> ## Documentation Index > Fetch the complete documentation index at: https://docs.cystack.net/llms.txt > Use this file to discover all available pages before exploring further. # Scan Configuration > Plan scope, authentication, scan options, scheduling, and output before running VulnScan A good scan starts before the **Start scan** button. This page explains how to choose scope, prepare authentication, understand scan options, and avoid common configuration mistakes. ## Before You Scan Confirm these items before scanning a production target: | Item | What to Confirm | | ---------------- | ----------------------------------------------------------------------------------------------- | | Authorization | The organization owns the target or has explicit written permission to test it. | | License scope | The target is covered by the active VulnScan license. | | Network path | The VulnScan host can reach the target from the intended network location. | | Target tolerance | The target owner understands that security testing can create traffic, logs, and alerts. | | Authentication | A dedicated test account, cookie, token, header, or Basic Auth credential is ready if required. | | Notification | Mail delivery is configured if the team expects scan-completed or report-ready emails. | | Reporting | The team knows whether it needs CSV, JSON, PDF, or all three. | ## Choose the Right Scope | Scope | Use When | Watch For | | ----------- | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | | Single URL | You want focused testing for one application entry point. | May miss sibling applications on other subdomains. | | Root domain | You want discovery across a business domain such as `acme.com`. | Review discovered subdomains before broad testing. | | Subdomain | You want repeatable testing for one application such as `app.acme.com`. | Use authenticated context if most functionality is behind login. | | IP address | You want network service and exposed-component checks for one host. | Web applications behind virtual hosting may require hostname-based scans. | | CIDR range | You want inventory and service exposure checks across a small owned network block. | Start with a small range and confirm rate limits. | | Target file | You need repeatable CLI automation for many known targets. | Keep the file under change control and remove decommissioned targets. | ## Web UI Workflow 1. Open **Assets**. 2. Add or select the asset you want to assess. 3. Review the asset detail page for discovery signals. 4. Choose **Start scan**. 5. Confirm the scan name and target list. 6. Enable subdomain coverage only when the domain and discovered hosts are in scope. 7. Add authentication context if the application requires login. 8. Start the scan and monitor progress on the scan detail page. Start scan ## Authentication Options | Option | Use Case | Example | | ------------- | ------------------------------------------------------------------------------------- | -------------------------------- | | Cookie | Browser application after login. | `session=REDACTED; tenant=acme` | | Custom header | API token, bearer token, tenant routing, staging gateway, or internal routing header. | `Authorization: Bearer REDACTED` | | Basic Auth | Staging site or internal application protected by HTTP Basic Authentication. | `scanner:REDACTED` | For step-by-step authenticated scan guidance, see [Authenticated Scanning](/en/vulnscan/authenticated-scanning). ## CLI Equivalents Use CLI when the scan needs to run from automation, a scheduled task, CI/CD, or a repeatable analyst workflow. | Goal | Command Pattern | | --------------------- | ---------------------------------------------------------------------------------------------------------------------- | | Scan one application | `vulnscan scan --target https://app.acme.com --output ./reports --format json,csv` | | Scan multiple targets | `vulnscan scan --target https://app.acme.com --target https://api.acme.com --output ./reports --format json,csv` | | Scan from file | `vulnscan scan --target-file ./targets.txt --output ./reports --format json,csv` | | Include subdomains | `vulnscan scan --target acme.com --include-subdomains --output ./reports --format json,csv` | | Cookie scan | `vulnscan scan --target https://portal.acme.com --cookie "session=REDACTED" --output ./reports --format json,csv` | | Header scan | `vulnscan scan --target https://api.acme.com -H "Authorization: Bearer REDACTED" --output ./reports --format json,csv` | | Basic Auth scan | `vulnscan scan --target https://staging.acme.com --basic-auth "scanner:REDACTED" --output ./reports --format json,csv` | | Vietnamese PDF | `vulnscan scan --target https://app.acme.com --output ./reports --format pdf --lang vi` | See [CLI Reference](/en/vulnscan/cli-reference) for full command details. ## Scan Output VulnScan stores standard Web UI, CLI, and scheduled scans in the workspace database. The scan source remains visible for audit and troubleshooting. Supported export formats: | Format | Use For | | ------ | ------------------------------------------------------------------------------------ | | CSV | Remediation tracking, spreadsheets, ticket import, and vulnerability registers. | | JSON | SIEM, SOAR, custom integration, evidence processing, and data pipelines. | | PDF | Executive summaries, customer-facing reports, audit packages, and management review. | PDF exports run as background jobs. Closing the browser does not cancel the export. ## Scheduling Strategy Use recurring scans when the target is important enough to monitor continuously. Recommended starting point: | Asset Type | Suggested Cadence | | -------------------------------------- | -------------------------------------------------- | | Internet-facing production application | Weekly or after major releases. | | Critical customer portal | Weekly plus manual scan after high-risk changes. | | Staging application in CI/CD | On demand during release validation. | | Root domain discovery | Weekly or monthly, depending on asset change rate. | | Small public CIDR range | Monthly, or after infrastructure changes. | Avoid scanning large scopes during peak business traffic unless the target owner has approved it. ## Configuration Checklist Before clicking **Start scan**, verify: * The scan target exactly matches the intended hostname, URL, IP, or CIDR. * The target is inside the active license scope. * The asset detail page shows the expected discovery context. * Authenticated applications have a valid test session or token. * The scan source and output requirements are clear. * The team knows who will triage Critical and High findings. * PDF export notifications are configured if stakeholders need a downloadable report later. ## Common Mistakes | Mistake | Impact | Fix | | ---------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------- | | Scanning only an IP for a virtual-hosted application | The scanner may miss hostname-specific web content. | Scan the real hostname or URL. | | Using an expired cookie | Authenticated pages are missed. | Re-create the session before scanning. | | Running a broad root-domain scan first | Too much data before owners understand scope. | Start with discovery, review assets, then expand. | | Ignoring WAF/CDN signals | Findings may represent edge behavior rather than origin behavior. | Review WAF/CDN context in the asset detail page. | | Exporting only PDF for remediation | Engineering teams lose structured fields. | Export CSV or JSON alongside PDF. |