Security Checks

In Invicti, you can select the security checks you want to run in a web application security scan. If you use a Default Scan Policy, the default security checks cannot be modified or deleted. But if you configure a new scan policy, you can disable the security checks that are irrelevant to you.

By default, most of the security checks are enabled. Newly available Security Group Checks will be enabled automatically. There are no settings available for some of the security check groups. With other groups, you can filter for specific checks within that group.

Here are some security checks that have additional options you may want to configure:

• Forced Browsing
• GraphQL Library Detection
• Malware Analyzer
• BREACH Attack
• WAF Identifier
• Login Page Identifier

For further information, see Scan Policy Fields.

How to Configure Security Check Options in Invicti Enterprise

1. Log in to Invicti Enterprise.
2. From the main menu, Policies > New Scan Policy.

3. Select the Security Checks tab.

4. In the Security Checks tab, select each Security Check category to view help text in the UI.
5. Select the relevant security check.
6. Deselect the checkboxes you don’t require.
7. If the security check has group settings, configure them as required.
8. Select Save.

How to Configure Security Check Options in Invicti Standard

1. Open Invicti Standard.
2. Click the Scan Policy Editor.
3. In the Security Checks tab, select each Security Check category to view help text in the UI.
4. Select the relevant security check.

5. Deselect the checkboxes you don’t require.
6. If the security check has group settings, configure them as required.
7. Select OK.