> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/ast-scan-now.md).

# AST Scan Now

The Attack Surface Testing (AST) Scan Now feature (also called AST rescan) enables you to trigger immediate Attack Surface Testing (AST) rescans directly from alerts that were originally triggered by positive AST results. Instead of waiting for the next scheduled scan cycle, you can verify whether a detected vulnerability is still present right when you need the answer. This is useful after you've applied a remediation and want to confirm the fix, or when you need up-to-date evidence before making a triage decision.

Key capabilities of AST Scan Now include the following:

* **Rapid Results:** Once you click the rescan button, you can expect the AST results to appear within 15 minutes. Xpanse displays indicators to notify you when these results are available.
* **Automated Alert Resolution**: To streamline your workflow, the system will automatically close the alert if the rescan confirms a negative result (meaning the vulnerability is no longer present) or if it returns two consecutive inconclusive results.
* **Audit Logs for Full Traceability**: All rescan activity is recorded in the audit log for accountability and compliance.

## Prerequisites for AST Scan Now

Before the **Rescan Now** button is available on an alert, the following conditions must be met:

* The attack surface rule associated with the alert must be enabled.
* The attack surface test for the alert must be enabled.
* The service must be included in the target selection for the attack surface test.
* There is no rescan already in progress for the same attack surface test and service. Only one rescan can run at a time per test-service combination.
* You must have a role that includes Vulnerability Testing view/edit permission.

If any of these conditions are not met, the **Rescan Now** button will be unavailable or will trigger a “Scan is already in progress” message.

## Initiate an AST rescan

Perform the following steps to initiate an attack surface test rescan from an alert.

1. Navigate to Incident **Response > Alerts** and click on the alert you want to rescan.

The alert detail view displays the attack surface test, associated service, and current evidence.

2. Click the **Rescan Now** button on the top right of the alert details page.

The system submits an immediate rescan request for the attack surface test and service tied to this alert. The rescan results will display in the **Alert Evidence** section within 15 minutes.

If you click the **Rescan Now** button while a rescan is running, the system displays a message indicating a scan is already in progress. The system will display a notification indicating when the rescan is complete.

## View AST rescan evidence

The **Alert Evidence** section of the alert details provides visibility into rescan activity, including the following:

* A list of all attack surface test results, including results from on-demand rescans
* The total number of rescans initiated for this attack surface test and service
* The current rescan status, if a scan is in progress

To view the alert details, navigate to Incident **Response > Alerts** and click on the alert.

## AST rescan results and automatic actions

When a rescan completes, one of three outcomes occurs. The system automatically updates the alert based on the result:

| Scan result        | What it means                                         | Automatic alert action                                                                                                              |
| ------------------ | ----------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| Confirmed Negative | The vulnerability is no longer detected               | The alert is automatically resolved with the comment "Resolution status updated by AST Scan Now - vulnerability no longer observed" |
| Confirmed Positive | The vulnerability is still present                    | The alert is automatically reopened with the comment "Alert reopened by AST Scan Now - vulnerability confirmed"                     |
| Inconclusive       | The scan could not determine the vulnerability status | No change is made to the alert                                                                                                      |

If you have manually resolved an alert with a terminal resolution, such as resolved as false positive or resolved as duplicate, the rescan result will not override your decision. The system respects manual analyst resolutions and will not reopen or change alerts that you have intentionally closed.

## AST Scan Now timeout and error handling

If a rescan takes too long to complete, the system marks it as timed out. When this happens:

* You receive a failure notification (the notification reports the rescan as "failed").
* The alert remains unchanged. No automatic resolution or reopening occurs.
* You can initiate a new rescan after the timed-out scan is cleared.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/ast-scan-now.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.