> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/alerts-for-positive-attack-surface-test-results.md).

# Alerts for positive attack surface test results

Confirmed positive Attack Surface Testing (AST) results, including both CVE and non-CVE findings, automatically generate alerts, enabling you to formally prioritize, track, and resolve positive AST results as part of your remediation workflow.

Confirmed Positive AST results generate alerts automatically through the Attack Surface Rules (ASRs) listed in the following table. These ASRs are enabled by default.

<table data-header-hidden><thead><tr><th width="182"></th><th width="136"></th><th></th></tr></thead><tbody><tr><td><strong>Attack Surface Rule</strong></td><td><strong>Default Severity</strong></td><td><strong>Description</strong></td></tr><tr><td>Confirmed Exploits</td><td>Critical</td><td><p>Creates alerts for test results that confirm a successful exploit against a known CVE on an active asset.</p><p>Confirmed exploits pose a critical risk because they prove that a technical weakness can be leveraged to gain unauthorized access, execute remote code, or escalate privileges.</p></td></tr><tr><td>API Security</td><td>Critical</td><td><p>Creates alerts for critical vulnerabilities identified during testing of API endpoints, specifically targeting logic weaknesses and insecure authentication schemas.</p><p>Because APIs serve as the primary gateway to sensitive backend data, these represent a direct path for unauthorized data exfiltration and potential lateral movement.</p></td></tr><tr><td>Credential Testing</td><td>High</td><td><p>Creates alerts for test results that identify system misconfigurations, which are settings that could lead to data leaks or exploitation.</p><p>Attackers leverage public documentation and automated tools to identify these predictable entry points, which can lead to full system compromise.</p></td></tr><tr><td>Misconfiguration Testing</td><td>High</td><td><p>Creates alerts for test results that identify system misconfigurations, which are settings that could lead to data leaks or exploitation.</p><p>These tests cover a broad spectrum of risky configurations that do not correspond to a specific CVE.</p></td></tr></tbody></table>

To determine which attack surface rule applies to a specific attack surface test, look at the **ASR Category** field on the **Rules** → **Vulnerability Testing** page.

## View alerts generated by attack surface test results

You can view alerts that were generated by positive attack surface test results by filtering the **Alerts** page. The alert details include information about the specific attack surface test that generated the alert.

1. Navigate to **Incident Response** → **Alerts**.
2. Click the filter icon, and select the following values from the drop-down menus:

   **Attack Surface Rule = Attack Surface Testing**

   Optionally, you can also select one or more of the specific attack surface rules nested under Attack Surface Testing in the drop-down menu.
3. Click on an alert to display the alert details.
4. Select the **About** tab and then **Alert Details** to display details about the attack surface test and test results.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/alerts-for-positive-attack-surface-test-results.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.

Attack Surface Rule	Default Severity	Description
Confirmed Exploits	Critical	Creates alerts for test results that confirm a successful exploit against a known CVE on an active asset. Confirmed exploits pose a critical risk because they prove that a technical weakness can be leveraged to gain unauthorized access, execute remote code, or escalate privileges.
API Security	Critical	Creates alerts for critical vulnerabilities identified during testing of API endpoints, specifically targeting logic weaknesses and insecure authentication schemas. Because APIs serve as the primary gateway to sensitive backend data, these represent a direct path for unauthorized data exfiltration and potential lateral movement.
Credential Testing	High	Creates alerts for test results that identify system misconfigurations, which are settings that could lead to data leaks or exploitation. Attackers leverage public documentation and automated tools to identify these predictable entry points, which can lead to full system compromise.
Misconfiguration Testing	High	Creates alerts for test results that identify system misconfigurations, which are settings that could lead to data leaks or exploitation. These tests cover a broad spectrum of risky configurations that do not correspond to a specific CVE.