# Strobes Help Center > Official documentation for Strobes, a Continuous Threat Exposure Management (CTEM) platform: assets, findings and vulnerability management (RBVM), attack surface management (ASM), scanning, engagements and Pentesting as a Service (PTaaS), agentic AI pentesting, integrations, automation, dashboards and reporting. Full text of every article: https://help.strobes.co/llms-full.txt ## Get Started A step-by-step path from first login to your first AI pentest and report. ### Getting Started - [Welcome to Strobes](https://help.strobes.co/article/welcome-to-strobes): A first-day orientation to the Strobes continuous threat exposure management platform: what it does and where to start. - [Key concepts in Strobes](https://help.strobes.co/article/key-concepts-in-strobes): A glossary of the core objects in Strobes: how assets, findings, tasks, engagements, AI pentests, automations, dashboards and reports fit together. - [Alerts vs. Vulnerabilities vs. Findings](https://help.strobes.co/article/alerts-vs-vulnerabilities-vs-findings): If you've spent time in Strobes instance, you've likely noticed three terms that show up across dashboards and menus: Alerts, Vulnerabilities, and Findings. They sound similar, and ## Exposure Management Onboard assets, manage findings, prioritize risk and run scans. ### Exposure Management ### Assets - [Understanding and Managing Assets in Strobes](https://help.strobes.co/article/understanding-and-managing-assets-in-strobes): An asset is a digital inventory item in your organization — anything through which you deliver IT services to customers or internal employees. Assets in Strobes include: - [What are linked assets?](https://help.strobes.co/article/what-are-linked-assets): In Strobes, you can link multiple related assets, such as APIs, servers, and databases to treat them as part of a single application or service. This gives you a combined, or agglo - [Asset Views](https://help.strobes.co/article/asset-views): Asset Views enable you to segregate your assets at a granular level. The following are the options that are available using which you can create views. - [Asset Summary](https://help.strobes.co/article/asset-summary): The asset summary dashboard provides various metrics that provide a general synopsis of the health of your assets. - [Onboarding Assets](https://help.strobes.co/article/onboarding-assets): In order to do vulnerability management, you must onboard your organization's assets onto the Strobes platform. Now, there are 3 ways of onboarding assets: - [Adding assets manually](https://help.strobes.co/article/how-to-add-assets-manually): - Select the 'Asset type' that you need to add. - [Import assets in bulk using CSV](https://help.strobes.co/article/import-assets-in-bulk-using-csv): Strobes provides support to onboard multiple assets at once using the 'Import Assets from CSV' connector. There is a format in which Strobes expects your data to be. The following - [Import assets from AWS environment](https://help.strobes.co/article/import-assets-from-aws-environment): Strobes makes it easy for you to import your cloud assets from your AWS environment. Not just that, you have the option to fetch the assets in a timely manner. - [Merging assets](https://help.strobes.co/article/how-to-merge-assets): The Merge Assets feature allows you to combine duplicate or overlapping assets into one. This helps maintain a clean and accurate asset inventory while preserving associated vulner - [Asset bulk actions](https://help.strobes.co/article/asset-bulk-actions): There are certain actions which you can perform in bulk for assets instead of updating that data individually for all the assets. The following are the bulk actions that you can ca ### Asset custom fields & exports - [Asset Custom Fields](https://help.strobes.co/article/asset-custom-fields): While creating an asset, Strobes provides several default fields. The default fields change based on the type of asset being added. Apart from the default fields, if the user needs - [Bulk Updating Asset Custom Fields Using CSV](https://help.strobes.co/article/bulk-updating-asset-custom-fields-using-csv): This guide will walk you through the process of updating multiple asset custom fields simultaneously using a CSV file in the Strobes platform.​ - [Assets Custom CSV Export](https://help.strobes.co/article/assets-custom-csv-export): While exporting assets as CSV, there are a few fields which will be present by default in the exported file (fixed fields) and there are a few fields which you can select if they h - [Exporting asset reports](https://help.strobes.co/article/exporting-asset-reports): Strobes allows you to export assets reports in various formats. To export a report, navigate to the Asset Management page and click on the Actions button in the toolbar. Once you h ### Findings - [Understanding the Findings Toolbar](https://help.strobes.co/article/understanding-the-findings-toolbar): The Vulnerability Management page in Strobes provides a centralized interface for managing and monitoring vulnerabilities identified across your environment. It is built on a featu - [Saving views under Assets and Findings](https://help.strobes.co/article/saving-views-under-assets-and-findings): Views in Vulnerability Management allows you to view/export vulnerabilities based on the specific conditions provided by you. Conditions can be provided by using a combination of ' - [Creating folders to save vulnerability views](https://help.strobes.co/article/creating-folders-to-save-vulnerability-views): While views are very helpful to apply filters, save those applied filters and share the filters with other team members, Vulnerability View Folders helps you in organizing views in - [Bulk actions on findings](https://help.strobes.co/article/performing-bulk-actions-on-findings): There are certain actions which you can perform in bulk for vulnerabilities instead of updating that data individually for all the vulnerabilities. The following are the bulk actio - [Editing and Archiving