Results
Displays the detailed findings of a single completed scan, including all discovered hosts, ports, and services. Security engineers use this page for attack surface monitoring — identifying unexpected open ports, new services, and deviations from expected baselines. Results are paginated and loaded on demand as you scroll to handle large scans efficiently. Failed scans show per-scanner error details.
Fields & columns
| Name | Description |
|---|---|
IP Address | The target host IP (IPv4 or IPv6) where the port was discovered |
Hostnames | Reverse-DNS name(s) for this host, from the scan's reverse-DNS enrichment (merged in after the results page loads). "—" when there are none, when the DNS state could not be read, or when retention has removed the scan's DNS evidence. Click a non-"Not requested" cell to open the evidence drawer, which lists every lookup attempt for that host. |
DNS Status | The host's reverse-DNS status: Resolved, No PTR, Timed out, Nameserver error, Resolver error, Pending, Not attempted, Expired, or Not requested (see the legend below the table for what each means). "—" means unknown: the DNS state could not be read right now, or retention removed this scan's DNS evidence (the summary box says which). |
Scanner | Name of the scanner that discovered this result (useful for multi-vantage scans) |
Port | Port number and protocol (e.g., 443/tcp) |
State | Port state: Open (accepting connections), Closed (refused), or Filtered (no response / firewalled) |
Service | Detected service name based on port number or banner analysis |
Banner | Raw response string from the service, useful for version identification |
Discovered | Timestamp when the scanner detected this host/port combination |
Changes | Opened/closed port-state transitions vs the previous scan of this template (per scanner vantage). "Baseline scan" means there is no prior scan to compare. |
Reverse DNS — Mode | In the "Reverse DNS" summary box above the results table: how this execution resolved hostnames — "Resolver host DNS" (a resolver's own system resolver) or "Nameserver group" (a specific ordered failover list of nameservers). |
Reverse DNS — Resolver group | In the summary box: the resolver group whose resolvers ran this execution's lookups. Always shown — every enrichment has one, in both modes. |
Reverse DNS — Nameserver group | In the summary box, mode "Nameserver group" only: the ordered failover list of nameservers the resolvers queried. That mode shows both groups — the resolver group that ran the lookups and the nameserver group that answered them. |
Reverse DNS — Status | In the summary box: the enrichment's own lifecycle status — Collecting, Closing, Complete, Incomplete, or Cancelled (the same words as the scan lists' Reverse DNS column) — with its terminal reason in parentheses once closed. See the gotchas below for what each value means. |
Reverse DNS — Requested / Deadline / Closed | In the summary box: when the enrichment opened, when its 15-minute lookup window ends ("—" while still open), and when it actually closed ("—" while still open or closing). |
Reverse DNS — Tasks | In the summary box: a one-line breakdown of this execution's lookup tasks by status — Pending, Assigned, Done, Failed, Expired, Cancelled — with a count for each. Replaced by a retention note once the scan's DNS evidence has been removed. |
Gotchas
- The Changes section compares this scan against the previous completed scan of the same template, per scanner. A scanner that did not run this time will not produce false "closed" changes. "No changes since scan #N" is a real result (stability), distinct from a baseline scan.
- The DNS Status legend (below the results table): Resolved — a PTR record was found for this host. No PTR — no PTR record exists for this host. Timed out — the nameserver/resolver did not respond in time. Nameserver error — the nameserver returned an error. Resolver error — the resolver could not complete the lookup. Pending — the lookup has not finished yet. Not attempted — no lookup was attempted for this host. Expired — the lookup window closed before an answer arrived. Not requested — reverse DNS was not requested for this scan.
- Hostnames and DNS Status cannot be filtered or sorted: hostnames are merged into the page in TypeScript after the SQL results page is already cut, so the server-side filter grammar has no column for them.
- "Not requested" means the scan's template had reverse DNS off — there is no DNS evidence trail for these hosts. "Pending" means a lookup is queued or in flight, including a retry after an earlier failed attempt (the column does not fall back to that attempt's outcome while a retry is running). "Expired" means the enrichment's lookup window closed before an answer arrived for this host — a terminal state, distinct from a still-open "Pending".
- Scan completion never waits for DNS: a scan reaches "completed" independently of its reverse-DNS enrichment, so a freshly completed scan's results page can show every host as "Pending" and fill in hostnames/status as the resolver reports back — reload the page to see progress.
- Click a hostname cell (any DNS status except "Not requested") to open the evidence drawer. It lists every attempt recorded for that host, including a superseded failed attempt from an earlier retry, not just the current status shown in the column.
