HelpUiDialogsScanpolicy

thc202 edited this page Feb 15, 2016 · 3 revisions

Scan Policy Dialog

This allows you to enable and disable the rules that are run when performing an active scan. The first screen allows you to define the default levels as well as the levels for all of the rules in a specific category.

The category screens allow you to define the levels for every individual rule.

Note that passive scan rules are no longer managed via this dialog but are instead managed via the Options Passive Scan Rules.

Threshold

This controls how likely ZAP is to report potential vulnerabilities.

  • If you select Off then the scanner won't run.
  • If you select Low then more potential issues will be raised which may increase the number of false positives.
  • If you select High then fewer potential issues will be raised which may mean that some real issues are missed (false negatives).

Strength

This controls the number of attacks that ZAP will perform. If you select Low then fewer attacks will be used which will be quicker but may miss some issues. If you select High then more attacks will be used which may find more issues but will take longer. The Insane level should typically only be used for small parts of an application as it can result in a very large number of attacks being used, which can take a considerable length of time.

Accessed via

     Scan Policy Manager dialog

See also

     UI Overview for an overview of the user interface
     Dialogs for details of the dialogs or popups
Clone this wiki locally
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.
Press h to open a hovercard with more details.