Vulnerabilities](https://help.strobes.co/article/editing-and-archiving-vulnerabilities): You can easily modify or archive vulnerability records in Strobes based on your current assessment needs. Follow the steps below to edit details or archive unnecessary vulnerabilit - [Vulnerability State Approvals](https://help.strobes.co/article/vulnerability-state-approvals): This feature will enable you to create a global setting in your organization for approving the change in the state of a vulnerability. The owner of the organization as well as the - [Vulnerability Custom Fields](https://help.strobes.co/article/vulnerability-custom-fields): While creating a vulnerability, Strobes provides several default fields. The default fields change based on the type of vulnerability being added. Apart from the default fields, if - [Bulk Updating Vulnerability Custom Fields Using CSV](https://help.strobes.co/article/bulk-updating-vulnerability-custom-fields-using-csv): If you need to update multiple vulnerability custom fields at once, you can do so by uploading a CSV file. This is done using the Upload CSV option under Edit Fields on the Vulnera ### Import & export findings - [Import Vulnerabilities in bulk using CSV](https://help.strobes.co/article/import-vulnerabilities-in-bulk-using-csv): Strobes provides support to onboard multiple vulnerabilities at once using the 'Import Bugs from CSV' connector. There is a format in which Strobes expects your data to be. The fol - [Vulnerabilities Custom CSV Export](https://help.strobes.co/article/vulnerabilities-custom-csv-export): While exporting vulnerabilities as CSV, there are a few fields which will be present by default in the exported file (fixed fields) and there are a few fields which you can select - [Generating and exporting a vulnerability report](https://help.strobes.co/article/generating-and-exporting-a-vulnerability-report): Strobes gives you the flexibility to export vulnerability reports in multiple formats depending on your reporting needs. ### Prioritization & SLAs - [Configuring Threat Intel](https://help.strobes.co/article/configuring-threat-intel): Strobes allows you to enrich your vulnerability data using Threat Intelligence (TI), helping you associate real-world risk context to each vulnerability. This empowers better prior - [Prioritization Rules](https://help.strobes.co/article/prioritization-rules): Prioritization Rules are used by Strobes to generate a priority score for a vulnerability which can be used by the IT, Patch management and Development teams to better understand t - [Configuring SLA](https://help.strobes.co/article/configuring-sla): Organizations tend to have an accepted timeline across dev/infra teams to fix vulnerabilities after they have been identified/reported. SLA policy on Strobes allows you to define a - [Smart Close](https://help.strobes.co/article/smart-close-vulnerabilities): The Smart Close feature in Strobes helps you keep your vulnerability data clean and up to date by automatically resolving vulnerabilities that are no longer detected in the latest - [Smart Close when importing reports](https://help.strobes.co/article/smart-close-while-importing-reports): In order to utilize the Smart Close feature while importing reporting you will have to create a ‘Vulnerability View’ against which you want to auto-close vulnerabilities. More abou - [Smart Close when running scans](https://help.strobes.co/article/smart-close-while-running-scans): If you have run a scan on a target and the scan has resulted in 15 vulnerabilities. If fixes for 10 out of those 15 vulnerabilities are pushed and then a scan is run again on the t - [Recurring Vulnerability Logging Rules](https://help.strobes.co/article/recurring-vulnerability-logging-rules): Once a vulnerability is resolved, there’s still a chance it might resurface in a future release. This can happen if a fix gets undone (for example, by a code rollback) or if a new ### Attack Surface Management - [Configuring Attack Surface Management](https://help.strobes.co/article/configuring-attack-surface-management): Strobes ASM (Attack Surface Management) continuously discovers and monitors your organization's external-facing assets, then flags exposure before attackers can find it. Configurat ### Strobes scanners - [Configuring Strobes DAST](https://help.strobes.co/article/configuring-the-strobes-dast-connector): The Strobes DAST connector lets you continuously scan your web applications for vulnerabilities and prioritize the findings directly within Strobes. Scans can be run on-demand or o - [Configuring Strobes SAST](https://help.strobes.co/article/configuring-strobes-sast): Strobes SAST Connector – Static Application Security Testing Integration - [About Strobes SCA (software composition analysis)](https://help.strobes.co/article/software-composition-analysis-about-strobes-sca): What is Software Composition Analysis (SCA)? - [Configuring Strobes CSPM](https://help.strobes.co/article/configuring-strobes-cspm): Strobes CSPM (Cloud Security Posture Management) continuously scans your cloud environment against more than 240 controls covering CIS, PCI-DSS, ISO27001, GDPR, HIPAA, FFIEC, SOC2, - [Software Bill of Materials](https://help.strobes.co/article/software-bill-of-materials): What is a Software Bill of Materials (SBOM)? - [Generating an SBOM for all your GitHub repositories](https://help.strobes.co/article/how-to-generate-sbom-for-all-your-github-repositories): In order to generate an SBOM for all your Github Repositories, you will need to configure your Github credentials first. More about how to configure GitHub credentials [here](/arti - [OSS Patches](https://help.strobes.co/article/oss-patches): The OSS Patches page on Strobes provides a centralized view of all vulnerable open-source packages across your organization, along with the tools needed to take swift remediation a ### Third-party scans - [Setting up a cloud scan with Prowler](https://help.strobes.co/article/how-to-setup-a-cloud-scan-using-prowler): Prowler is a tool which carries out more than 200 checks covering security best practices according to