Dashboard Help

Managing members on your Catcher24 dashboard

Adding them, removing them, and other frequently asked questions. How many members can I add to my organization? You are able to add as many users as you like. How to add a new user to an organization? In order to be able to add new members to an existing organization, you must have an admin role within an organization. 1. Open the dashboard and select the correct organization. 2. Click Members under the Organization management section of the menu. 3. This is the current member overview of this organization, press the green invite member button. 4. Enter the email. https://app.arcade.software/share/Uz9CpfMKVJLpjAbc0CVC Your invited member will receive an email containing the invite information and login or register link to the dashboard. Once logged in, the member can accept the invitation and be part of your organization. How do I remove a user? 1. Open the dashboard and select the correct organization. 2. Click Members under the Organization management section of the menu. 3. Click the red garbage bin of the member you want to remove from your organization and confirm the removal of the member. Can I withdraw an invitation? When an invited member has not yet accepted the invite, the invitation will be shown in a separate invitations overview. You can simply remove the invitation and the user will no longer be able to accepted or decline the invite in their dashboard. 1. Open the dashboard and select the correct organization. 2. Click Members under the Organization management section of the menu. 3. In the invitations overview, click the red garbage bin of the member you want to remove from your organization and confirm the removal of the member.

What IPs does Catcher24 use to scan my environment?

If you’re using security technologies like a Next-Gen Firewall, Intrusion Prevention System (IPS), Intrusion Detection System (IDS), or a Web Application Firewall (WAF), they may flag Catcher's traffic as suspicious and block it. We recommend allowlisting our IP ranges to avoid these problems. This article provides the full list of IP ranges you’ll need to configure in your security tools to avoid false positives or blocked traffic during scans. 95.211.123.176/28 185.24.173.0/24 FAQ Where should I add these ranges? You should add these ranges to the appropriate IPS, IDP etc. you have enabled. If your applications are hosted by a 3rd party, please inform them that you will run scans from these ranges, to avoid your 3rd party blocking our IPs. What about my firewall? If you use a perimeter firewall, please don't add our ranges to it as that would show results which aren't accessible through the internet normally.

Catcher security score

The Security Score in Catcher provides a quick, comprehensive view of your organization's overall security posture. It combines three key metrics into a single score ranging from 0 to 100, where higher scores indicate better security. How the Security Score Is Calculated The score is a weighted sum of three components: - Vulnerability Risk Score (VRS) – 60% weight - Behavior Risk Score (BRS) – 25% weight - Endpoint Protection Score (EPS) – 15% weight Formula Security Score = (VRS × 0.6) + (BRS × 0.25) + (EPS × 0.15) If Phished integration or ESET integration is not configured, their weights are redistributed proportionally among the remaining components to maintain a total weight of 100%. Component Breakdown Vulnerability Risk Score (VRS) Assesses the severity of vulnerabilities in your environment. - Penalty per vulnerability: - Critical: 40 - High: 20 - Medium: 5 - Low: 1 - Score normalization: Average penalty is normalized against a max of 120. - Score caps based on highest severity: - Critical: max 50 - High: max 70 - Medium: max 85 - Low: max 95 - No vulnerabilities: 100 Behavior Risk Score (BRS) Derived from the Phished integration. - If configured, score is fetched directly (0–100). - If not configured, BRS is excluded from the calculation. Endpoint Protection Score (EPS) Evaluates ESET endpoint protection and update status. Formula: EPS = ((Protected / Total) × 0.6 + (Updated / Total) × 0.4) × 100 - If not configured, EPS is excluded from the calculation. How to Improve Your Catcher Security Score Improving your Catcher Security Score means strengthening your organization's overall cybersecurity posture. Since the score is based on three components—Vulnerability Risk Score (VRS), Behavior Risk Score (BRS), and Endpoint Protection Score (EPS)—you can target improvements in each area: Vulnerability Risk Score (VRS) – 60% Weight This is the most heavily weighted component, so reducing vulnerabilities has the biggest impact. Steps to improve: - Patch critical and high vulnerabilities promptly. These carry the highest penalties. - Conduct regular vulnerability scans to identify new issues early, or do this automatically by scheduling your scans. - Implement automated patch management to reduce manual effort and delays. - Remove or isolate unused or legacy systems that may introduce risks. Behavior Risk Score (BRS) – 25% Weight This score comes from the Phished integration, which assesses user behavior around phishing threats. Steps to improve: - Enable and configure the Phished integration if not already done. - Identify and report our phishing simulations in your email client. - Train your security awareness by completing security awareness training. Endpoint Protection Score (EPS) – 15% Weight This score reflects how well your endpoints are protected and updated via ESET integration. Steps to improve: - Ensure all endpoints have ESET protection installed. - Keep endpoint protection software up to date. - Automate updates and protection checks to maintain coverage. - Monitor for unprotected or outdated devices and remediate quickly. If Integrations Are Missing If either Phished or ESET integrations are not configured, their weights are redistributed. This means the remaining components become even more critical to your score. Tip: Configuring all integrations ensures a balanced and accurate score—and gives you more control over improvements.

