Scan Templates
Scan templates combine target subnets (or subnet groups) with port lists (or port list groups) to create reusable scan configurations. A template is eligible to run only when at least one of its subnets has a scanner assigned. Built-in templates cannot be modified. Templates referenced by scan template groups are protected from deletion.
Inputs
| Name | Description | Allowed values | Default |
|---|---|---|---|
Name | Human-readable label for this template | Non-empty string, must be unique across scan templates | — |
Description | Optional free-text note about this template | Any text, max 10,000 characters | Empty |
Subnets | Individual subnets to scan | Zero or more existing subnets | None selected |
Subnet Groups | Subnet groups to scan | Zero or more existing subnet groups | None selected |
Port Lists | Individual port lists defining which ports to check | Zero or more existing port lists | None selected |
Port List Groups | Port list groups defining which ports to check | Zero or more existing port list groups | None selected |
Reverse DNS | Whether executions of this template request hostnames for discovered hosts, and from where | Off · Resolver host's DNS · Nameserver group · Inherit global setting | Off |
Resolver group | The DNS vantage point whose resolvers perform the lookups (active modes only) | An existing resolver group | None |
Nameserver group | The servers those resolvers query, in failover order (Nameserver group mode only) | An existing nameserver group | None |
Fields & columns
| Name | Description |
|---|---|
Name | Editable inline (non-built-in) — the template label. Links to the edit form. |
Description | Editable inline (non-built-in) — optional note |
IPs | Deduplicated host count across all selected subnets and subnet groups |
Ports | Deduplicated port count across all selected port lists and port list groups |
Probes | Total scan probes (IPs x Ports) — the actual work the scanner will perform |
Tests | Number of expected-result tests defined for this template |
Reverse DNS | The template's reverse-DNS mode: Off, Resolver host's DNS, Nameserver group or Inherit global setting |
Built-in | Whether this template ships with mipo and is read-only |
Created By | The user who created this template |
Gotchas
- No lookups run yet. Each execution records its reverse-DNS request, and the dispatcher queues a lookup for every host the scan discovers, up to the per-execution host cap, but nothing performs them until the resolver runtime (R2) ships: the request closes incomplete (normally with reason no_resolver) about 15 minutes after the scan ends, and hostnames do not appear in results yet (R3).
- Reverse DNS never delays or blocks the port scan: lookups are designed to run alongside it, and the results page will fill in hostnames as they land. Each execution snapshots its DNS request at start, so changing the mode later affects only future executions.
- In "Inherit global setting" mode, a global default of Off means the execution requests no lookups at all — the same as setting the template itself to Off.
- On the wire the three reverse-DNS fields are reverseDnsMode (disabled | resolver_host_dns | nameserver_group | inherit_global), resolverGroupId and nameserverGroupId. Shape rule: nameserver_group needs both ids, resolver_host_dns needs resolverGroupId, disabled and inherit_global need neither — an inconsistent PUT/POST is a 400 Validation failed.
- One probe = one IP + one port. A template with 256 IPs and 20 ports generates 5,120 probes.
- A template is only eligible to run when at least one of its subnets has a scanner assigned.
- Built-in templates cannot be modified or deleted — clone them to create customizable copies.
- Templates referenced by scan template groups are protected from deletion — remove the group reference first.
API calls (10)
| Method | Path | Description |
|---|---|---|
| GET | /api/config/scan-templates | List all scan templates |
| POST | /api/config/scan-templates | Create a new scan template |
| PUT | /api/config/scan-templates/:id | Update an existing scan template |
| DELETE | /api/config/scan-templates/:id | Delete a scan template (if unreferenced) |
| GET | /api/config/scan-templates/:id/details | Get expanded template details with resolved counts |
| GET | /api/config/scan-templates/:id/tests | List compliance tests for a scan template |
| POST | /api/config/scan-templates/:id/tests | Create a compliance test for a scan template |
| PUT | /api/config/scan-templates/:templateId/tests/:testId | Update a compliance test |
| DELETE | /api/config/scan-templates/:templateId/tests/:testId | Delete a compliance test |
| GET | /api/config/scan-templates/filter-values | Get available filter values for the templates table |
Related
- Resolver Groups — The vantage point a template names for reverse-DNS lookups
- Nameserver Groups — The servers a template in Nameserver group mode points at
- Subnets — Define which network ranges the template scans
- Subnet Groups — Group subnets for simpler template configuration
- Port Lists — Define which ports the template checks
- Port List Groups — Group port lists for simpler template configuration
- Scan Template Groups — Organize templates for scheduling and permissions
- Run Scan — Launch a scan using a configured template
- Recent Scans — View progress and results of scans launched from templates
- Results — Detailed findings from scans based on this template
- Schedules — Automate recurring scans using templates
- Discovery — Discovery lists can be referenced by templates as scan targets
- Scanner Groups — Scanner groups execute template scans from multiple vantage points
- Port Catalog — Reference library for importing ports into port lists used by templates
- FQDN Groups — FQDN-based targeting is planned; FQDN groups are not yet referenceable by scan templates
- FQDNs — FQDN-based targeting is planned; individual FQDNs are not yet referenceable by scan templates