the CIS Amazon Web Services Foundations benchmarks for several groups. Prowle - [Initiating a Burp Scan](https://help.strobes.co/article/initiating-a-burp-scan): This guide walks you through how to initiate a Burp Scan on a target using the Strobes platform. Make sure you’ve already configured your Burp Suite credentials before starting the - [Initiating an HCL AppScan DAST Scan](https://help.strobes.co/article/initiating-an-hcl-appscan-dast-scan): In order to initiate an AppScan DAST scan you will have to configure your AppScan credentials first. More about how to configure AppScan credentials [here](/article/configuring-hcl - [Initiating an HCL AppScan SAST Scan](https://help.strobes.co/article/initiating-an-hcl-appscan-sast-scan): In order to initiate an AppScan SAST scan you will have to configure your AppScan credentials first. More about how to configure AppScan credentials [here](/article/configuring-hcl - [Initiating a CloudSploit Scan](https://help.strobes.co/article/initiating-a-cloudsploit-scan): In order to initiate a CloudSploit scan you will have to configure your AZURE credentials first. More about how to configure AZURE credentials [here](/article/configuring-azure-cre ## Offensive Testing AI-driven penetration testing, the Strobes AI analyst, and pentest engagements with Strobes testers. ### Agentic Pentesting - [What is a workspace?](https://help.strobes.co/article/workspace-what-is-a-workspace): A Workspace is the container for a single AI pentest engagement on Strobes. - [Choosing a template or a blank workspace](https://help.strobes.co/article/what-to-pick-template-or-a-blank-workspace): AI Workspaces - [Creating a Blank Workspace](https://help.strobes.co/article/creating-a-blank-workspace): This article shows how to create a Blank Workspace — a free-form, chat-driven pentest engagement where you describe the task in plain English and let the AI agent plan the methodol - [Initiating an AI Pentest](https://help.strobes.co/article/initiating-an-ai-pentest): This article walks you through the high-level flow of running your first AI-driven penetration test on Strobes ### Pentest templates - [Running a pentest from a template](https://help.strobes.co/article/running-a-pentest-from-a-template): This article walks you through the four-step wizard for launching a pentest from a Strobes template. Templates come pre-configured with a defined methodology, testing areas, and co - [Web Application Pentest](https://help.strobes.co/article/web-application-pentest): This article shows how to run a Web Application Pentest on Strobes using the Web App Pentest template. The template uses a 21-phase OWASP WSTG-aligned methodology with parallel tes - [Network External Pentest](https://help.strobes.co/article/network-external-pentest): This article shows how to run an external network pentest on Strobes using the Network External Pentest template. The template covers external network penetration testing including - [Network Internal Pentest](https://help.strobes.co/article/network-internal-pentest): This article shows how to run an internal network pentest on Strobes using the Network Internal Pentest template. Because internal pentests run from inside your network, they requi - [API Security Testing](https://help.strobes.co/article/api-security-testing): This article shows how to run an API-focused security assessment on Strobes using the API Security Testing template. The template covers REST and GraphQL endpoint discovery, authen - [Code Review Assessment via Template](https://help.strobes.co/article/code-review-assessment-via-template): The Code Review template enables AI-powered security analysis of source code repositories. The assessment performs repository ingestion, SAST analysis, dependency auditing, secret - [Active Directory Pentest Template](https://help.strobes.co/article/active-directory-pentest-template): The Active Directory Pentest template helps security teams assess the security posture of their Active Directory environment by identifying misconfigurations, privilege escalation - [Threat Modeling Template](https://help.strobes.co/article/threat-modeling-template): The Threat Modeling template helps security teams systematically identify threats, analyze attack scenarios, evaluate risks, and generate mitigation recommendations for application - [Attack Surface Monitoring Template](https://help.strobes.co/article/attack-surface-monitoring-template): The Attack Surface Monitoring template helps organizations continuously discover, inventory, and monitor internet-facing assets. The assessment identifies exposed services, subdoma - [Creating a Red Team Engagement in Strobes](https://help.strobes.co/article/creating-a-red-team-engagement-in-strobes): A Red Team Engagement in Strobes is a full adversarial simulation — an AI-driven exercise that mimics the techniques, tactics, and procedures of a real attacker to test how well yo ### Running & monitoring - [What happens after launch](https://help.strobes.co/article/know-what-happens-after-launch): This article describes what Strobes does in the seconds and minutes after you click Launch Assessment — so you know what to expect and where to look while the agent is starting up. - [Using the workspace dashboard](https://help.strobes.co/article/explaining-workspace-wizard-platform): This article explains the Workspace Dashboard — the live view of an in-flight pentest. Use it to watch progress, follow the agent's reasoning, and review findings as they're confir - [Workflow controls](https://help.strobes.co/article/workflow-controls): Workflow controls — Pause, Resume, Cancel, and Restart - [Reviewing findings and generating reports](https://help.strobes.co/article/findings-and-generating-reports): This article explains how to review findings produced by an AI pentest, mark their state, generate executive and technical reports, and re-test after a remediation cycle. ### Workspace configuration - [Managing credentials for AI Workspaces](https://help.strobes.co/article/managing-credentials-for-ai-workspaces): This article explains