The main scans page shows information about all scans. You can also view scans for an individual site when viewing site details, or for an individual agent when viewing agent details. For each scan, various details are shown including the start time, status, and a summary of the results.
The filter bar lets you show or hide scans based on particular features; for example, only showing scans that are currently running.
Hovering the mouse over a scan shows contextual options for that scan, such as deleting a completed scan or canceling a scheduled or in-progress scan.
You can click into a scan to see more details.
Viewing scan details
Clicking into an individual scan lets you see more details.
For running or completed scans, you can view:
The issues reported by the scan. You can click into each issue to see more details.
For recurring scans, counts of issues that are new, resolved, repeated, and regressed, as compared with the previous scan.
The scan status, duration, and metrics.
The agent that performed the scan.
Details of the site (such as URLs) at the time it was scanned. This information is useful in cases where the site configuration has been modified since the scan occurred.
For scheduled scans, you can view:
The configuration of the scheduled scan, including timing details.
If recurring, the individual scans that have already occurred.
You can also perform the following actions via the 3 dots menu:
- Generate a scan summary report in HTML format.
- Cancel an in-progress or scheduled scan.
- Delete a completed scan.
Viewing scan issue details
Clicking into an individual scan issue lets you see more details, including:
The issue type (such as cross-site scripting).
The severity and confidence.
The host and URL path for which the issue was reported.
A description of the issue and its remediation.
The HTTP requests and responses on the basis of which the issue was reported.
Any Burp Collaborator interactions supporting the issue.
Links to any related Jira issues.
Creating Jira tickets
If you have set up an integration with Jira, a "Link to Jira" button will appear when viewing scan issue details. You can create a new Jira ticket or link to an existing ticket. If multiple Jira projects have been set up, you will need to choose the Jira project for the ticket.
Flagging issues as false positives
You can flag issues as false positives by:
- Clicking the "Mark as false positive" button when viewing scan issue details.
- Clicking the "FP" button when hovering over a scan issue when viewing scan results on the scan details page.
When you flag an issue as a false positive, you can choose whether to also flag any other issues with the same issue type or URL.
Setting up scans
You can initiate a new scan in various ways:
On the scans page, clicking the "New scan" button.
On the sites page, hovering the mouse over a site and selecting the "New scan" contextual option.
- When viewing details of an individual site, clicking the "New scan" button.
- When viewing the results of an individual scan, clicking "Scan again" from the 3 dots menu.
When setting up a scan, you must specify:
The site to be scanned.
When to start the scan. You can select to start the scan as soon as possible or at a specific future time.
Whether the scan is one-off or should recur at a regular interval; for example, every Saturday or on the twelfth day of each month.
If recurring, whether to stop at a certain point or continue indefinitely.
Any particular scan configurations to use for the scan.
Scan configurations can be used to control numerous details of how a scan is performed, such as the maximum link depth of the crawl, or what types of issues to report.
If no configuration is specified when setting up a scan, then Burp Scanner will use its default configuration which is suitable for typical web sites.
You can specify multiple configurations for a single scan, and these will be applied sequentially in the same way as when launching scans using Burp Suite Professional. Each configuration can define settings in one or more specific areas. Applying configurations sequentially allows you to specify a general configuration followed by more specific configurations. When these are applied, they will build up to determine the actual full configuration that is used.
When selecting scan configurations, you can:
Choose from various built-in configurations that are useful for common purposes. For example, performing a fast crawl, or an audit only for critical vulnerabilities.
Load custom configurations. These use the same JSON format that Burp Suite Professional uses for its configuration files. To create a custom configuration, use the configuration library function in Burp Suite Professional to create the configuration that you want. Export the configuration to a file and then load it into Burp Suite Enterprise Edition as a custom scan configuration.