How to scan websites hosted behind Cloudflare with Catcher24

This article explains how to set up Catcher24 to correctly scan web servers that are hosted behind Cloudflare. Catcher24 is fully compatible with Cloudflare, but it is important that you set up your targets in the Catcher dashboard correctly. This ensures our scanning engines can distinguish between and reach your intended targets (the website versus the underlying server). Configuring your targets - To scan only the website/web-application: Add the domain hostname. - To scan the server infrastructure: Add the server IP-address. - To scan the infrastructure and website: Add both the hostname and the IP-address. Please note that this will count as two targets. Best practice: In all situations, you must prevent scan interference by adding the Catcher24 scanning IPs to the Cloudflare allowlist.

How to add Catcher24 IPs to the Cloudflare allowlist

To ensure Catcher24 can successfully scan your targets without being blocked by Cloudflare's security features, you must create a WAF Custom Rule to allow our scanning engines. Step-by-step guide 1. Log in to your Cloudflare dashboard and select your domain. 2. Navigate to Security > Security rules. 3. Click + Create rule > Custom rules 4. Name the rule: e.g., "Allow Catcher24 Scanners". 5. Configure the "If incoming requests match..." section: - Field: Select IP Source Address. - Operator: Select is in. - Value: Enter the Catcher24 IP ranges listed in this help article (type the first one, press Enter, then type the second). 6. Configure the "Then take action..." section: - Choose action: Select Skip. - WAF components to skip: Check the boxes for WAF components to skip. Click the More components to skip option and check all extra boxes as well. 7. The rule will look like this: 8. Click Deploy. Note: Using the "Skip" action is preferred over "Allow" because "Allow" only bypasses the firewall, whereas "Skip" prevents Cloudflare from presenting CAPTCHAs or JavaScript challenges that can block automated scanners. ⚠️ Important Note: Cloudflare Validation Checks Even with the Catcher24 IPs added to your allowlist, Cloudflare performs certain Validation Checks that run before your custom rules are evaluated. These checks cannot be disabled or bypassed by an allowlist. According to Cloudflare's documentation, this component blocks: - Malformed HTTP requests. - Specific attack patterns in HTTP headers (e.g., Shellshock attacks). - Requests that trigger "sanity checks" early in Cloudflare's infrastructure. How this affects your scans: Because these checks happen at the Cloudflare edge, before the request reaches your "Allow/Skip" rule, some specific scan probes sent by Catcher24 may still be blocked. - Scans that lose connection or fail. - Limited scan results on Cloudflare targets. - Blocked Probes: You may see scan logs indicating that certain connection attempts or specific exploit payloads failed, even though the IP is whitelisted. This is standard Cloudflare behavior and generally means Cloudflare is doing its job to protect your application from malformed traffic, even from authorized scanners. Suggestions for mitigating interference If you have already added the Catcher24 IPs to your allowlist but continue to see scan errors or incomplete results, the behavior is likely due to Cloudflare's mandatory validation checks which cannot be bypassed by standard allowlisting. Because these checks cannot be disabled directly on your main domain, we recommend one of the following approaches: 1. Create a dedicated subdomain This is the most effective workaround for production environments. - Setup: Create a specific subdomain (e.g., catcher-scan.yourdomain.com) and point its DNS to the same backend IP as your main website. - Configuration: On this specific subdomain, you can safely lower Cloudflare's security settings without affecting your main site users. - Disable "Browser Integrity Check". - Disable "Always Use HTTPS" (if necessary for specific HTTP probes). - Disable "Bot Fight Mode" or "Super Bot Fight Mode". - Action: Add this subdomain as your target in the Catcher dashboard. 2. Scan a staging environment If you have a staging or development environment that mirrors your production code, use that as your primary scan target. - Benefit: Staging environments often have relaxed WAF configurations or can be configured to bypass Cloudflare entirely (e.g., restricted by IP access only), allowing Catcher24 to scan the application logic without WAF interference. 3. Cloudflare Enterprise options If you are on a Cloudflare Enterprise plan, you may have access to advanced settings that are not available on standard plans. - Enterprise Features: Enterprise support can sometimes offer higher-level configuration options, such as custom "Host Header" modification or classifying specific scanner IPs as trusted traffic to bypass mandatory validation checks. Please contact your Cloudflare account manager if this applies to you.

