Skip to main content
Version: 2504.1

Analysis Options

This is information about analysis options by tool type that can be set when making an analysis request.

SAST

KeyDescriptionDefault ValueTypeConstraint 1Constraint 2
extensionsList of file extensions to be analyzed["*"]String list
excludedPathDirectories to exclude from analysisNoneString list
maxSourceSizeMaximum size limit for analysis target (MB)200Integer1~200

SCA

KeyDescriptionDefault ValueTypeConstraint 1Constraint 2
sbomCreatorUsernameUsername to use when creating SBOMNoneString
sbomCreatorEmailEmail to use when creating SBOMNoneString
sbomTypesList of SBOM types to generate as analysis resultsEmpty string listSbomType list
maxSourceSizeMaximum size limit for analysis target (MB)200Integer1~200

DAST

KeyDescriptionDefault ValueTypeConstraint 1Constraint 2
crawlerTargetSeedUrlsURLs to perform crawling and analysisNoneString list
commonRecordsLoginWhen attaching a login record file, during URL collection and analysis, when reaching the URL where recording started from the event clipboard, the stored user's actions are reproduced as-is. This method allows you to pass the required authentication on the login page.NoneString list
crawlerTargetContainEntireSeedWhether the URLs collected by the crawler must all include the analysis target URL. If this option value is set to true, URLs to be collected must all include the target URL.trueBoolean
crawlerDebugPerformLoggerDetailed execution log option. If this option is set to true, you can check the actions executed during collection in logs, so you can verify if URLs were collected normally.falseBoolean
crawlerLimitUrlDepthDegreeHow far from the starting URL to collect URLs.mediumStringmedium, low, high
crawlerLimitDomDepthDegreeHow far from the first DOM created when moving to each URL to collect DOMs. A distant DOM means that many minimum actions are required to reach a specific DOM where the site changes without URL changes from the first DOM.mediumStringmedium, low, high
crawlerLimitFindEventDegreePage event execution level setting option. You can set how much of the events present on each page to execute.mediumStringmedium, low, high
crawlerBrowserMobileModeMobile screen setting option. If this option is set to true, the browser used when analyzing URLs is changed to mobile screen. If this option is set to false, the browser is used in the default PC screen format.falseBoolean
crawlerBrowserPageLoadStrategyEagerPage partial loading option. If this option is set to true, collection proceeds without waiting for resources to load, making collection faster. This may result in pages that require resources not being collected normally. If this option is set to false, collection proceeds only after all page resources are loaded. This allows pages that require resources to be collected normally, but slows down on pages with resource loading issues.falseBoolean
crawlerTargetSubDomainSubdomain collection option. If this option is set to true, URLs corresponding to subdomains of the analysis target URL are also collected. If this option is set to false, URLs corresponding to subdomains of the analysis target URL are not collected.falseBoolean
crawlerBrowserExplicitTimeoutEvent wait time. The larger the value entered in this option, the more URLs of web applications that take time to reflect executed events in the DOM can be collected, but collection speed becomes slower.300Integer0~5000
crawlerRequestCountPerSecondHTTP request count limit per second. The larger the value entered in this option, the more HTTP requests can be sent per second, making URL collection faster, but traffic increases and load on the target web application server may also increase.-1Integer-1~10000
crawlerBrowserResourceLoadTimeoutMaximum resource loading wait time setting. The smaller the value entered in this option, the more resources start collection without waiting to load. Therefore, pages that require resources may not be collected normally.10000Integer1 ~ 600000
analyzerDetectStoredStored vulnerability detection setting option. If this option is set to true, additional work is performed to detect stored vulnerabilities, and checkers for detecting stored vulnerabilities are activated. This slows down analysis but allows detection of stored vulnerabilities. If this option is set to false, work to detect stored vulnerabilities is not performed, and checkers for detecting stored vulnerabilities are deactivated. This speeds up analysis but stored vulnerabilities cannot be detected.falseBoolean
