> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/advanced-persistent-threats.md).

# Advanced Persistent Threats

With Enginsight's Advanced Persistent Threats (APT) feature, you can scan all hosts on which a [Pulsar was installed](/docs/manual/english/installation-and-configuration/installation-and-configuration/enginsight-components/pulsar.md) for sophisticated, persistent threats.

You can use more than 7,100 predefined rules managed by Enginsight, or create custom rules that are used by default for scanning for APTs.

***

## Requirements

**Enabling the APT Feature**

* To scan your hosts for active persistent threats, you must enable the **Advanced Persistent Threats** option in the [settings of the individual hosts](/docs/manual/english/platform-usage/host-detail-view/settings.md#core-feature) or under **Hosts** → **Policies** via a [corresponding policy](/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager.md#advanced-persistent-threats).

***

## Important Notes

* All rules managed by Enginsight are automatically updated and extended every 24 hours.

**Running an APT Scan**

* Running a [scan](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/scans.md) for APTs can take several hours, depending on how many files and directories are scanned.
* When running an APT scan on a host, the maximum number of detected APTs is limited to 100. Once this limit is reached, the scan stops automatically. This measure allows us to ensure that only relevant detections are included in the analysis and that the database is not overloaded unnecessarily.
* Because APT scans generate a high system load, we recommend that you run a scan of all files and directories on the hard drive no more than once per week.

***

## APT: Menu Structure

Under **Hosts** → **Advanced Persistent Threats**, you will find various options for detecting and defending against sophisticated, persistent threats to your IT systems.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Advanced Persistent Threats** menu item to expand or collapse the corresponding submenu.

The following submenu items are available:

{% columns %}
{% column width="33.33333333333333%" %}

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FP0POIaFhOyDAv3vYlXWZ%2FEnginsight-EN-Menu-Hosts-APT.jpg?alt=media&amp;token=13508d01-eb37-4a0e-94b4-d2e18d899ee0" alt=""><figcaption></figcaption></figure>
{% endcolumn %}

{% column width="66.66666666666667%" %}

* [Dashboard](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/dashboard.md)
* [Active Threats](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/active-threats.md)
* [Scans](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/scans.md)
* [Plans](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/plans.md)
* [Rules](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/rules.md)
* [Whitelist](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/whitelist.md)
  {% endcolumn %}
  {% endcolumns %}

<i class="fa-grip-dots-vertical">:grip-dots-vertical:</i> Click and hold the **Advanced Persistent Threats** menu item to move it, including all submenu items, within the menu tree using drag and drop.

***