Scans and findings

Scan one live service

  1. Open a host.

  2. Select the service port in the host header.

  3. Select Run Alkonos.

  4. Optionally choose agents, a request rate limit, a timeout, login behavior, context, and supporting documents.

  5. Start the scan.

Saved credentials on the selected port are available to the scan. If several credentials exist, select which ones to use.

Scan a whole group

Open the group and select Run all. You can:

  • Run all enabled DAST agents or select specific agents.

  • Limit the run to the top hosts by relevance, or leave the host count blank to scan all hosts.

  • Set a request rate limit and overall timeout.

  • Add context for the agents.

  • Enable automatic account registration when the target has no saved login.

A group run queues separate scans for its selected hosts. Assets without a discovered service port cannot be targeted by DAST.

Store credentials for authenticated testing

  1. Open a host and select the intended service port.

  2. Open Credentials.

  3. Select Add credential.

  4. Choose a type: form login, basic auth, bearer token, API key, cookie, OAuth, or other.

  5. Add a clear label and the required secret values.

Credentials are stored per service port. Scans and crawls use the selected credentials; secret payloads are not returned by list operations.

Scan source code

  1. Connect a forge and add the repository to an asset group.

  2. Open the repository asset.

  3. Select the branch in the repository header.

  4. Select Scan branch.

Branches are the scannable units under a repository. Open Pull requests and select Scan on an open PR when its head branch has been indexed.

Monitor progress

Use Scans for organization-wide scan state and metrics. From a host, the Agents tab shows scans and agent activity for that asset. A completed scan exposes its findings and per-agent results.

Triage vulnerabilities

Open Vulnerabilities to search and filter by severity, status, weakness type, scanner, or creation date.

A finding detail can include:

  • Description and affected URL.

  • Evidence and captured request/response data.

  • Impact and reproduction steps.

  • Remediation guidance.

  • CVSS, CWE, CVE, and code context.

  • The originating agent trace.

Use these customer-facing statuses:

  • Open — accepted work that has not been fully triaged.

  • Confirmed — validated as a real issue.

  • In progress — remediation is underway.

  • Resolved — remediation is complete.

  • Won’t fix — accepted risk.

  • False positive — not a valid vulnerability.

Export reports

Generate a PDF from the Reports page, an asset, a group, or a vulnerability. Reports can cover an organization overview, asset group, asset, scan, or selected vulnerabilities.

Report generation is asynchronous. Open Reports, wait for Completed, then download the PDF.