> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/attack-surface-testing-intrusivity.md).

# Attack Surface Testing intrusivity

Attack surface tests are classified by their level of intrusiveness. While most tests are benign, some vulnerabilities require more intrusive methods for confirmation. You can choose whether to enable these more intrusive tests, with the various levels of intrusiveness described in the table below.

<table data-header-hidden><thead><tr><th width="178"></th><th></th><th></th></tr></thead><tbody><tr><td>Intrusivity level</td><td>Description</td><td>Examples</td></tr><tr><td>Level 0: Non-intrusive</td><td>No interaction with the target system beyond passive information gathering. The system remains completely unaffected by any tests.</td><td><ul><li>Default credential login tests</li><li>Basic HTTP GET / POST requests</li></ul></td></tr><tr><td>Level 1: Minimal interaction</td><td>Basic interactions that involve standard requests without altering the system state or data. Any changes are confined to volatile memory and do not persist.</td><td><ul><li>Dropping a small, benign file in a temporary directory, such as <code>/tmp</code>, that the system deletes on reboot.</li></ul></td></tr><tr><td>Level 2: Temporary modification</td><td>Makes temporary and fully reversible changes to the system. Modifications do not impact normal operations and can be undone without lasting effects. Cleanup is not necessary, but can be done.</td><td><ul><li>Dropping files with benign content in non-temporary directories and that can be removed afterward</li><li>Modifying service configurations that revert after a restart</li><li>Creating a temporary database user that is deleted upon restart</li></ul></td></tr><tr><td>Level 3: Reversible changes</td><td>Introduces changes that persist but can be reversed with your actions. These changes may slightly impact normal operations, but are recoverable.</td><td><ul><li>Dropping a file containing controlled code that is removed afterward</li><li>Modifying application data (such as UI elements or database entries) that can be corrected</li><li>Executing commands that alter system state but can be undone</li></ul></td></tr><tr><td>Level 4: Significant impact</td><td>Makes significant changes that are not easily reversible. These actions may disrupt services or alter system data.</td><td><ul><li>Injecting data into a database that cannot be fully removed</li><li>Causing temporary service unavailability (for example, a brief Denial of Service lasting a few seconds)</li><li>Creating users or projects within the application that cannot be deleted</li></ul></td></tr><tr><td>Level 5: Full compromise</td><td>Actions that fully compromise the system, leading to irreversible damage, persistent backdoors, or extensive disruption.</td><td><ul><li>Executing commands that install persistent backdoors or webshells that cannot be removed</li><li>Modifying critical system files or settings leading to system instability</li><li>Performing Denial of Service attacks that render services completely unavailable</li></ul></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/attack-surface-testing-intrusivity.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.