crawlerClientTimeoutHTTP client timeout setting option. The larger the value entered in this option, the more analysis proceeds normally even when delays occur due to poor network connection status with the web server. However, if disconnections with the web server occur continuously, analysis time may increase.3000Integer0 ~ 30000
crawlerRequestAcceptLanguageClient languageko_KRString
crawlerSkipUrlSuffixURL suffix exclusion setting option. If any word in the list entered in this option is included at the end of a URL to be collected, that URL is not collected.[".js", ".css", ".xml", ".jpg", ".jpeg", ".gif", ".bmp", ".png", ".ico", ".wma",".wav", ".mp3", ".wmv", ".avi", ".mp4", ".mov", ".exe", ".zip", ".tar", ".tar.gz", ".7z", ".doc", ".xls", ".ppt", ".docx", ".xlsx", ".pptx", ".pdf", ".txt", ".csv", ".jar", ".eot", ".woff2", ".woff", ".ttf", ".otf", ".apk", ".hwp"]String list
crawlerRequestCustomHeadersCustom HTTP header setting option. Headers required for HTTP requests must be entered in this option. This sets a proxy in the browser, so collection speed may slow down. If multiple headers with the same name are entered except for the Cookie header, only one is applied. Therefore, if multiple values need to be entered, enter header values separated by semicolons.[]Map
crawlerTargetUpperExtensionUpper path collection setting option. If this option is set to true, upper paths of the analysis target URL are also analyzed. However, if the upper path is a site that does not need to be analyzed or automatically moves to another URL when accessing the upper path, meaningless URLs may be analyzed. If this option is set to false, only sub-paths included in the analysis target URL of the project are analyzed.falseBoolean
crawlerParseCommentHTML comment analysis option. If set to true, URLs included in HTML comments are found and those URLs are collected. This collects more URLs but slows down analysis because comments are analyzed, and meaningless URLs are likely to be collected.falseBoolean
crawlerParseTextGeneral body text analysis option. If this option is set to true, URLs are collected using URL patterns from general body text. This collects more URLs but slows down analysis because all body text is analyzed, not just HTML, and meaningless URLs are likely to be collected.trueBoolean
crawlerSkipUrlCollection URL exclusion setting option. If any word in the list entered in this option is included in a URL to be collected, that URL is not collected.[]String list
analyzerSkipUrlAnalysis URL exclusion setting option. If any word in the list entered in this option is included in a URL to be analyzed, that URL is not analyzed.[]String list
crawlerCrawlAdditionalScopesAdditional collection scope setting option. If any URL in the list entered in this option is included, that URL is collected.[]String list
crawlerExcludeCssSelectorEvent execution exclusion element (CSS selector) setting option. If any CSS selector in the list entered in this option is included on the page, events for the corresponding HTML element and all child HTML elements are not executed.[]String list
crawlerIncludeCssSelectorEvent execution additional element (CSS selector) setting option. If any CSS selector in the list entered in this option is included on the page, events for the corresponding HTML element and all child HTML elements are executed. This method allows elements such as tags not included in events on the page to be executed.[]String list
crawlerExcludeXpathEvent execution exclusion element (XPath) setting option. If any XPath in the list entered in this option is included on the page, events for the corresponding HTML element and all child HTML elements are not executed. This method allows you to set it so that logout buttons on the page are not clicked.[]String list
crawlerIncludeXpathEvent execution additional element (XPath) setting option. If any XPath in the list entered in this option is included on the page, events for the corresponding HTML element and all its child HTML elements are executed. This method allows elements such as tags not included in events on the page to be executed.[]Integer
crawlerCrawlMaxUrlIf the number of URLs collected during the collection process reaches the specified option value, collection is stopped. If the value is set to 0, URLs are collected without limit.According to user policyString list
crawlerCrawlTimeoutIf the time corresponding to the specified option value elapses after starting collection, collection is terminated. Unit is minutes. If the value is set to 0, collection is performed without limit.According to user policyInteger
analyzerAnalyzeTimeoutIf the time corresponding to the specified option value elapses after starting analysis, analysis is terminated. Unit is minutes. If the value is set to 0, analysis is performed without limit.According to user policyInteger