Export a PDF report of a target

Getting your security data out of the Catcher24 dashboard and into a PDF is a straightforward process, whether you need it for an internal audit, an insurance application, or just a peace-of-mind archive. Here is how you can download a report for a specific target. How to Download a PDF Report To generate a report for a specific target (such as a domain, IP address, or web application), follow these steps: 1. Select Your Organization If you manage multiple organizations, ensure you have selected the correct organization in the navigation menu. 2. Navigate to the Targets Navigate to the targets overview. 3. Open the Target Details Click on the specific Target name you wish to report on. This will open the detailed view showing the current security status, open ports, and found vulnerabilities. 4. Generate the PDF - Look for the "Download PDF" button, typically located in the top-right corner of the target's overview page. - Wait till the export PDF button is no longer loading. 5. Download and Save Once the system processes the data, your browser will open the target report PDF.

Microsoft Teams integration

Integrating Catcher24 with Microsoft Teams allows you to stream critical alerts, scan completions, and target updates directly into your preferred Teams channel. By setting up an Incoming Webhook, your team can stay informed and react to security insights in real time without having to constantly monitor the Catcher24 dashboard. To complete this setup, you will first generate a webhook URL inside Microsoft Teams, and then paste that URL into your Catcher24 organization. Step-by-Step Instructions To be able to send notifications to your Microsoft Teams instance you will need to either pick an existing channel or create a new channel. Part 0: Create a new Teams channel 1. Click "Create channel" 2. Give your channel a name, optional description, select a channel type and set the layout, we recommend the Posts layout. Part 1: Generate the Webhook URL in Microsoft Teams 1. Open your Microsoft Teams Channel Navigate to the specific channel in Microsoft Teams where you want the Catcher24 notifications to appear. Click the More options icon (three dots ...) next to the channel name and select Workflows or Connectors (depending on your specific Teams version). 2. Add an Incoming Webhook Search for and select the Send webhook alerts to channel template. 3. Provide a name for the webhook (e.g., "Catcher24 Alerts") and optionally upload a Catcher24 logo as the image. Click Create. 4. Step 3: Copy the Webhook URL Once created, Microsoft Teams will generate a unique URL. Copy this URL to your clipboard and save your changes in Teams. You will need this URL for the next part. Part 2: Add the Webhook to Catcher24 Now that you have your unique Teams URL, you can configure Catcher24 to start sending alerts. 1. Access Organization settings From your Catcher24 dashboard, navigate to the left-hand menu, click on Settings. 2. Navigate to the Microsoft Teams notification integration Within the Organization settings menu and click on Connect Teams. 3. Add the webhook link copied during the webhook creation. 4. Save and Test Click Save Changes to activate the integration. Troubleshooting & FAQs I'm getting an "Invalid URL" error in Catcher24. Make sure you copied the entire URL from Microsoft Teams without any extra spaces at the beginning or end. The URL should typically start with https://. The webhook says it's active, but messages aren't appearing in Teams. If the test fails or doesn't appear, ensure that the webhook URL is correctly copied. Can I send different alerts to different Teams channels? No, currently only one Teams channel can be added for each organization.

Slack notifications integration

Connecting Slack to your workspace is one of the best ways to stay in the loop without constantly refreshing your dashboard. Once integrated, you can receive vulnerability change notifications and certificate expiry warnings directly in your preferred Slack channel. Adding the Slack integration 1. Log in to the Catcher24 dashboard and navigate to the Organization management settings. 2. Scroll to the Slack integration section and click Connect Slack. 3. This will open a new window where you can login to your Slack workspace and select the channel where the Catcher24 should post notifications. 4. Select your channel, click allow and you're done! Managing notifications Once the Slack integration has been configured the section will show your organizations notification preferences.

How do I download a target report?

