Automation Framework - passiveScan-config Job

This job allows you to manage the passive scan configuration.

The passive scanner runs against all requests and responses that are generated by ZAP or are proxied through it. If you want to configure the passive scan configuration then you should typically do so before running any other jobs. However you can run this job later, or multiple times, if you want different jobs to use different passive scan configurations.

YAML

  - type: passiveScan-config           # Passive scan configuration
    parameters:
      maxAlertsPerRule: 10             # Int: Maximum number of alerts to raise per rule
      scanOnlyInScope: true            # Bool: Only scan URLs in scope (recommended)
      maxBodySizeInBytesToScan:        # Int: Maximum body size to scan, default: 0 - will scan all messages
      enableTags: false                # Bool: Enable passive scan tags, default: false - enabling them can impact performance
    rules:                             # A list of one or more passive scan rules and associated settings which override the defaults
    - id:                              # Int: The rule id as per https://www.zaproxy.org/docs/alerts/
      name:                            # String: The name of the rule for documentation purposes - this is not required or actually used
      threshold:                       # String: The Alert Threshold for this rule, one of Off, Low, Medium, High, default: Medium

The job saves the current passive scan configuration when a plan starts and resets it when the plan ends. This is primarily to ensure the scanOnlyInScope setting is not changed - the default is ’true’ for the job but ‘false’ in the GUI.
In versions up to and including 0.16.0 running this job with the default settings would change scanOnlyInScope to ’true’ in the GUI. This has proved confusing as many users use the GUI without setting a scope - when scanOnlyInScope is set to ’true’ and no scope is defined then no passive scan alerts are raised.