how to add, manage, and attach credentials that the AI agent will use during pentests. Credentials are reusable across every Workspace you create — set them u - [Choosing a browser](https://help.strobes.co/article/browsers): This article explains the Browser option in the Workspace wizard — when to use the default Cloud Browser, when to switch to a Connected Browser, and how to set one up. - [Choosing an AI model](https://help.strobes.co/article/choosing-ai-model): Choosing an AI model for your Workspace - [Scheduling recurring pentests](https://help.strobes.co/article/schedule-scheduling-recurring-pentests): This article explains how to set up a recurring schedule for a Workspace, what cadences are available, and how to manage schedules later. Recurring schedules turn a Workspace into ### Shells & internal networks - [Reaching On-Prem Targets from Strobes SaaS](https://help.strobes.co/article/reaching-on-prem-targets-from-strobes-saas): Strobes is SaaS. Many of your targets aren't. - [Creating a Shell Using Shell Bridge in Strobes](https://help.strobes.co/article/creating-a-shell-using-shell-bridge-in-strobes): A Shell Bridge lets you connect a local machine or server to Strobes without opening inbound firewall ports. You download a lightweight agent binary, run a single connect command o - [Setting up a Jumphost (SSH shell)](https://help.strobes.co/article/jumphost-ssh-shell-setup-configuration): Connect Strobes to your internal network through an SSH-based jumphost, enabling vulnerability scans, penetration tests, and code execution against assets that aren't reachable fro ### Planning & best practices - [Strobes Agentic Testing: Autonomous vs. Human-in-the-Loop](https://help.strobes.co/article/strobes-agentic-testing-autonomous-vs-human-in-the-loop): Platform Benefits, Differences and Applicability - [Best Practices for AI Penetration Testing](https://help.strobes.co/article/best-practices-for-ai-penetration-testing): AI-assisted penetration testing — where language model agents autonomously discover assets, reason about vulnerabilities, chain tool calls, and generate findings — represents a sig - [Reachability and Performance Requirements for Scanning](https://help.strobes.co/article/reachability-and-performance-requirements-for-scanning): Before Strobes can begin scanning your environment, two foundational requirements must be met: reachability and performance. Reachability means our scanning infrastructure can esta - [Running Agentic Tests on Large Infrastructure and CIDRs](https://help.strobes.co/article/running-agentic-tests-on-large-infrastructure-and-cidrs): Strobes AI agents can run end-to-end security assessments autonomously — discovering assets, analyzing findings, chaining tool calls, and generating remediation guidance without ma ### Governance, compliance & FAQ - [Strobes AI Governance and Autonomy Controls](https://help.strobes.co/article/strobes-ai-governance-and-autonomy-controls): Strobes AI Penetration Testing provides configurable AI governance and autonomy controls to support different levels of engagement execution. This article explains the available ex - [Managing AI Workspace Isolation and AI Member Access](https://help.strobes.co/article/managing-ai-workspace-isolation-and-ai-member-access): Every workspace in Strobes is created as a public workspace by default — meaning every member of your organization automatically has Owner-level access to it. For most internal wor - [Evidence Capture, Export, and Reproducibility](https://help.strobes.co/article/evidence-capture-export-and-reproducibility): Every finding an agent files carries the raw material behind it — the request that triggered it, the response that proved it, a screenshot, or the command that surfaced it. - [Compliance and Framework Reporting in Strobes AI Penetration Testing](https://help.strobes.co/article/compliance-and-framework-reporting-in-strobes-ai-penetration-testing): Strobes AI Penetration Testing provides compliance and security framework reporting capabilities to help organizations analyze penetration testing findings against industry standar - [Troubleshooting and FAQ for AI Pentests](https://help.strobes.co/article/troubleshooting-and-faq-for-ai-pentests): This article answers the most common questions and issues that come up while running AI pentests on Strobes. ### Strobes AI - [AI Overview page](https://help.strobes.co/article/ai-overview-page): Entry point to Strobes AI, - [AI Inbox](https://help.strobes.co/article/ai-inbox): View and manage every AI agent conversations. - [Knowledge Base](https://help.strobes.co/article/knowledge-base): Upload your organization's documents - [Schedules](https://help.strobes.co/article/schedules): Run AI agent tasks on a recurring cadence - [Human in the Loop](https://help.strobes.co/article/human-in-the-loop): AI agents queue up the decisions and inputs they need from you (user) - [Guardrails](https://help.strobes.co/article/guardrails): Safety rails that keep AI agents from leaking secrets - [Logs](https://help.strobes.co/article/logs): The audit trail for every AI agent action across your organization ### AI Agents - [AI agents overview](https://help.strobes.co/article/agents): Create, configure, and manage the AI agents - [Custom AI Agents](https://help.strobes.co/article/custom-ai-agents): Create, configure, and manage the AI agents - [Launching an AI agent task](https://help.strobes.co/article/automations-launching-an-ai-agent-task): Launching an AI Agent Task can happen by Strobes Automation. It lets you build event-driven workflows that act on your security data automatically. Each automation watches for a sp - [Configuring Strobes AI for Automated Vulnerability Management](https://help.strobes.co/article/configuring-strobes-ai-for-automated-vulnerability-management): Strobes offers powerful automation capabilities leveraging Large Language Models (LLMs) to streamline vulnerability management. This guide will walk you through the process of sett ### AI settings - [Configuring AI Budgets](https://help.strobes.co/article/configuring-ai-budgets): Strobes