Skip to main content

Your First Scan

Prerequisites: you are signed in with an admin user, the Jira connection test passes, and a valid license is installed.

Start narrow

Scan one or two projects first, not everything. You learn how noisy the rules are against your own content, and how hard the scan works Jira, before committing to a run that takes hours.

1. Create a scan configuration​

Under Administration -> Scan Configuration:

  1. Name the configuration.
  2. Select all accessible projects, or enter specific project keys.
  3. Choose included and excluded fields, whether to include comments, and whether to scan rendered text, raw field values, or both (both is the default).
  4. Leave Scan attachment contents off for a first run - it is the most expensive part of a scan. Turn it on once you know the basics work; it requires the SCAN_ATTACHMENTS license feature.
  5. Optionally adjust the Scan engine settings - worker count, throughput limit, batch size, retry attempts and backoff. Conservative defaults are fine for a first run. See Scans configuration.
  6. Press Preview scope - estimated projects, issues, and runtime - then Save as new version. Scan configurations are immutable snapshots; a run always references the exact version it ran with.

2. Start the scan​

Under Scans, start a read-only full scan from your saved configuration. The scan page shows status (QUEUED, RUNNING, PAUSED, COMPLETED, FAILED, CANCELLED), scanned and skipped issue counts, finding count, elapsed and estimated remaining time, and throughput. Long scans can be paused, resumed, or cancelled at any time; a failed scan resumes from its last checkpoint instead of restarting.

3. Review the results​

Open the Risk Dashboard for the summary, then work through the Findings list: filter, read each finding's location and rule, and classify findings as false positive, accepted risk, or fixed. The list opens grouped by issue, which is the right shape for cleanup; switch to the flat list when you want to work through a single rule or severity.

Expect false positives on a first run - that is what the review workflow and suppressions are for. If one rule is producing most of the noise, disable it in the Rule Catalog rather than reviewing hundreds of rows.

See the User Guide for each page, and CSV export for getting the results out.

4. Make it routine​

A single scan is a snapshot. Two things turn it into a process:

  • Attach a schedule so the configuration scans on its own.
  • Configure Reporting so Jira project leads get their open findings by e-mail without logging in.