findings gained direct links to the offending code line during triage. See Products.
Assets management
A dedicated Assets tab, populated automatically:
- Hosts discovered during network discovery and vulnerability scans are saved and updated as later scans learn more about them.
- All fields are sortable and filterable, and assets can be added or amended by hand.
- Email and Telegram alerts fire when a new asset appears, or when an existing asset's ports or severity change.
The alerting is the part that changes behaviour: a new open port on a known host reaches you without anyone opening the console. See Assets.
Scan history and execution
| Feature | Description |
|---|---|
| Improved Scan History | A reworked view for interacting with running and completed scans — stop, restart, delete, and open reports. |
| Scan Replay | Re-run a previous scan with its exact configuration in a single action. |
| Near real-time logging | Execution logs stream while the scan runs, so a stuck scan is visible rather than merely slow. |
Incremental code scanning
The Monitor Changes scanning mode performs an initial full scan of a branch and then checks hourly for new commits. When the branch moves, only the modified files are fetched and analysed.
This is what made frequent re-scanning practical: a re-scan costs what the change costs rather than what the codebase costs. It became load-bearing in v4.0, where per-file model analysis made full re-scans genuinely expensive.
See Scheduling periodic and incremental scans.
Authentication across every scan type
Scanning what an anonymous visitor can see is the easy half. This release added authentication support across all three scan families:
| Scan type | Authentication |
|---|---|
| Static analysis | SSH key authentication for private Git repositories. See Git repository authentication. |
| Web scanning | Cookies and custom headers threaded through the scan, so post-login surface is actually tested. |
| Infrastructure scanning | Credentials for authenticated patch validation over SSH and SMB/WMI. |
Last reviewed 2026-08-16