Creating a new scan from a scan file

You can upload your own AppScan Standard scan (SCAN) file to run an ASoC scan.

Before you begin

Back up your site before scanning.
If you have not yet done so, Create an application for your scans.
Verify to ASoC your permission to scan the domain (see Verifying a domain)
If your site is not available on the Internet, and an AppScan Presence does not yet exist on the server: Creating the AppScan Presence.
When configuring a scan in AppScan Standard that requires an OTP, you must use action-based login, not request-based login. See the AppScan Standard documentation for details.

Note:

CAPTCHA login is supported only when it is configured in AppScan Standard and uploaded in a scan (SCAN) or template (SCANT) file. For configuration instructions, see CAPTCHA authentication in AppScan Standard.

For applications that use Google reCAPTCHA v2, ask the site owner to configure Google's reCAPTCHA v2 test keys in the UAT or staging environment. Use test keys only in test environments, never for production traffic. IP allowlisting alone might not prevent reCAPTCHA v2 from blocking the scan or leaving the verification widget loading indefinitely.

Note:

If the scan file uses advanced encryption, prepare it for the target ASoC environment before uploading it. See Using files with advanced encryption.

Procedure

On the specific Application page, click Create scan, then click Create scan under DAST Dynamic Analysis to open the wizard.
Under the Scan from file section > Upload template or scan file, click Upload file, select the scan file and then click Apply.
Upload file
The file is opened and the starting URL from the configuration is filled in the URL field.
Note:
AppScan on Cloud limits file uploads to 2 GB.
If your file includes only configuration data (no explore data), you can only run a full scan. If your file includes Explore data and issues, you can choose from the following options:
- Restart full scan: Ignores scan results and runs a full scan (including the Explore and Test stages) using the current configuration.
- Continue tests: Continues tests from where they were paused using the configuration, explore data, and tests from the file.
- Re-test: Ignores the test results and runs the Test stage only using the configuration and explore data from the file.
Private site scanning:

Public site scanning is the default. If your site is not available on the Internet, click Private network. Select your presence from the list of connected presences.

If you have not yet created an AppScan Presence you can do so now by clicking the Presences link, and referring to Creating the AppScan Presence.

Schedule:


Setting	Options
Scan now	Your scan runs as soon as set up and review are complete.
Save for later	Your configuration is saved when completed. You can run the scan later.
Schedule	Your configuration is saved, and one or more scans run as configured: Select a date and time. Enter these according to the time zone configured on your machine, but note that times will be converted to UTC when displayed in the user interface. To run the scan more than once, select the Repeat, and then choose: Daily, and select a daily interval (1-30 days) Weekly, and select which day, or Monthly, select a monthly interval, and then select which numerical day of the month, or which weekday of the month (first, second, third, fourth, last). Note: If the maximum number of concurrent scans are running when the scheduled time arrives, the scan starts as soon as allowed by your subscription. Set the End date (the last date a scan will run), or click Remove end date to have the schedule run indefinitely.

Scan options:
In the Scan options panel, you can:
- Update the Scan name if required.
- Add a Description to add more context to your scans.
- Elect to run the scan as a Personal scan.
- Elect to receive an email when the scan is complete.
- Specify Scan enablement. By default, the Allow intervention check box is selected. This means that if ASoC detects that the scan may produce poor results with the current settings, it alerts the Scan Enablement Team to review them. The scan status changes to Under Review and resumes when review is complete (see Scan status).
  - If you do not want to allow intervention by the Scan Enablement Team, clear the check box.
  - If you allow intervention, you can include a message to the team if you think they might need specific information to resolve an issue. Optional.
Summary:

Edit the name of the scan, if desired, and review the settings selected for the scan. Click back to previous panels to make adjustments if needed.
Click Scan.

Results

The new scan is added to the Scans view with its starting time, and a progress bar indicates that the scan is running. When the scan is complete the progress bar closes, the results are summarized in a graph, and (if selected) you receive an email notification. See Results.