A target report provides a snapshot of your current tracking metrics, engagement stats, and overall target performance. Downloading these reports allows you to easily share data with your team or keep offline records. (Note: Currently, exporting downloads the current, up-to-date status of your Target. Date-specific reporting will be available in a future update). Download a report with the most recent findings 1. From your dashboard, click on the Targets tab in the left-hand navigation menu. 2. Locate the specific Target you want to analyze and click on its name to open the detailed view. 3. Click the Download PDF button located at the top right of the screen. 4. The report is generated in the background, stay on the page and the report will automatically be downloaded. This can take up to a minute. Troubleshooting My download is taking a long time. Large target reports can occasionally take a few moments to generate. Please keep the page open while the download processes.

How to update organization email notification Preferences

Managing your organization's email notifications helps keep your team informed without cluttering their inboxes. Important: Updating these preferences will apply the new email notification settings globally to all members within your organization. Individual users can override their individual notification preferences in their account settings. Step-by-Step Instructions 1. Access Organization Settings From your Catcher24 dashboard, navigate to the left-hand menu and click on Settings (often represented by a gear icon), then select Organization. 2. Navigate to Notification Preferences Within the Organization settings menu, scroll down to the notification preferences 3. Adjust the Notification Settings You will see a list of available email alerts (e.g., new target reports, system alerts, daily/weekly summaries). Use the toggles or checkboxes to enable or disable specific notifications for your entire team. 4. Save your changes Once you have adjusted the preferences to your liking, scroll to the bottom of the page and click the Save button. Your new notification preferences will take effect immediately for all current and future members of your organization. Troubleshooting Why can't I access the Organization Settings? If the Organization or Settings tabs are hidden or greyed out, you likely do not have the required administrative permissions. Only Organization Admins or Owners can change global notification preferences. Reach out to your team's account owner to request access or have them make the change.

How to update account email notification preferences

Managing your personal account notifications ensures you only receive the alerts that are most relevant to your workflow. These settings control the emails and in-app alerts sent directly to your individual user account. (Note: If your Organization Admin has enforced global email preferences, some of these individual settings may be locked or overridden. See [How to Update Organization Email Notification Preferences] for more info). Step-by-Step Instructions 1. Access Your Profile Settings From your Catcher24 dashboard, click on your Profile Avatar or Name located in the top-left corner of the screen, then select Account Settings from the dropdown menu. 2. Navigate to Notifications In your personal account menu, click on the Notifications tab. 3. Adjust Your Preferences You will see a list of individual alert options. Use the toggles to opt in or out of specific emails and in-app notifications. 4. Save Your Changes Once you have customized your preferences, scroll to the bottom of the page and click Save. Your updated personal notification settings will be applied immediately. Troubleshooting Why are some of my notification toggles greyed out? If you are unable to change certain email preferences, your Organization Administrator has likely set global notification rules for your entire team. You will need to contact your Admin to adjust those organization-wide settings. I enabled email notifications, but I'm still not receiving them. Please check your spam or junk folder. If Catcher24 emails are landing there, mark them as "Not Spam" or add our sender address to your email provider's safe sender list to ensure future alerts reach your inbox.

How to set the organization timezone

Setting your organization's timezone is an important step to ensure your automated tasks run exactly when you expect them to. Important Note on Time Display: The organization timezone only dictates when automated background tasks (like scheduled scanning) are executed. The times you actually see displayed inside the Catcher24 dashboard (such as report generation times or scan logs) will always be shown in your current device's local timezone. The organization timezone does not change your dashboard display. Step-by-Step Instructions 1. Access Organization Settings From your Catcher24 dashboard, navigate to the left-hand menu, click on Settings. 2. Select Your Organization Timezone Locate the Timezone dropdown menu. Select the primary timezone where your organization operates or where you want your system's "clock" to be anchored. 3. Step 4: Save Your Changes Scroll to the bottom of the page and click Save. How This Affects Scheduled Scanning When you set up a recurring scheduled scan, the scan will execute based on the Organization Timezone you just selected. Choosing a location-based timezone (like Europe/Amsterdam) instead of a fixed UTC offset is highly recommended, as it dictates how your automated tasks handle time changes throughout the year. - The DST Advantage: By selecting Europe/Amsterdam, Catcher24 automatically adjusts for Daylight Saving Time. If you schedule a daily scan for 02:00, it will consistently run at 02:00 local Amsterdam time year-round - seamlessly shifting between Central European Time (CET) in the winter and Central European Summer Time (CEST) in the spring. If you had selected a fixed offset like UTC+1 instead, your scans would run an hour late during the summer months. - The Display Difference: Remember that your dashboard converts times to your local device clock. If your Organization Timezone is Europe/Amsterdam and the scan runs at 02:00, a team member logging in from London will see the scan recorded at 01:00 on their dashboard, because their local device is one hour behind Amsterdam. Troubleshooting & FAQs I scheduled a scan for 09:00, but my dashboard says it ran at a different time. Did it fail? Most likely, no! It ran at 09:00 according to your Organization's timezone, but your dashboard is displaying the time according to your computer's current local timezone. Verify your device's clock settings if the time difference seems incorrect. What happens to scans scheduled between 02:00 and 03:00 during the spring DST clock change? When clocks spring forward and skip that hour entirely, Catcher24 will automatically execute any scans scheduled during that skipped window immediately at the 03:00 mark to ensure no tasks are missed. Can individual users set their own timezone for scheduled scans? No. To prevent conflicting schedules and ensure consistent automation, all automated scans run strictly on the single, global Organization Timezone set by the Administrator.

