Skip to main content
The Scans module runs automated vulnerability discovery against your configured web applications using integrated Qualys scanning engines. Use it to define recurring scan schedules, manage those definitions, and review the history of every execution.

​
Scheduled scans vs. scan runs

Scanning is built on two distinct concepts:
  • Scheduled scan (recurring definition). The top-level configuration. It defines what target web application to scan, which authentication record to use, what scan type to run, and when or how frequently it executes — Once, Daily, Weekly, or Monthly.
  • Scan run (execution). A single instance triggered by a scheduled scan or launched manually. Each run scans the target at a specific point in time and produces its own metrics, status, start and end dates, and vulnerability findings.
The definition is the recipe. Each run is one time you cooked it.

​
Scan statuses

Both scan definitions and individual runs carry a status:
  • Scheduled — the definition is active and waiting for its next configured run time.
  • Running / In Progress — an execution is currently scanning the target application.
  • Finished — the execution completed and its findings have been cataloged.
  • Failed — the run hit an error or was interrupted before completion.
  • Canceled — a user stopped the run before it completed.

​
Empty states

The Scans list shows one of two empty states before you have any scan history. No web applications exist yet. The page explains that you need to create a web application before you can run scans, and offers a Create Web Application button that takes you to /web-applications. Web applications exist, but no scans have run. The table renders empty, and you start your first scan from the New Scan button in the top header.
  • Web applications — define and manage the target domains every scan points at.
  • Auth records — manage the credentials used during authenticated scans.
  • Vulnerabilities — view and triage the findings your scan runs produce.