AI agents consume credits every time they run a task — researching a finding, drafting a remediation, or working inside the sandbox. The Budgets tab in AI Settings lets you - [Configuring AI Alerts](https://help.strobes.co/article/configuring-ai-alerts): The Alerts tab in AI Settings controls organization-wide notifications for AI agent activity — budget breaches, approvals that are taking too long, and runs that hit technical trou - [Bringing Your Own Model to Strobes](https://help.strobes.co/article/bringing-your-own-model-to-strobes): Strobes AI is built on top of a model layer that you can customize. By default, Strobes AI uses its built-in models for tasks like agentic reasoning, knowledge base enrichment, ins ### PTaaS & Engagements - [What Is an Engagement in Strobes?](https://help.strobes.co/article/what-is-an-engagement-in-strobes): An engagement in Strobes is a structured security assessment — a defined scope of work where vulnerabilities are discovered, tracked, and managed from start to finish. - [Creating an Engagement](https://help.strobes.co/article/creating-an-engagement): Engagements in Strobes represent a scoped security testing exercise — whether it's a web application pentest, a network security assessment, or a cloud security review. Each engage - [Defining Engagement Scope](https://help.strobes.co/article/defining-engagement-scope): The Engagement Scope defines the exact set of assets and services you wish to include in a security assessment when initiating a new engagement through the Strobes PTaaS (Pentestin - [Managing Engagement Prerequisites](https://help.strobes.co/article/managing-engagement-prerequisites): Prerequisites allow you to define checklist items that need to be satisfied before an assessment can begin — for example, providing VPN access, sharing test credentials, or confirm - [Engagement Summary Report Download](https://help.strobes.co/article/engagement-summary-report-download): The Engagement Summary gives you a complete snapshot of an engagement — covering scope, vulnerabilities, team efforts, and more. Use it to track assessment progress at a glance and ### Running engagements - [Life Cycle of an Assessment in an Engagement](https://help.strobes.co/article/life-cycle-of-an-assessment-in-an-engagement): Each asset added to an engagement is treated as an individual assessment that needs to be executed. For example, if you scope five assets for an engagement, five separate assessmen - [Editing Timelines for Individual Assessments](https://help.strobes.co/article/editing-timelines-for-individual-assessments): When an engagement is created, all assessments under it inherit the same default timeline. However, if different assessments need different start or end dates, you can edit them in - [Logging Hours for Assessments](https://help.strobes.co/article/logging-hours-for-assessments): In order to keep a track of the amount of time spent on each assessment within engagements, a user can log the hours. The following are the instructions to log the hours. - [Archiving and Unarchiving Engagements](https://help.strobes.co/article/archiving-and-unarchiving-engagements): In Strobes, engagements represent your ongoing or completed pentesting and security assessment projects. As your list of engagements grows, it’s important to keep things organized. - [Document Vault](https://help.strobes.co/article/document-vault): Document vault is a functionality which you can use to upload any specific documents that are required to carry out engagements because they contain specific information about the ### Pentesting as a Service (PTaaS) - [Services Available on PTaaS](https://help.strobes.co/article/services-available-on-ptaas): The Strobes PTaaS (Penetration Testing as a Service) platform offers a diverse range of security assessment services to help you strengthen your application, network, cloud, and ov - [Submitting a web-level vulnerability](https://help.strobes.co/article/ptaas-submitting-a-web-level-vulnerability): If the 'Vulnerability Type' is chosen as 'Web Level', you will be provided with the following fields: - [Submitting a vulnerability for a web or mobile asset](https://help.strobes.co/article/ptaas-submitting-a-vulnerability-for-a-web-mobile-asset): Strobes allows you to manually submit vulnerabilities for your Web and Mobile assets. When selecting one of these asset types, you’ll need to specify the vulnerability subtype, whi - [Submitting a vulnerability for a network asset](https://help.strobes.co/article/ptaas-submitting-a-vulnerability-for-a-network-asset): When a Network asset has been selected to submit a vulnerability, you will be provided with the following fields: - [Submitting a code-level vulnerability](https://help.strobes.co/article/ptaas-submitting-a-code-level-vulnerability): If the 'Vulnerability Type' is chosen as 'Code Level', you will be provided with the following fields: ## Reporting & Automation Dashboards, reports, workbooks and event-driven automation. ### Dashboards & Reports ### Dashboards - [Introduction to Dashboards](https://help.strobes.co/article/introduction-to-dashboards): A dashboard in Strobes is a visual workspace that brings your security data together in one place. - [Creating and Managing Dashboards](https://help.strobes.co/article/creating-and-managing-dashboards): Create custom Strobes dashboards: build widgets from scratch, choose the data they pull, and arrange them with the drag-and-drop dashboard builder. - [Creating a Widget](https://help.strobes.co/article/creating-a-widget): Widgets are the individual charts and metrics that make up a dashboard. You can create a widget either from the Widgets tab or directly from inside the dashboard builder by clickin - [Creating a Dashboard with AI](https://help.strobes.co/article/creating-a-dashboard-with-ai): The AI Custom Dashboard feature lets you describe the dashboard you want in plain English and have Strobes AI build it for you. Instead of manually configuring each widget, you tel - [Deleting a Dashboard](https://help.strobes.co/article/deleting-a-dashboard): This