This job allows you to manage the passive scan configuration.
It is covered in the video: ZAP Chat 08 Automation Framework Part 2 - Environment.
The passive scanner runs against all requests and responses that are generated by ZAP or are proxied through it. If you want to configure the passive scan configuration then you should typically do so before running any other jobs. However you can run this job later, or multiple times, if you want different jobs to use different passive scan configurations.
- type: passiveScan-config # Passive scan configuration
parameters:
maxAlertsPerRule: 10 # Int: Maximum number of alerts to raise per rule
scanOnlyInScope: true # Bool: Only scan URLs in scope (recommended)
maxBodySizeInBytesToScan: # Int: Maximum body size to scan, default: 0 - will scan all messages
enableTags: false # Bool: Enable passive scan tags, default: false - enabling them can impact performance
disableAllRules: false # Bool: If true then will disable all rules before applying the settings in the rules section
rules: # A list of one or more passive scan rules and associated settings which override the defaults
- id: # Int: The rule id as per https://www.zaproxy.org/docs/alerts/
name: # String: The name of the rule for documentation purposes - this is not required or actually used
threshold: # String: The Alert Threshold for this rule, one of Off, Low, Medium, High, default: Medium
The job saves the current passive scan configuration when a plan starts and resets it when the plan ends. This is primarily to ensure the scanOnlyInScope setting is not changed - the default is ’true’ for the job but ‘false’ in the GUI.
Note that if you set disableAllRules to true then they will stay disabled when the plan has finished.
Automatically re-enabling them when the plan finishes could result in the rules becoming enabled while the passive scan
queue is being processed, for example if the passiveScan-wait job is not used,
or if it is used but with the maxDuration option is set.
In versions up to and including 0.16.0 running this job with the default settings would change scanOnlyInScope to ’true’ in the GUI. This has proved confusing as many users use the GUI without setting a scope - when scanOnlyInScope is set to ’true’ and no scope is defined then no passive scan alerts are raised.