Reference

Technical reference documentation for XBOW Console.

Articles in this section

  • IP addresses and hostnames used by XBOW for penetration testing. Configure your firewall to allow XBOW access.

  • Reference for XBOW artifact uploads: supported file formats for source code, and for Attack surface, Priorities, and Attack strategy cards.

  • Web applications supported for XBOW penetration testing, including requirements and compatibility considerations.

  • Overview of the attack methods XBOW runs, how they are grouped, and how release phases determine what runs in a comprehensive assessment.

  • Reference for events recorded in the XBOW Console audit log, including user actions, configuration changes, and security-relevant activity.

  • Methods supported for XBOW to authenticate to access a target and assess it.

  • Data residency
    • Private preview

    Store data for your XBOW security assessment in your chosen region. Available regions, what is stored where, backups, and limitations.

  • How XBOW groups repeat detections into a single finding, what finding IDs mean, and why a report and the Console can show different details.

  • Impact demonstration controls how XBOW explores findings to demonstrate the impact of vulnerabilities it finds.

  • Information on protecting sensitive endpoints from attack during assessments.

  • Understand the difference between the penetration testing report, executive summary, and letter of attestation.

  • How XBOW calculates an asset's risk score: a count of its open findings, weighted by severity.

  • Configure domain scope and exclusion rules for XBOW penetration testing. Learn how Attackable, Allow Visit, and Blocked settings control what XBOW tests.

  • What each XBOW finding severity means, how severity is set, and how teams commonly prioritize findings by severity.

  • Target protection
    • Public preview

    Choose how much risk to your asset XBOW may accept during an assessment, and understand how Standard and Permissive protection differ.

  • Understand why an assessment paused and how to fix the problem before you resume, covering authentication, target health, and other pause reasons.

  • Roles available in XBOW with details of the permissions each role grants to organization members.

  • The vulnerability classes XBOW tests, grouped by CWE, with each class's release phase, and the checks run in comprehensive assessments.

  • Reference for XBOW Console webhook subscriptions, including available event types, payload formats, and configuration options for automated notifications.

Was this helpful?