AST Scan Now

Trigger on-demand AST rescans from alerts to verify vulnerabilities and automatically update alert status.

The Attack Surface Testing (AST) Scan Now feature (also called AST rescan) enables you to trigger immediate Attack Surface Testing (AST) rescans directly from alerts that were originally triggered by positive AST results. Instead of waiting for the next scheduled scan cycle, you can verify whether a detected vulnerability is still present right when you need the answer. This is useful after you've applied a remediation and want to confirm the fix, or when you need up-to-date evidence before making a triage decision.

Key capabilities of AST Scan Now include the following:

• Rapid Results: Once you click the rescan button, you can expect the AST results to appear within 15 minutes. Xpanse displays indicators to notify you when these results are available.
• Automated Alert Resolution: To streamline your workflow, the system will automatically close the alert if the rescan confirms a negative result (meaning the vulnerability is no longer present) or if it returns two consecutive inconclusive results.
• Audit Logs for Full Traceability: All rescan activity is recorded in the audit log for accountability and compliance.

Prerequisites for AST Scan Now

Before the Rescan Now button is available on an alert, the following conditions must be met:

• The attack surface rule associated with the alert must be enabled.
• The attack surface test for the alert must be enabled.
• The service must be included in the target selection for the attack surface test.
• There is no rescan already in progress for the same attack surface test and service. Only one rescan can run at a time per test-service combination.
• You must have a role that includes Vulnerability Testing view/edit permission.

If any of these conditions are not met, the Rescan Now button will be unavailable or will trigger a “Scan is already in progress” message.

Initiate an AST rescan

Perform the following steps to initiate an attack surface test rescan from an alert.

1. Navigate to Incident Response > Alerts and click on the alert you want to rescan.

The alert detail view displays the attack surface test, associated service, and current evidence.

1. Click the Rescan Now button on the top right of the alert details page.

The system submits an immediate rescan request for the attack surface test and service tied to this alert. The rescan results will display in the Alert Evidence section within 15 minutes.

If you click the Rescan Now button while a rescan is running, the system displays a message indicating a scan is already in progress. The system will display a notification indicating when the rescan is complete.

View AST rescan evidence

The Alert Evidence section of the alert details provides visibility into rescan activity, including the following:

• A list of all attack surface test results, including results from on-demand rescans
• The total number of rescans initiated for this attack surface test and service
• The current rescan status, if a scan is in progress

To view the alert details, navigate to Incident Response > Alerts and click on the alert.

AST rescan results and automatic actions

When a rescan completes, one of three outcomes occurs. The system automatically updates the alert based on the result:

Scan result	What it means	Automatic alert action
Confirmed Negative	The vulnerability is no longer detected	The alert is automatically resolved with the comment "Resolution status updated by AST Scan Now - vulnerability no longer observed"
Confirmed Positive	The vulnerability is still present	The alert is automatically reopened with the comment "Alert reopened by AST Scan Now - vulnerability confirmed"
Inconclusive	The scan could not determine the vulnerability status	No change is made to the alert

If you have manually resolved an alert with a terminal resolution, such as resolved as false positive or resolved as duplicate, the rescan result will not override your decision. The system respects manual analyst resolutions and will not reopen or change alerts that you have intentionally closed.

AST Scan Now timeout and error handling

If a rescan takes too long to complete, the system marks it as timed out. When this happens:

• You receive a failure notification (the notification reports the rescan as "failed").
• The alert remains unchanged. No automatic resolution or reopening occurs.
• You can initiate a new rescan after the timed-out scan is cleared.