How to Activate and Manage Two-Factor Authentication (2FA)

Two-Factor Authentication (2FA) adds an essential layer of security to your Catcher24 account. By requiring both your password and a time-sensitive code from your mobile device, you significantly reduce the risk of unauthorized access. Catcher24 supports standard Time-based One-Time Password (TOTP) authenticator apps, such as Google Authenticator, Microsoft Authenticator, Proton Authenticator, Authy, or FreeOTP. Step-by-Step Setup Instructions 1. Access Your Account Settings From your Catcher24 dashboard, click on your Profile Avatar or Name (located in the bottom-left or top-right corner), then select Account Settings from the dropdown menu. 2. Navigate to the 'Signing in' Tab In your personal account menu, click on the Signing in tab. This section manages your password and security credentials. 3. Begin 2FA Setup Locate the Two-Factor Authentication or Authenticator Application section and click the button to Set up or Enable. 4. Step 4: Scan the QR Code A QR code will appear on your screen. Open your preferred authenticator app on your smartphone and use it to scan the QR code. (Note: If you cannot scan the code, click the option to view the manual setup key and type it directly into your authenticator app). 5. Step 5: Verify and Save Once scanned, your app will begin generating 6-digit codes. Type the current 6-digit code shown in your app into the verification field on your Catcher24 screen. You can also provide a Device Name (e.g., "My Work iPhone") to help you identify it later. Click Submit to finalize the setup. You will now be prompted to enter a 6-digit code from your app every time you log in to Catcher24. Managing or Removing 2FA If you get a new phone or wish to switch authenticator apps, you will need to remove your current 2FA device and set up a new one. 1. Navigate back to Account Settings > Signing in. 2. Locate your active authenticator device in the 2FA section. 3. Click Remove or the Trash Can icon next to the device. 4. You can now follow the setup instructions above to add your new device. Troubleshooting & FAQs My authenticator code isn't working. The 6-digit codes are heavily dependent on time. If your code is failing, open your authenticator app's settings and ensure its "Time correction for codes" is synced, or verify that your smartphone's clock is set to update automatically. What happens if I lose my phone and cannot log in? If you lose the device containing your authenticator app, you will not be able to log in to Catcher24. Please contact your the Catcher support in order to regain access to your account.

