Enterprise Edition

Site and scan data settings

• Last updated: April 10, 2024

• Read time: 3 Minutes

This section explains how Burp Suite Enterprise Edition handles sites and the data generated by their scans.

Automatic site creation for API-generated scans

When a scan is triggered via the REST API integrated using the legacy "Burp scan" integration option, Burp Suite Enterprise Edition attempts to attach the scan data to existing sites in the system.

If no matching site is found, a new site is automatically created instead. You can choose whether these sites are displayed in the site tree. By default, they are hidden.

How does Burp Suite Enterprise Edition decide which sites to match?

Burp Suite Enterprise Edition uses its built-in site-matching rules to decide whether the scan and its data should be matched with an existing site. These site-matching rules are based on both the name of the site and the list of included and excluded URLs.

If a name was provided for the site when the scan was created:

• The system checks all folders to see if a site with this name already exists. If not, it creates a new site.
• If a site with this name already exists and it contains exactly the same set of included and excluded URLs, the new scan is attached to this site.
• If more than one site with this name exists, the system uses the first instance it finds, starting from the top of the site tree.
• If a site with this name already exists, but the included and excluded URLs do not match, this results in an error and the scan does not run.

If no name was provided for the site when the scan was created:

• If an existing site contains exactly the same set of included and excluded URLs, the new scan is attached to this site.
• If more than one site with these included and excluded URLs exists, the system uses the first instance it finds, starting from the top of the site tree.
• If no existing sites are found that contain the same included and excluded URLs, a new site is created with an auto-generated name. The new site name is generated using the hostname found in the URL followed by a sequential number if necessary.

Scan deltas

When a scan finds an issue, Burp Suite Enterprise Edition determines whether it is a new issue for the site or an issue that was already discovered by previous scans. This information is used to produce the trend information about new, resolved, and regressed issues that you see in the dashboards. It is also used to identify issues that have previously been flagged as false positives.

In the scan delta settings, you can adjust how Burp Suite Enterprise Edition decides which issues are new:

• Identify a new issue on a site as an issue type not seen before
  If an issue has already been reported anywhere on this site, the system will not treat any subsequent issues of the same type as new for this site. This is the default setting.
• Identify a new issues on a site as an issue type and URL not seen before
  The URL where this issue was found is also taken into account. For example, if a SQL-injection issue has already been found for the site, but at a different URL, the system will treat the SQL-injection issues at each URL as separate and mark them each as new when they are discovered.