Assessment Overview¶

Audience: All client users (with access to the assessment) · Where: click any row in Assessments, or open one from the Dashboard / Analytics.

Overview¶

Opening an assessment lands you on its Overview tab. The header shows the assessment name, its type badge (Internal / External / Web App) and status (Completed, In Progress, …), with All Assessments to go back. Below the header is the tab bar, the hub for everything about this engagement. The full set, in order, is:

Overview · Config · Assets · Findings · Vulnerability Scanning · Reports · Files · Network Graph · Access · Evidence and Actions Log

Not every tab appears for every assessment. The set depends on the assessment type, the scan mode, and your role, and tabs that don't fit collapse into a More dropdown at the end of the bar. This table shows when each tab appears and where to read more:

Tab	When it appears	Guide
Overview	All engagements	This page
Config	All engagements	This page (below)
Assets	Internal & External engagements only	This page (below)
Findings	Hidden for vulnerability-scan-only assessments	Working with Findings
Vulnerability Scanning	Internal & External only; shows once a scan has run (or was enabled)	Vulnerability Scanning
Reports	All engagements	Reports
Files	All engagements	This page (below)
Network Graph	Internal & External only; hidden for vulnerability-scan-only	Network Graph & Evidence Log
Access	Owners and managers only	This page (below)
Evidence and Actions Log	Internal & External only; hidden for vulnerability-scan-only	Network Graph & Evidence Log

Why some tabs are missing

Assets, Vulnerability Scanning, Network Graph, and Evidence and Actions Log appear for Internal and External engagements only.
Findings, Network Graph, and Evidence and Actions Log are hidden for a vulnerability-scan-only assessment, which produces scan results rather than exploited findings and an attack graph.
Vulnerability Scanning shows only once a scan has run (or was enabled) for the engagement.
Access is visible to owners and managers only.

What's on the Overview tab¶

Recurrence: whether this assessment runs once or on a schedule. A recurring assessment shows its schedule; each run creates a new assessment with the next #N suffix. A one-off reads "This assessment runs once."

Findings: a quick count of findings for this engagement with the severity breakdown. View all → jumps to the Findings tab.

Overview details: the engagement facts: Target, Type, Created, Started, and Completed timestamps.

Recurrence clones

A recurrence clone also shows its Occurrence number (#N).

Scope & Setup: what was recorded when the engagement was created: the Targets in scope (e.g. an IP range like 192.0.2.0/24 for an internal test), any Scoped assets picked from the Asset Library, the OVA appliance that ran an internal scan (shown by name), and, where they apply, ASM access, Breach data, and anything Excluded from scope.

WAF-whitelist User-Agent panel

For a web-app engagement with WAF whitelisting on, a WAF-whitelist User-Agent panel appears here with the exact string to add to your firewall allowlist.

The Scan progress panel¶

At the bottom, the Scan panel shows the engagement's lifecycle. A stage tracker walks through the phases (for an internal test: Internal Recon → Internal Enumeration → Internal Exploitation → Internal Reporting), with a green check on each completed stage and the current Stage labelled at the top.

Below it, the Activity feed is a timestamped, live log of what the testing agents did: every event, tagged by the agent that produced it (e.g. PoC Refiner, Report Writer, Responder, NTLM Relay). You can:

Filter by level: ALL / INFO / WARN / ERROR.
Filter by agent with the all agents dropdown (each specialized agent, such as AD CS Exploit, Kerberos Attacks, Lateral Movement or SMB Enumeration, can be isolated).

For an in-progress scan this feed updates in real time so you can watch the test as it runs; for a completed one it's the full record of the engagement.

Emergency Stop

While a scan can still be cancelled, the Scan panel shows an Emergency Stop button. It immediately cancels the assessment and force-stops every test that is running under it. To confirm, you type the assessment's name and give a reason. This cannot be undone. Use it if a test is affecting a system it shouldn't.

The Config tab¶

The Config tab is a read-only record of everything set when the assessment was created, so you can always check exactly what was authorised. It's grouped into General and Scope, plus, depending on the type:

Web apps: the application types, rules-of-engagement toggles, linked repository, scan User-Agent, and Login identities (names and roles only, never secrets).
Internal: Techniques (opt-in), Coverage, and Tunables.
External: the port range, scan intensity, scan window, OSINT and DNS options, and the other testing options.

Settings are fixed once the scan starts. See Running an Assessment.

The Assets tab¶

(Internal and External engagements.) The Assets tab shows the hosts this engagement actually touched, in two parts:

Tested hosts

The in-scope hosts discovered and tested, projected from the scan. Use Search hosts… and sort the list to find a specific host. Hosts appear here once a scan has run.
Excluded from scope (ROE)

The hosts or ranges deliberately left out. This covers both what you declared out of scope at creation and any live hosts a scan observed on the wire but did not test because they were out of scope. It's your record that the rules of engagement were honoured.

A Targets in scope strip at the top restates the engagement's target ranges.

The Files tab¶

The Files tab holds documents generated for the engagement. Today that's the Letter of Attestation: a signed, point-in-time letter attesting to the testing performed, the methodology used, and the findings result. It's useful when a customer, auditor, or insurer asks for proof of testing without needing the full report.

The letter becomes available once the assessment report is published; download it as a PDF from this tab.

The Access tab¶

(Owners and managers only.) The Access tab controls who can see this one engagement without handing over broader access:

Direct viewers

Add an individual member or viewer to give them read access to this assessment only. Use Search viewers… to find someone in the list.
Team access

Grant one of your organisation's teams access to the engagement. (Create teams first under Administration → Teams & Access.)

Tips¶

The Overview is the jumping-off point: start here, then dive into Findings or Reports.
The Activity feed is a transparency feature: it shows exactly what was tested and when, which is useful for audits and for understanding how a finding was discovered. For a human-readable summary of tester actions, see the Evidence and Actions Log (guide).
Need to confirm what was in scope or which techniques were allowed? The Config tab is the authoritative record.