Organize your targets with labels

Labels let you group your targets in a way that fits your organization. Once targets share a label, you can find them faster, start their scans in one go, and control which users can see them. What can you use labels for? - Server locations, for example Amsterdam datacenter or Office. - The IT partner that manages a target, for example Managed by Partner A. - Environment or priority, for example Production, PCI-DSS or High Risk. - Scanning in bulk: start the scans for every target with a label at once. See Scan all targets with a label at once. - Access control: restrict users to specific targets. See Restrict user access with labels. A target can have more than one label, and a label can be linked to as many targets as you like. Find your labels 1. In the left-hand menu, under Vulnerability Management, click Targets. 2. Click the Labels tab. The number next to the tab name is the number of labels you have. For each label, the overview shows the name and the date it was created. Use Search by label name to find a label, or click the Label and Created at column headers to sort. Click the arrow at the start of a row to see the targets linked to that label. Create a label Use this method to create a label and link several targets to it right away. 1. Go to Targets and open the Labels tab. 2. Click New Label. 3. Enter a Label Name. This field is required. 4. (Optional) Click Linked Targets and tick the targets that should get this label. 5. Click Save. The new label appears in the overview. Click Cancel to close the window without creating a label. Add a label to a target You can also work with labels from the detail page of a target. 1. Go to Targets and click a target to open it. 2. Under the target name, click Add label. 3. In the Classification Labels box, open the list and tick one or more labels. The label is saved as soon as you select it. 4. Need a label that doesn't exist yet? Click Create new label in the same box. The labels now appear under the target name. To remove a label from a target, click the x next to the label under the target name. Edit or delete a label On the Labels tab, each label has these buttons in the Actions column: - Run (orange): starts scans for all targets with this label. See Scan all targets with a label at once. - Edit (pencil): change the label name or the linked targets. - Delete (red): delete the label. Tips - Agree on a naming scheme, for example Location - Amsterdam, so the list stays easy to search. - Label new targets right away, so bulk scans and access restrictions stay complete. - Use several labels per target, for example a location label and a partner label.

Scan all targets with a label at once

If you have labeled your targets, you can start the scans for every target with the same label in one step. This is handy for scanning a whole location, or all targets managed by one IT partner. Before you start - Make sure the targets you want to scan have the label. See Organize your targets with labels. - The scan starts immediately. There is no confirmation message, so check which targets carry the label first. Start the scans 1. In the left-hand menu, under Vulnerability Management, click Targets. 2. Click the Labels tab. 3. (Optional) Click the arrow at the start of the label row to check which targets are linked to it. 4. In the Actions column of the label, click the orange Run button. While the scans are running, the label shows Scanning instead of the Run button. Follow the progress Go back to the Targets tab. A Scans in Progress section appears at the top with every target that is being scanned, and the status of each scan step (for example Starting or Queued). When a scan is running, the target in the Monitored Targets list shows a square button instead of the orange run button. When the scan has finished, the target moves back to the list and the Last scan date is updated. Good to know - Scans only start for targets that have the label. - You can also start a scan for a single target with the orange button next to it in the Monitored Targets list.

Restrict user access with labels

You can use labels to decide which targets a user can see. When a user is restricted to a label, they only see the targets with that label. Everything else in your organization stays hidden from them. This is useful when, for example: - An external IT partner should only see the targets they manage. - A team should only see the targets at their own location. How access works - No label assigned: if neither the user nor any of their groups has a label, the user can access all targets. - One or more labels: the user can access all targets of all assigned labels. A user with the labels Amsterdam datacenter and Managed by Partner A sees the targets of both labels. - Admins are not exempt. Label restrictions also apply to users with the admin role. An admin can always remove their own label restrictions again. You can assign labels in two ways: directly to a user, or through a user group. Method 1: assign a label directly to a user Use this method for one-off cases or small organizations. 1. In the left-hand menu, under Organization Management, click Members. 2. Find the user in the list. 3. In the Labels column, click Select Labels and tick the labels you want to give this user. To remove the restriction, clear the labels again. Without labels, the user can see all targets. Method 2: assign a label through a group Use this method when several users need the same access. Change the group once and every member follows. 1. Create a group and give it a label. See Manage user groups. 2. In the left-hand menu, click Members. 3. In the Groups column of the user, click Select Groups and tick the group. The user now gets the labels of that group. Roles and labels Labels decide which targets a user sees. The user's role decides what they can do. You can create extra roles with exactly the permissions you need under Organization Management > Roles, and combine them with labels for precise access. Tips - Label all targets before you restrict users, so nobody is locked out of targets they need. - Prefer groups to direct labels when more than one user needs the same access. - Review access when you add a new target. A new target without a label is invisible to restricted users.

Manage user groups

A group bundles users who need the same role and the same access to targets. Instead of setting labels for each user, you set them once on the group. Open the groups In the left-hand menu, under Organization Management, click Groups. The list shows each group with its Roles and Labels. Use the search box to find a group. Create a group 1. Go to Groups and click New Group. 2. Enter a Group Name. This is the only required field. 3. Click Save. The group appears in the list. Set the role and labels of a group 1. In the group's row, click Select Roles and choose a role (for example member). 2. Click Select Labels and choose one or more labels. Users in this group only see the targets that have these labels. See Restrict user access with labels. Add users to a group 1. Go to Members. 2. In the Groups column of the user, click Select Groups and tick the group. Delete a group Click the red Delete button at the end of the group's row. Roles The admin and member roles are available by default. To create a role with specific permissions, go to Organization Management > Roles and click New Role.

