Assessment Overview¶

Audience: All client users (with access to the assessment) · Where: click any row in Assessments, or open one from the Dashboard / Analytics.

Overview¶

Opening an assessment lands you on its Overview tab. The header shows the assessment name, its type badge (Internal / External / Web App) and status (Completed, In Progress, …), with All Assessments to go back. Below the header is the tab bar — the hub for everything about this engagement. The full set, in order, is:

Overview · Assets · Findings · Vulnerability Scanning · Reports · Network Graph · Access · Evidence and Actions Log

Not every tab appears for every assessment — the set depends on the assessment type, the scan mode, and your role, and any tabs that don't fit collapse into a More dropdown at the end of the bar. This table shows when each tab appears and where to read more:

Tab	When it appears	Guide
Overview	All engagements	This page
Assets	Internal & External engagements only	This page (below)
Findings	Hidden for vulnerability-scan-only assessments	Working with Findings
Vulnerability Scanning	Internal & External only; shows once a scan has run (or was enabled)	Vulnerability Scanning
Reports	All engagements	Reports
Network Graph	Internal & External only; hidden for vulnerability-scan-only	Network Graph & Evidence Log
Access	Owners and managers only	This page (below)
Evidence and Actions Log	Internal & External only; hidden for vulnerability-scan-only	Network Graph & Evidence Log

Why some tabs are missing

Assets, Vulnerability Scanning, Network Graph, and Evidence and Actions Log appear for Internal and External engagements only (web-app equivalents are on the way).
Findings, Network Graph, and Evidence and Actions Log are hidden for a vulnerability-scan-only assessment, which produces scan results rather than exploited findings and an attack graph.
Vulnerability Scanning shows only once a scan has run (or was enabled) for the engagement.
Access is visible to owners and managers only.

What's on the Overview tab¶

Recurrence — whether this assessment runs once or on a schedule. If it's a one-off, you'll see "This assessment runs once. To enable recurring scans, edit the recurrence settings."

Findings — a quick count of findings for this engagement with the severity breakdown (High / Medium / Low). View all → jumps to the Findings tab.

Overview details — the engagement facts: Target, Type, Created, Started, and Completed timestamps.

Recurrence clones

A recurrence clone also shows its Occurrence number (#N).

Scope & Setup — what was recorded when the engagement was created: the Targets in scope (e.g. an IP range like 192.168.9.1/24 for an internal test), any Scoped assets picked from the Asset Library, the OVA appliance that ran an internal scan, and — where they apply — ASM access, Breach data, and anything Excluded from scope.

WAF-whitelist User-Agent panel

For a web-app engagement with WAF whitelisting on, a WAF-whitelist User-Agent panel appears here with the exact string to add to your firewall allowlist.

The Scan progress panel¶

At the bottom, the Scan panel shows the engagement's lifecycle. A stage tracker walks through the phases (for an internal test: Internal Recon → Internal Enumeration → Internal Exploitation → Internal Reporting), with a green check on each completed stage and the current Stage labelled at the top.

Below it, the Activity feed is a timestamped, live log of what the testing agents did — every event, tagged by the agent that produced it (e.g. PoC Refiner, Report Writer, Responder, NTLM Relay). You can:

Filter by level: ALL / INFO / WARN / ERROR.
Filter by agent with the all agents dropdown (each specialized agent — AD CS Exploit, Kerberos Attacks, Lateral Movement, SMB Enumeration, etc. — can be isolated).

For an in-progress scan this feed updates in real time so you can watch the test as it runs; for a completed one it's the full record of the engagement.

The Assets tab¶

(Internal and External engagements.) The Assets tab shows the hosts this engagement actually touched, split into two parts:

Tested hosts

The in-scope hosts discovered and tested, projected from the scan. Search and sort the list to find a specific host. Hosts appear here once a scan has run.
Excluded from scope (ROE)

The hosts or ranges deliberately left out. This covers both what you declared out of scope at creation and any live hosts a scan observed on the wire but did not test because they were out of scope. It's your record that the rules of engagement were honoured.

A Targets in scope strip at the top restates the engagement's target ranges. (A discovered-endpoints view for web-app engagements is coming later.)

The Access tab¶

(Owners and managers only.) The Access tab controls who can see this one engagement without handing over broader access:

Direct viewers

Add an individual member or viewer to give them read access to this assessment only.
Team access

Grant one of your organisation's teams access to the engagement. (Create teams first under Administration → Teams & Access.)

Tips¶

The Overview is the jumping-off point — start here, then dive into Findings or Reports.
The Activity feed is a transparency feature: it shows exactly what was tested and when, which is useful for audits and for understanding how a finding was discovered. For a human-readable summary of tester actions, see the Evidence and Actions Log (guide).
A pre-engagement questionnaire may be requested when scoping some assessments (especially web apps) to capture credentials, test accounts, and environment details. Fill it in as accurately as possible — it directly improves test coverage.