Scan Templates
Scan templates combine target subnets (or subnet groups) with port lists (or port list groups) to create reusable scan configurations. A template is eligible to run only when at least one of its subnets has a scanner assigned. Templates referenced by scan template groups are protected from deletion.
Inputs
| Name | Description | Allowed values | Default |
|---|---|---|---|
Name | Human-readable label for this template | Non-empty string, must be unique across scan templates | — |
Description | Optional free-text note about this template | Any text, max 10,000 characters | Empty |
Subnets | Individual subnets to scan | Zero or more existing subnets | None selected |
Subnet Groups | Subnet groups to scan | Zero or more existing subnet groups | None selected |
Port Lists | Individual port lists defining which ports to check | Zero or more existing port lists | None selected |
Port List Groups | Port list groups defining which ports to check | Zero or more existing port list groups | None selected |
Reverse DNS | Whether executions of this template request hostnames for discovered hosts, and from where | Off · Resolver host's DNS · Nameserver group · Inherit global setting | Off |
Resolver group | The DNS vantage point whose resolvers perform the lookups (active modes only) | An existing resolver group | None |
Nameserver group | The servers those resolvers query, in failover order (Nameserver group mode only) | An existing nameserver group | None |
Fields & columns
| Name | Description |
|---|---|
Name | Editable inline — the template label. Links to the edit form. |
Description | Editable inline — optional note |
IPs | Deduplicated host count across all selected subnets and subnet groups |
Ports | Deduplicated port count across all selected port lists and port list groups |
Probes | Total scan probes (IPs x Ports) — the actual work the scanner will perform |
Tests | Number of expected-result tests defined for this template |
Reverse DNS | The template's reverse-DNS mode: Off, Resolver host's DNS, Nameserver group or Inherit global setting |
Created By | The user who created this template |
Gotchas
- Each execution records its reverse-DNS request, and the dispatcher queues a lookup for every host the scan discovers, up to the per-execution host cap. Any online resolver installed for the assigned resolver group claims and works those lookups; a group with no online member still closes its request incomplete (normally with reason no_resolver) about 15 minutes after the scan ends. Hostnames and a per-host DNS status appear on the scan's results page, and the scan lists carry an opt-in Reverse DNS column with the execution's overall enrichment status.
- Reverse DNS never delays or blocks the port scan: lookups run alongside it, and the results page fills in hostnames as they land — reload to see progress. Each execution snapshots its DNS request at start, so changing the mode later affects only future executions.
- In "Inherit global setting" mode, a global default of Off means the execution requests no lookups at all — the same as setting the template itself to Off.
- On the wire the three reverse-DNS fields are reverseDnsMode (disabled | resolver_host_dns | nameserver_group | inherit_global), resolverGroupId and nameserverGroupId. Shape rule: nameserver_group needs both ids, resolver_host_dns needs resolverGroupId, disabled and inherit_global need neither — an inconsistent PUT/POST is a 400 Validation failed.
- One probe = one IP + one port. A template with 256 IPs and 20 ports generates 5,120 probes.
- A template is only eligible to run when at least one of its subnets has a scanner assigned.
- Templates referenced by scan template groups are protected from deletion — remove the group reference first.
- A template that has run a scan cannot be deleted: every scan keeps pointing at the template that produced it, so the audit trail stays whole. To retire one, remove its subnets and port lists instead.
API calls (10)
| Method | Path | Description |
|---|---|---|
| GET | /api/config/scan-templates | List all scan templates |
| POST | /api/config/scan-templates | Create a new scan template |
| PUT | /api/config/scan-templates/:id | Update an existing scan template |
| DELETE | /api/config/scan-templates/:id | Delete a scan template (if unreferenced) |
| GET | /api/config/scan-templates/:id/details | Get expanded template details with resolved counts |
| GET | /api/config/scan-templates/:id/tests | List compliance tests for a scan template |
| POST | /api/config/scan-templates/:id/tests | Create a compliance test for a scan template |
| PUT | /api/config/scan-templates/:templateId/tests/:testId | Update a compliance test |
| DELETE | /api/config/scan-templates/:templateId/tests/:testId | Delete a compliance test |
| GET | /api/config/scan-templates/filter-values | Get available filter values for the templates table |
Related
- Resolver Groups — The vantage point a template names for reverse-DNS lookups
- Nameserver Groups — The servers a template in Nameserver group mode points at
- Subnets — Define which network ranges the template scans
- Subnet Groups — Group subnets for simpler template configuration
- Port Lists — Define which ports the template checks
- Port List Groups — Group port lists for simpler template configuration
- Scan Template Groups — Organize templates for scheduling and permissions
- Run Scan — Launch a scan using a configured template
- Recent Scans — View progress and results of scans launched from templates
- Results — Detailed findings from scans based on this template
- Schedules — Automate recurring scans using templates
- Discovery — Discovery lists can be referenced by templates as scan targets
- Scanner Groups — Scanner groups execute template scans from multiple vantage points
- Port Catalog — Reference library for importing ports into port lists used by templates
- FQDN Groups — FQDN-based targeting is planned; FQDN groups are not yet referenceable by scan templates
- FQDNs — FQDN-based targeting is planned; individual FQDNs are not yet referenceable by scan templates