Scan Template Form
The Scan Template form creates a new template or edits an existing one. A scan template combines target subnets (or subnet groups, or discovery lists) with port lists (or port list groups) to define what gets scanned and when. Templates are reused by both manual runs (/scans/run) and Schedules (/scans/schedules).
Inputs
| Name | Description | Allowed values | Default |
|---|---|---|---|
Name | Human-readable label for this template | Non-empty string, must be unique across scan templates (e.g., "weekly-perimeter-scan") | — |
Description | Optional free-text note | Any text, max 10,000 characters | Empty |
Subnets | Direct subnet selection — every selected subnet becomes a target | Zero or more from the Subnets list | None |
Subnet Groups | Group selection — every subnet in each selected group becomes a target | Zero or more from the Subnet Groups list | None |
Port Lists | Direct port-list selection | Zero or more from the Port Lists list | None |
Port List Groups | Group selection — every port list in each selected group is included | Zero or more from the Port List Groups list | None |
Discovery Lists | Optional — IPs from external discovery sources (cloud providers, CMDBs) | Zero or more from the Discovery Lists | None |
Reverse DNS | Whether executions request hostnames for discovered hosts, and from where (wire field reverseDnsMode) | Off · Resolver host's DNS · Nameserver group · Inherit global setting | Off |
Resolver group | The DNS vantage point whose resolvers perform the lookups (wire field resolverGroupId; shown for the two active modes) | An existing resolver group | None |
Nameserver group | The servers those resolvers query, in failover order (wire field nameserverGroupId; Nameserver group mode only) | An existing nameserver group | None |
Gotchas
- No lookups run yet: each execution records the Reverse DNS choice and the dispatcher queues its lookups, but nothing performs them until the resolver runtime ships.
- The form REQUIRES at least one target source (subnet, subnet group, OR discovery list) AND at least one port source (port list OR port list group). The submit button shows an error if either tier is empty.
- **When creating:** Use the Scan Summary panel above the sections to verify the deduplicated target/port count BEFORE saving. Overlapping subnets and overlapping port lists are deduplicated automatically — what you see in the summary is what gets scanned.
- **When editing:** Removing a target or port source affects FUTURE scans only — historical scan results remain read-only for audit integrity.
- A scan template referenced by a schedule cannot be deleted from the parent list page until the schedule is updated to drop it.
- Discovery lists that have not received their first push (zero IPs) can be selected, but the resulting scan will have zero targets from that list. Wait until the discovery source has populated before relying on it.
- Reverse DNS shape rule: "Nameserver group" needs a resolver group AND a nameserver group, "Resolver host's DNS" needs a resolver group only, and Off and Inherit need neither. The form clears pickers that no longer apply, and the API answers 400 Validation failed for an inconsistent shape.
API calls (10)
| Method | Path | Description |
|---|---|---|
| GET | /api/config/scan-templates/:id/details | Load an existing template with all selected subnets/groups/ports (Edit mode) |
| GET | /api/config/subnets | List available subnets |
| GET | /api/config/subnet-groups | List available subnet groups |
| GET | /api/config/port-lists | List available port lists |
| GET | /api/config/port-list-groups | List available port list groups |
| GET | /api/config/discovery-lists | List available discovery lists |
| GET | /api/config/resolver-groups | Populate the resolver group picker |
| GET | /api/config/nameserver-groups | Populate the nameserver group picker |
| POST | /api/config/scan-templates | Create a new template (Create mode) |
| PUT | /api/config/scan-templates/:id | Update an existing template (Edit mode) |
Related
- Scan Templates — Parent list page
- Subnets — Direct target sources
- Subnet Groups — Grouped target sources
- Port Lists — Direct port sources
- Port List Groups — Grouped port sources
- Run Scan — Executes a scan template manually
- Schedules — Runs templates on a recurring cadence