Action cannot be Undone ### Default dashboards - [Customizing Default Dashboards](https://help.strobes.co/article/customizing-default-dashboards): Use the seven default dashboard templates in Strobes: open a template, filter it to specific assets or findings, and export it. No configuration required. - [Risk Summary](https://help.strobes.co/article/risk-summary): Risk Summary dashboard provides the leadership team with all the required metrics for them to understand the current risk and security posture of the organization. - [Patch & SLA Summary](https://help.strobes.co/article/patch-sla-summary): Patch & SLA summary dashboard makes you deep-dive into the overall patch status and workload of your teams. - [Threat Intel Summary](https://help.strobes.co/article/threat-intel-summary): Threat Intel summary dashboard expands your understanding of the threat surface area and the potential attackers who could be compromising your organization. ### Reports - [What's in the Reports Page?](https://help.strobes.co/article/whats-in-the-reports-page): The Reports page is the central location for every report generated across your Strobes instance. Whether a report was produced from a pentest engagement, a SAST scan, a DAST conne - [Generating PDF Reports](https://help.strobes.co/article/generating-pdf-reports): Strobes allows you to export vulnerability reports in the PDF format. You can export all the vulnerabilities at once, apply filters and export only the resulting vulnerabilities of - [Using the Template Library](https://help.strobes.co/article/using-the-template-library): The Template Library is where all report templates in your Strobes workspace live. It gives you a single place to browse, search, create, edit, and manage every template used to ge - [Creating a Report Template](https://help.strobes.co/article/report-templates): Ready-to-use default report templates or creating a template. - [Report Template Access and Permissions](https://help.strobes.co/article/locking-a-template): The Template Library in Strobes is where your organization's report templates live. To prevent unintended changes to a finalized template — especially ones tied to compliance repor - [Report Audit Logs](https://help.strobes.co/article/report-audit-logs): The Audit Logs tab in the Reports module gives you a complete, timestamped record of every action taken on your report templates and generated reports. Use it to track who made cha - [Workbooks](https://help.strobes.co/article/workbooks-help-desk-guide-strobes-ctem): Workbooks is a spreadsheet-like feature in Strobes that helps security teams: ### Automation & Workflows - [Creating a New Automation](https://help.strobes.co/article/creating-a-new-automation): Building an automation from scratch - [Using Automation Templates](https://help.strobes.co/article/using-automation-templates): A library of ready to use automation templates - [Configuring Actions in Strobes Automation](https://help.strobes.co/article/configuring-actions-in-strobes-automation): Learn the essentials of task management on Strobes. From creating and assigning tasks to understanding task statuses and priorities, this section covers the fundamental workflows y ### Scan workflows - [Cloud security (CSPM) workflow](https://help.strobes.co/article/cloud-security-workflow-configuration-guide-cspm): This guide will walk you through how to setup a continuous scan on your cloud account. It involves four steps which are as follows: - [DAST workflow](https://help.strobes.co/article/dast-workflow-configuration-guide): This guide will walk you through how to setup a continuous DAST scan. In involves two steps which are as follows: - [Secret scanning workflow](https://help.strobes.co/article/secret-scanning-workflow-configuration-guide): This guide will walk you through the process of setting up workflows for your Secret scans for your code repositories. It involves four steps which are as follows: - [SCA and SBOM workflow](https://help.strobes.co/article/sca-sbom-workflow-configuration-guide): This guide will walk you through the process of setting up workflows for your SCA scans and SBOM generation for your code repositories. It involves four steps which are as follows: - [Container scanning workflow](https://help.strobes.co/article/container-scanning-workflow-configuration-guide): This guide will walk you through how to setup continuous scanning on your Container images. It involves four steps which are as follows. ## Platform & Integrations Connect scanners, cloud accounts, code repositories and ticketing tools, and manage your organization. ### Integrations ### Connector basics - [Everything about connectors](https://help.strobes.co/article/everything-about-connectors): Connectors extend the functionality of 3rd party security and IT tools to the Strobes platform. The connectors can also be considered as integrations with 3rd party tools. - [Using the credential manager](https://help.strobes.co/article/how-to-use-credential-manager): The Credential Manager in Strobes allows you to securely store and manage credentials for third-party security and IT tools. This ensures safe reuse of credentials across different - [About Asset Inventory connectors](https://help.strobes.co/article/about-asset-inventory-connectors): Asset Inventory connectors in Strobes allow you to seamlessly import assets from third-party tools and cloud environments into your Strobes workspace. These connectors help ensure - [Transfer Connector Configurations](https://help.strobes.co/article/transfer-connector-configurations): In Strobes, some connectors like scan tools require a Credential Manager configuration to perform scans or syncs. If you have multiple credential manager configurations set up for - [What is a task?](https://help.strobes.co/article/what-is-a-task): A task is an action that Strobes is performing either on-demand or on schedule. Tasks are generated by several connectors. These are connectors which perform scans, import inventor - [Managing tasks](https://help.strobes.co/article/how-to-manage-tasks): You