Configuration
You configure a scan by choosing settings that best describe your application, and the kind of testing you want.
- Scan Configuration Wizards
  You can quickly configure basic scans using the wizards.
- Scan Configuration Dialog Box
  - URL and Servers view
    Configure the Starting URL for the svcan, and any additional servers and domains to be included.
  - Login Management view
    Show AppScan® how to log in to your application.
  - One-Time Password (OTP) view
    If required by your application, configure AppScan® to use OTP when logging in.
  - Environment Definition view
    Environment definition is not essential, but enables AppScan® to safely refrain from sending non-relevant tests during the scan, resulting in a faster and more accurate scan.
  - Exclude Paths and Files view
    You can configure AppScan to ignore certain paths in the application, or specific types of file.
  - Explore Options view
    Define scan limits, link extraction methods and the general Explore method.
  - Parameters and Cookies view
    Identify session IDs and list parameters to exclude from the scan.
  - Automatic Form Fill view
    Provide AppScan® with valid parameter values for filling forms in your application during the scan.
  - Error Pages view
    Add strings, regular expressions and URLs to identify your application's custom error pages.
  - Multi-Step Operations view
    Record and manage multi-step operations that are required to reach specifica parts of the application that could otherwise be missed.
  - Content-Based Results view
    Define a logical structure for the application tree, if AppScan® will not be able to do this based on URL structure.
    - Adding new Content-Based view rules
      Instructions and examples of adding rules to define the site's logical structure.
  - Communication and Proxy view
    Configure communication timeout and proxy server settings.
  - HTTP Authentication view
    Add server-level authentication and client-side certificates, if required by the application.
  - 3rd Party Authentication view
    3rd Party Authentication view of the Configuration dialog box lets you configure AWS settings.
  - Test Policy view
    Define and edit the collection of tests that will be sent to the application during testing; the test policy.
  - Test Optimization view
    Apply optimization for faster scans at times in the product lifecycle when speed is more important to you than scan depth.
  - Test Options view
    Additional test options.
  - Privilege Escalation view
    Refer AppScan to scans run using different user privileges, to discover privileged resources that may be accessible to users with insufficient privileges.
  - Advanced Configuration view
    This view gives you access to many advanced registry settings and it should only be used by experienced AppScan users, or when instructed to do so by the support team to troubleshoot a problem.
- Scan file structure
  Explains the basic structure of an AppScan Standard SCAN file.
- Scan templates
  A scan template is simply a scan configuration that has been saved so that you can use it again.
- Changing the configuration during a scan

Content-Based Results view

Define a logical structure for the application tree, if AppScan® will not be able to do this based on URL structure.

If your site content is structured in such a way that the URLs reflect a folder-like hierarchy, the scan results will automatically reflect this, making them easy to navigate.
If your site uses "breadcrumbs", or other "content-based" navigational methods, so that the URLs do not indicate the user's "location" within the site, it is recommended that you "teach" AppScan® how the site is "logically" structured, so it can present the scan results in an easily understood format, rather than long lists of results under one or two URLs. This is not essential, but will make it easier for you to navigate the results.

For example, the code snippet below has a logical structure Home | Buy | Books and it would be useful to structure the results so that "Books" appears under "Buy", and "Buy" under "Home".

<td class="navigation">
    <a href="http://www.onlineshop.com/">Home</a> &gt;
    <a href="http://hub.onlineshop.com/buy?ssPageName=h:h:cat:US">Buy</a> &gt;
    <b>Books<b>
</td>

To do this, you define the rules that will enable AppScan® to identify and extract the relevant content (in this case "Home", "Buy" and "Books") to construct a content-based tree.

Once you have defined the rules, you can select the Content-Based option in the Application Tree, to display the results using this information. (See Issues: Application tree.)

Note: The total number of security issues (shown at the top of the Result list) is a measure of the vulnerable locations in the site, and depends in part on how site is structured. If you define a content-based structure, the total number of issues in the application tree may not be the same as it is for the URL-based application tree (for the same results). When site structure is content-based (rather than URL-based), and content-based view is configured correctly, the issue count in content-based view represents more accurately the number of "vulnerable locations" that exist in the site. The total number of variants (at the top of the Result List in parentheses) is independent of site structure, and does not change between content-based and URL-based views.