- The "Reverse DNS" summary box above the results table has four states. A warning "Reverse DNS status unavailable" means the manager could not read the DNS state right now — retry; the scan's own port-scan results are unaffected. Plain "Reverse DNS not requested" means the scan's template (or the inherited global default) had reverse DNS turned off for this execution — there is nothing to retry. The full detail grid (Mode, Resolver group, Nameserver group in that mode, Status, Requested/Deadline/Closed, Tasks) is the normal state. The same grid with "Reverse DNS evidence was removed by retention after 90 days" in place of Tasks means the scan did request reverse DNS, but its hostnames, per-host statuses, lookup attempts and DNS receipts are past the retention window (the same 90 days as scan results) and are no longer kept — so every host shows "—", and the evidence drawer says the evidence was removed.
- Enrichment Status meanings: Collecting — the scan is still running (or just finished) and its hosts are still being collected and their lookups queued. Closing — the scan has completed or failed, a deadline is set, and the reconciler is waiting for pending lookups to finish or expire before the final close. Complete — closed because every task reached a terminal outcome and host derivation had read all of the scan's evidence by the deadline. Incomplete — closed for any other reason (see the terminal reason in parentheses). Cancelled — the scan itself was cancelled, so its enrichment cancels its queued lookups too.
- Terminal reason meanings (shown in parentheses after the Status once closed): complete — the normal close, every task done and derivation caught up. deadline — the 15-minute lookup window ran out before every task finished, or the dispatcher was down or behind and swept late. no_resolver — lookups were queued but no resolver in the group came online before the deadline. host_cap — host derivation stopped because the scan's host cap was reached (a stopping point, not a failure). cancelled — the scan was cancelled.
- Results are paginated server-side — scroll down in the table to load additional pages automatically. Use the rows-per-page selector in the table footer to choose how many results are fetched per scroll page (20 / 50 / 100 / 250). Changing the value restarts loading from the top.
- The IP, Port, State, Service, and Scanner columns support server-side filtering: selecting a filter value re-queries the server for the full matching set, so the "of Z" total in the footer always reflects the filtered result count — not just the rows loaded so far.
- A scan with zero results does not necessarily indicate an error; it may mean no open ports were found in the target range.
- Rows marked "(unchanged)" in the Discovered column were not observed afresh this scan: the scanner ran a compacted (baseline-delta) job, found the port still open, and attested that in its signed receipt instead of re-sending the row. The time shown is the receipt's; such rows carry no service or banner, and "not confirmed" means the job never delivered a receipt, so the port is shown from its dispatched baseline alone. If the compacted set could not be read (an unusually large one, or the jobs schema unreachable), the API returns `compactedUnavailable: true` and the table shows only observed rows.
- Failed scan error details come from the jobs database and may take a moment to load separately from the scan metadata.
- Export-context tracking is operational, not user-tagging. When you export results, mipo records WHO exported, WHEN, the source query, the row count, and the file format. This builds the audit trail for compliance review. It does NOT let you attach custom labels (department, audit period, framework) to the export — that taxonomy lives in your downstream evidence-management system.
- You can cancel a pending or running scan with the Cancel button by the status badge. Pending work never dispatches; in-flight scanners abort mid-probe (older scanner builds finish their current job, then the scan still reaches "cancelled"). Partial results gathered before the stop are kept. A cancelled scan is never used as a diff baseline.
API calls (10)
| Method | Path | Description |
|---|---|---|
| GET | /api/scans/:id | Retrieve scan metadata (name, status, timestamps, result count) |
| GET | /api/scans/:id/results | Paginated scan results (hosts, ports, services) |
| GET | /api/scans/:id/dns-observations | Raw reverse-DNS observation evidence for a scan (the evidence drawer's data source), optionally filtered by ip/outcome |
| GET | /api/audit/states?scanId=:id | Port-state transitions (opened/closed) detected for this scan |
| GET | /api/scans/:id/progress | Scan progress and per-scanner error details for failed scans |
| POST | /api/scans/:id/save-tests | Save test baselines for scan results |
| GET | /api/scans/:id/results-with-tests | Get results with test pass/fail data |
| GET | /api/export/context | Get export metadata for compliance reporting |
| POST | /api/export/context | Configure export context for audit evidence |
| POST | /api/scans/:id/cancel | Cancel a pending or running scan (requires /scans:execute) |
Related
- Recent Scans — Lists all scans; click a completed scan to view its results
- Scan Templates — Defines which subnets and ports were included in the scan
- Execution Proof — Per-job receipts proving the scan ran (including no-change runs); results show what it found, proof shows that it happened
- Resolvers — The worker identities that performed this scan's reverse-DNS lookups
- Settings — The global reverse-DNS default a template in "Inherit global setting" mode follows