can manage all the completed, failed, and in-progress tasks from the All Tasks page. ### Vulnerability scanners - [Configuring Nessus by Tenable in Strobes](https://help.strobes.co/article/configuring-nessus-by-tenable-in-strobes): The Nessus by Tenable connector lets you pull your Tenable scan results directly into Strobes. Once connected, synced findings are deduplicated against results from your other scan - [Configuring Nessus credentials](https://help.strobes.co/article/configure-nessus-credential-manager): Integrating Nessus with Strobes via the Credential Manager allows you to securely store authentication details and streamline automated vulnerability scanning. Follow this step-by- - [Syncing assets from Nessus](https://help.strobes.co/article/sync-assets-from-nessus-to-strobes): In order to sync assets from Nessus, a nessus credential manager configuration is required. More about how to create a nessus credential manager configuration here. - [Configuring Qualys VMDR with Strobes](https://help.strobes.co/article/configuring-qualys-vmdr-with-strobes): The Qualys VMDR connector syncs assets and vulnerability findings from your Qualys environment into Strobes, where you can invoke scans, prioritize findings, and track remediation - [Configuring Qualys credentials](https://help.strobes.co/article/configuring-qualys-credential-manager): Integrating Qualys with Strobes is a key step for automating vulnerability ingestion and management. This guide will walk you through how to securely configure your Qualys credenti - [Connecting Tenable IO to Strobes](https://help.strobes.co/article/connecting-tenable-io-to-strobes): The Tenable Vulnerability Management connector (commonly referred to as Tenable.io) enables you to bring host-level vulnerability findings from your Tenable environment directly in ### Application security tools - [Configuring Burp Suite credentials](https://help.strobes.co/article/configuring-burp-credentials-using-credential-manager): This article explains how to configure your Burp Suite Enterprise credentials within the Strobes platform using the Credential Manager. This setup is essential to enable Burp-based - [Configuring Burp Suite Enterprise credentials](https://help.strobes.co/article/configuring-burp-suite-enterprise-credentials-using-credential-manager): To integrate Burp Suite Enterprise with Strobes, you'll first need to add your Burp credentials to the Credential Manager. Follow the steps below to get started. - [Syncing assets and vulnerabilities from Burp Suite Enterprise](https://help.strobes.co/article/sync-assets-vulnerabilities-from-burp-suite-enterprise-to-strobes): This article explains how you can sync assets and vulnerabilities from your Burp Suite Enterprise dashboard to Strobes. In order to sync assets and vulnerabilities, you will have t - [Configuring HCL AppScan credentials](https://help.strobes.co/article/configuring-hcl-appscan-credentials-using-credential-manager): This article explains how to configure AppScan credentials within the Strobes platform. By adding your AppScan credentials via Credential Manager, you can integrate and sync data l - [Configuring Veracode credentials](https://help.strobes.co/article/configure-veracode-credential-manager): - Generate Veracode API client ID & secret [https://docs.veracode.com/r/t_create_api_creds](https://docs.veracode.com/r/t_create_api_creds) - [Syncing assets and vulnerabilities from Veracode DAST](https://help.strobes.co/article/sync-assets-vulnerabilities-from-veracode-dast-to-strobes): This article explains how you can sync assets and vulnerabilities from your Veracode dashboard to Strobes. In order to sync assets and vulnerabilities, you will have to configure V - [Syncing assets and vulnerabilities from Veracode SAST](https://help.strobes.co/article/sync-assets-vulnerabilities-from-veracode-sast-to-strobes): This guide will walk you through how to sync your assets and vulnerabilities from Veracode SAST into the Strobes platform. Before you begin, ensure your Veracode credentials are al - [Configuring Snyk credentials](https://help.strobes.co/article/configuring-snyk-credentials-using-credential-manager): This article explains how to configure Snyk credentials within the Strobes platform. Setting up your Snyk integration allows you to sync vulnerabilities and assets directly from yo - [Syncing assets and vulnerabilities from Snyk](https://help.strobes.co/article/sync-assets-vulnerabilities-from-snyk-dashboard-to-strobes): This article explains how you can sync assets and vulnerabilities from your Snyk dashboard to Strobes. In order to sync assets and vulnerabilities, you will have to configure snyk - [Connecting JFrog Xray (violations)](https://help.strobes.co/article/jfrog-xray-connector-violations-integration): The JFrog connector enables you to synchronize violation data from JFrog with Strobes. Resources affected by violations are imported into Strobes as Assets, and the corresponding v ### Cloud, endpoint & inventory - [Connecting AWS Asset Inventory to Strobes](https://help.strobes.co/article/connecting-aws-asset-inventory-to-strobes): The AWS Asset Inventory connector pulls your AWS infrastructure into Strobes as assets. Once configured, Strobes discovers the AWS services running in your account and adds them to - [Configuring AWS credentials](https://help.strobes.co/article/configuring-aws-credentials-using-credential-manager): This article explains how to configure AWS credentials within the Strobes Platform using the Credential Manager. Once set up, these credentials allow Strobes to integrate with your - [Configuring Azure credentials](https://help.strobes.co/article/configuring-azure-credentials-using-credential-manager): This article explains how to configure your Microsoft Azure credentials within the Strobes platform using Credential Manager. This integration enables secure access to Azure cloud - [Connecting UpGuard to Strobes](https://help.strobes.co/article/UpGuard): The UpGuard connector pulls your organization's internet-facing domains