Audit log: see who did what and when

The audit log keeps a record of what happens in your organization: scans that were started, labels that were created, members that were invited, new findings that were detected on a target, and more. Use it to follow up on changes, answer the question "who changed this?", and keep a history for compliance. You can open the full audit log from the menu, and you also see a short version of it on your dashboard. Open the audit log 1. In the left-hand menu, under Organization Management, click Audit log. The log shows the most recent events first. Each entry shows: - An icon for the type of event. - Who did it. Events done by a person show their name. Events that happen automatically, such as a newly detected finding, have no name. These are called system events. - What happened, and on which target or port when that applies. - When it happened, for example 25m ago. By default, the log shows the last month. You need the View Audit Logs permission to see the audit log. See User roles and permissions. Similar events are grouped When the same kind of event happens many times in a row, the log groups them to keep the page readable. For example, a scan can connect several assets to a target in one go. - Click Expand 9 similar items to see all the items in the group. - Use the page buttons at the bottom of the group to move through longer lists. - Click the minus button at the top right of the group to collapse it again. Filter the audit log Use the filters at the top of the page to find specific events. The log updates as soon as you change a filter. Event type 1. Click Event type. 2. Type in the search box to find an event type, for example scan. 3. Tick one or more event types. The selected types appear in the filter field. Click the x next to a type to remove it, or the x at the end of the field to clear them all. Target Click Target and select one or more targets to only see events for those targets. Member Click Member and select one or more members to see what they did. Switch on System events (no member) at the bottom of the list to show events that happened automatically, without a person. Date range 1. Click the date field. 2. Pick a start and end date in the calendar, or click a shortcut below the calendar: Current month, Last month, Current quarter, Last quarter or This year. 3. Click the x in the date field to clear the range. Export the audit log Click the Export CSV button to download the audit log as a CSV file. Click the arrow next to the button to choose a format: - Export as CSV - Export as JSON Activity widget on the dashboard At the bottom right of your dashboard, the Activity widget shows the latest events in a compact list. It works the same way as the audit log: similar items are grouped and can be expanded, and you can scroll through the list. Use the widget for a quick look at what has just happened. Open the Audit log from the menu when you need to filter, search a longer period or export. Event types You can filter on these event types. | Area | Event types | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Targets and findings | Asset connected to target, Asset unbound from target, Certificate connected to target, Certificate unbound from target, Detection connected to target, Detection unbound from target, Dns record connected to target | | Scans | Started scan for target, Started scan for label, Cancelled scan | | Labels | Created label, Assign label to target | | Members, groups and access | Created organization invitation, Deleted organization member, Created organization group, Assign organization group to label, Assign organization group to role, Assign target label to user, Removed target label from user | | Subscription | Prepare subscription update, Restart organization subscription | Tips - To check who started a scan, filter on the event types Started scan for target and Started scan for label. - To review access changes, filter on Assign target label to user, Removed target label from user and Assign organization group to role. - To see only automatic events, filter on Member and switch on System events (no member)

User roles and permissions

A role is a set of permissions. It decides what a user can do in your organization: for example view targets, start scans, or invite new members. You can use the two built-in roles, or create your own roles with exactly the permissions you need. Roles work together with labels. A role decides what a user can do, and a label decides which targets the user can see. See Restrict user access with labels. Open the roles In the left-hand menu, under Organization Management, click Roles. The list shows every role and whether it is All Inclusive. Use the search box to find a role, or click the Name column header to sort. Each role has buttons at the end of its row: - Clone (blue): create a copy of the role as a starting point for a new role. - Edit (orange): change the name and permissions of a role. - Delete (red): delete the role. The built-in roles Every organization has two roles: | Role | What it can do | Can you change it? | | ---------- | ------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | | admin | All possible permissions. | No. You can only clone it. | | member | All permissions, except: delete the organization, create and delete invitations, delete members, and create, update and delete roles. | Yes. You can edit and delete it. | All inclusive roles and excluded permissions When you create or edit a role, you build it in one of two ways: - Choose what the role can do. Leave All Inclusive unticked. The list is called Granted Permissions, and the role can only do what you tick. - Choose what the role can not do. Tick All Inclusive (Contains all possible permissions). The list changes to Excluded Permissions, and the role can do everything except what you tick. New permissions that are added to the product later are included automatically. Use the first method for a restricted role, such as someone who only starts scans. Use the second method for a role that is almost an admin. Always enable these two permissions Whichever way you build a role, make sure it includes these permissions. Without them, users run into an empty or unavailable environment. | Permission | Section | Why | | ---------------------- | ----------------------- | -------------------------------------------------------------------------------------------- | | View Organizations | Organization Management | Required to see the organization at all. Without it, the user can not open the organization. | | View Dashboard | Reporting > Dashboards | Required to see the default dashboard. | Add them to every role you create, also to roles that only need a small set of permissions. If you build a role with All Inclusive ticked, make sure you do not tick these two in the Excluded Permissions list. Create a role 1. Go to Organization Management > Roles and click New Role. 2. Enter a Role Name. This field is required. 3. Choose how to build the role: leave All Inclusive unticked to grant permissions, or tick it to exclude permissions. 4. Tick the permissions. Always include View Organizations and View Dashboard. Every permission has a short description underneath. Tick the box next to a section name to tick all permissions in that section, and click the minus button next to a section to collapse it. 5. Scroll down and click Save. The new role appears in the list. A role you build by granting permissions shows No in the All Inclusive column. Example: a role that can only start and cancel scans Name: Scan operator - Organization Management: View Organizations (always include this) - Reporting > Dashboards: View Dashboard (always include this) - Targets: View Targets - Vulnerability Management: View Vulnerabilities - Scans & Runners: View Scans, Start Scans, Cancel Scans A user with this role can see targets and findings, and start and cancel scans, but can not change targets, members or settings. Give a role to a user or a group You can assign roles in two places: - Directly to a member: go to Members, and in the Roles column of the user, click the role field and tick one or more roles. - Through a group: go to Groups, and in the Roles column of the group, pick a role. Members of the group get this role. See Manage user groups. Your own roles also show up in these lists as soon as you create them. Permission reference Permissions are grouped in sections. Most sections have View permissions to see things, and other permissions to change them. Organization Management | Section | Permissions | | ----------------- | ----------------------------------------------------------------------------------------------------------------- | | Organizations | View Organizations, Update Organizations, Delete Organizations | | Groups | View, Create, Update and Delete Organizations Groups | | Invitations | View, Create and Delete Organizations Invitations | | Members | View Organizations Members, Delete Organizations Members, Assign Organizations Members (assign labels to members) | | Roles | View, Create, Update, Delete and Assign Organizations Roles | | Settings | View Organizations Settings, Update Organizations Settings (for example email, Slack and Teams notifications) | Targets and scans | Section | Permissions | | ------------------- | ---------------------------------------------------------------------------------------------- | | Targets | View Targets, Create Targets, Update Targets, Delete Targets (request the deletion of targets) | | Labels | View, Create, Update, Delete and Assign Label | | Scans & Runners | View Scans, Start Scans, Cancel Scans, View Scans Runner, View Scanner | | Certificates | View Certificates | | Dns | View Dns | | Endpoints | View Endpoints | Vulnerability Management | Section | Permissions | | -------------------- | ------------------------------------------------------------------------------------------------------- | | Vulnerabilities | View Vulnerabilities, Silence Vulnerabilities, Unsilence Vulnerabilities, View Silenced Vulnerabilities | | Occurrences | View, Silence and Unsilence Vulnerability Occurrences | | Detections | View Detection, Silence Detection, Unsilence Detection | | Asset Management | View Assets Product, View Assets Vendor, View Assets Version | Reporting and audit | Section | Permissions | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | Dashboards | View, Create, Update and Delete Dashboard | | Audit-Logs | View Audit Logs. See Audit log. | Integrations | Section | Permissions | | ----------------------- | ------------------------ | | ESET Integration | View ESET Integration | | Phished Integration | View Phished Integration | | UniFi Integration | View UniFi Integration | Payment and subscription | Section | Permissions | | ------------------------------ | ------------------------------------------------------------ | | Invoices | View Organizations Invoices | | Organization Subscriptions | View, Update, Cancel and Onboard Organizations Subscriptions | Tips - Always enable View Organizations and View Dashboard in every role. - Start from a clone of member or admin when the new role is close to one of them. It saves ticking every permission. - Give people only what they need. Prefer a restricted role over admin. - Combine roles and labels: a partner can have the Scan operator role and a label that limits them to their own targets.