> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/scans.md).

# Scans

The scan overview gives you an overview of scans performed for Advanced Persistent Threats (APT) and whether they were completed successfully or not.

{% hint style="warning" %}
**Please note**: Running a scan can take **several hours**. When running an APT scan on a host, the maximum number of detected APTs is **limited to 100**. If this limit is reached, the scan is automatically stopped. This measure ensures that only relevant detections are included in the analysis and that the database is not overloaded unnecessarily.
{% endhint %}

***

<i class="fa-compass">:compass:</i> Navigate to **Hosts** → **Advanced Persistent Threats** → **Scans** to show a list of all queued, failed, and finished scans.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FVGotPX7o312zV0mhZfQg%2Fenginsight-screenshot-hosts-apt-scans.jpg?alt=media&amp;token=afaded3c-01e4-4a10-b8ff-67752789ba16" alt=""><figcaption></figcaption></figure>

The [scan overview](#scans-overview) provides information such as:

* when a scan was started and completed, and which status it ended with.
* on which host the scan was performed and with which system load.
* how many APTs were found and which severity levels they have.
* how many files and what amount of data were scanned.

You can also stop running scans or repeat failed scans.

***

## Navigation

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

### Filtering the List

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Filter** icon <i class="fa-filter">:filter:</i> above the list to filter the list by predefined parameters.

<details>

<summary>Available filters</summary>

<table><thead><tr><th width="206.60546875">Parameter</th><th width="116.515625">Type</th><th>Description</th></tr></thead><tbody><tr><td>File Path</td><td>String</td><td>Filter by a specific file path that is being scanned or was scanned on a host, or exclude it from the results. All available file paths are shown.</td></tr><tr><td>Host</td><td>String</td><td>Filter by a specific host on which a scan is being performed or was performed, or exclude it from the results. All available hosts are shown.</td></tr><tr><td>Plan</td><td>String</td><td>Filter by a specific plan assigned to a scan, or exclude it from the results. All available plans are shown.</td></tr><tr><td>Status</td><td>String</td><td>Filter by a specific scan status or exclude it from the results. All available states are shown.</td></tr></tbody></table>

</details>

### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

### Further Actions for List Items

You can find additional actions for list items at the end of the row of the affected list item:

<table><thead><tr><th width="199.84765625">Action</th><th>Description</th></tr></thead><tbody><tr><td>Stop</td><td><p><i class="fa-eye">:eye:</i> This action is only shown for running scans with the status <strong>Processing</strong>.</p><p></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Stop</strong> to stop the running scan.</p></td></tr><tr><td>Repeat</td><td><p><i class="fa-eye">:eye:</i> This action is only shown for failed scans with the status <strong>Error</strong>.</p><p></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Repeat</strong> to repeat the failed scan.</p></td></tr></tbody></table>

***

## Scans: Overview

The scan overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2F3JeIR5naFq86enZ1wIuV%2Fenginsight-screenshot-hosts-apt-scans%20overview.jpg?alt=media&amp;token=0d755413-03dd-4e62-ad98-46e3665d9103" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="199.859375">Column</th><th>Description</th></tr></thead><tbody><tr><td>Status</td><td><p>Shows the status of the scan.<br></p><p>The following states can be shown:</p><ul><li><strong>Error:</strong> The scan could not be completed because an error occurred.</li><li><strong>Finished</strong>: The scan was completed successfully.</li><li><strong>Processing</strong>: The scan is currently being performed.</li><li><strong>Queued</strong>: The scan is in the queue.</li><li><strong>Skipped</strong>: The scan was cancelled.</li><li><strong>Stopped</strong>: The scan was stopped.</li></ul></td></tr><tr><td>Scan</td><td>Shows the unique ID of the scan. The date and time when the scan started and ended are also shown.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the ID of a scan to navigate to the respective <a href="/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/scans/scan-detail-view.md">scan detail view</a>.</td></tr><tr><td>Host</td><td>Shows the name of the host on which the scan is being performed or was performed, as well as an additional description if available. The scanned file paths are also shown, if defined.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a host to navigate to the respective <a href="/docs/manual/english/platform-usage/host-detail-view.md">host detail view</a>.</td></tr><tr><td>C / H / M / L</td><td>Shows the number of detected APTs broken down by severity: <strong>Critical</strong> (C), <strong>High</strong> (H), <strong>Medium</strong> (M), and <strong>Low</strong> (L), with <a href="/docs/manual/english/appendix/color-coding-of-severity-levels.md">color highlighting</a>.</td></tr><tr><td>System Capacity Utilization</td><td>Shows the system capacity utilization defined for the scan based on the associated <a href="/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/plans.md">plan</a>.</td></tr><tr><td>Data Volume</td><td>Shows the size of the scanned data volume in gigabytes (GB).</td></tr><tr><td>Number of Files</td><td>Shows the total number of scanned files.</td></tr><tr><td>Number of Rules</td><td>Shows the number of all <a href="/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/rules.md">rules</a> used to detect APTs during the scan.</td></tr></tbody></table>

***

## Scan: Detail View

<i class="fa-computer-mouse">:computer-mouse:</i> Click the ID of a scan in the **Scan** column to navigate to the respective [scan detail view](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/scans/scan-detail-view.md).

***