and the CVE-based vulnerabilities UpGuard has found on them directly into Strobes as assets and findings. On - [Connecting Tenable Cloud Security to Strobes](https://help.strobes.co/article/connecting-tenable-cloud-security-to-strobes): The Tenable Cloud Security connector enables you to bring cloud security findings from Tenable CS directly into Strobes. Once configured, the connector helps centralize cloud secur - [Connecting CrowdStrike Falcon Surface to Strobes](https://help.strobes.co/article/connecting-crowdstrike-falcon-surface-to-strobes): The CrowdStrike Falcon Surface connector lets you pull attack surface data from CrowdStrike's Attack Surface Analyzer directly into Strobes. Once configured, Strobes imports assets - [Connecting Microsoft Defender for Endpoints to Strobes](https://help.strobes.co/article/connecting-microsoft-defender-for-endpoints-to-strobes): The Microsoft Defender for Endpoint connector enables you to sync endpoint assets and associated security findings into Strobes, providing centralized visibility into endpoint risk - [Configuring Tanium credentials](https://help.strobes.co/article/configuring-tanium-credentials-using-credential-manager): Integrating Tanium with the Strobes platform allows for seamless vulnerability and asset data ingestion. To begin, you’ll first need to configure your Tanium credentials using the - [Syncing assets and vulnerabilities from Tanium](https://help.strobes.co/article/sync-assets-vulnerabilities-from-tanium-to-strobes): This article explains how you can sync assets and vulnerabilities from your Tanium instance to Strobes. In order to sync assets and vulnerabilities, you will have to configure Tani ### Code repositories - [Configuring Your Git Repo with Strobes](https://help.strobes.co/article/configuring-your-git-repo-with-strobes): This article explains how to configure your Git repository within the Strobes platform. By integrating your Git repository, Strobes can automate workflows such as issue creation, t - [Configuring Git credentials](https://help.strobes.co/article/configuring-git-credentials-using-credential-manager): This article provides step-by-step instructions to configure Git credentials within the Strobes platform using Credential Manager. Setting up Git credentials is a prerequisite for - [Configuring GitHub credentials](https://help.strobes.co/article/configuring-github-credentials-using-credential-manager): This article explains how to configure Github Credentials within the Strobes platform. - [Configuring Bitbucket credentials](https://help.strobes.co/article/configuring-bitbucket-credentials-using-credential-manager): This guide walks you through how to connect your Bitbucket workspace to Strobes using the Credential Manager. By setting this up, you’ll enable secure access and syncing between Bi ### Ticketing & ITSM - [Configuring the Jira integration (OAuth 1.0)](https://help.strobes.co/article/configuring-the-jira-integration-in-strobes): This article walks through connecting Strobes to your Jira instance using OAuth. The integration lets Strobes create and update Jira tickets directly from findings and engagements - [Configuring Azure Boards Integration with Strobes](https://help.strobes.co/article/configuring-azure-boards-integration-with-strobes): The Azure Boards connector establishes a 2-way sync between Azure Boards and Strobes. You can push findings from Strobes directly onto Azure Boards as work items, and when the stat - [Configuring Azure Boards credentials](https://help.strobes.co/article/configuring-azure-boards-credential-manager): - Access to your Azure DevOps account with permission to create Personal Access Tokens (PATs) - [Configuring ServiceNow Credentials and Connector in Strobes](https://help.strobes.co/article/configuring-servicenow-credentials-and-connector-in-strobes): Before you can configure the ServiceNow connector in Strobes, you must first add a ServiceNow OAuth credential through the Credential Manager. This is the required first step for t ### Administration - [Editing organization details](https://help.strobes.co/article/how-to-edit-organization-details): The Organization Details section lets you view and manage essential information about your organization, such as its name, industry, and billing information. - [Managing Your Plan & Subscription](https://help.strobes.co/article/managing-your-plan-subscription): The Manage Plan page gives you a single place to monitor everything tied to your Strobes subscription — credit balances, resource usage across assets, findings, tasks, and users, y - [Invite Members and Manage Roles in Strobes](https://help.strobes.co/article/invite-members-and-manage-roles-in-strobes): Strobes solves the silos among the stakeholders by allowing you to bring everyone under one roof. You can on invite your: - [Configuring Okta SSO (SAML)](https://help.strobes.co/article/saml-configuring-okta-sso-in-strobes): This article walks through setting up SAML 2.0 Single Sign-On (SSO) between Okta and Strobes. By the end of the setup, users in your Okta organization can log in to Strobes with th - [Configuring Google Workspace SSO (SAML)](https://help.strobes.co/article/saml-configuring-google-workspace-sso-in-strobes): Only the Owner of an organization has permission to enable SAML authentication. Follow the steps below to complete the setup using Google Workspace: - [Enabling Two-Factor Authentication](https://help.strobes.co/article/enabling-two-factor-authentication): Two-Factor Authentication (2FA) adds an extra layer of security to your Strobes account. Only the Owner of an organization can enable this feature. - [Setting up email alerts](https://help.strobes.co/article/setting-up-email-alerts): Email alerts are a handy way to receive alerts for various events that take place within the Strobes platform. The alert type can be configured from Email Alerts under the 'Setting - [Data Retention](https://help.strobes.co/article/data-retention): There are five options available for which you can apply a data retention policy. The following are the options: