A scan profile is a named bundle of tools and intensity settings. Profiles let you say what to test without wiring up individual tools. This page maps profiles to the tools underneath and shows how to tune them.

TL;DR

Light, Standard, and Deep profiles trade speed for depth. Under the hood they orchestrate nmap (network), nuclei (templated vulns), a DAST engine (web apps), and Prowler (cloud). You can adjust scope, rate, and which tool families run.

Built-in profiles

Profile	Tools engaged	Typical duration	Use when
Light	nmap (top ports), nuclei (critical templates)	Minutes	Fast discovery, low noise
Standard	nmap (full TCP), nuclei (full set), DAST (core)	Tens of minutes	Day-to-day coverage
Deep	Standard + DAST (aggressive), auth flows, brute checks	Hours	Pre-release, thorough audits

The tools

nmap — network & service discovery

Enumerates open ports, detects service versions, and fingerprints hosts. This is the foundation the other tools build on.

nmap -sV -sC --top-ports 1000   # Light
nmap -sV -p-                     # Standard/Deep (full TCP)

nuclei — templated vulnerability checks

Runs a large library of community and RedStrike templates for known CVEs, misconfigurations, exposed panels, and default credentials. Templates are severity-tagged so profiles can include or exclude by severity.

# Illustrative template shape
id: exposed-admin-panel
info:
  name: Exposed Admin Panel
  severity: high

DAST — dynamic web app scanning

Crawls your web application and actively tests for OWASP Top 10 classes: injection, broken auth, XSS, SSRF, insecure deserialization, and misconfig. In Deep mode it also exercises authenticated flows using credentials you provide.

Prowler — cloud posture (CSPM)

For cloud targets, RedStrike runs Prowler against AWS, Azure, and GCP to check hundreds of CIS-aligned controls. See Cloud Security.

Tuning a scan

You can override profile defaults per scan:

Scope — restrict to specific hosts, ports, or URL paths.
Rate — throttle requests to protect fragile production systems.
Tool families — enable or disable network / web / cloud independently.
Authenticated testing — supply credentials so DAST can test logged-in views.

Running against production? Start with Light, set a conservative rate limit, and scan during a low-traffic window. Move to Deep in staging where aggressive testing is safe.

Custom profiles

Organizations on higher tiers can save custom profiles — for example, a "web-only, authenticated, nightly" profile — and reuse them across targets and schedules.

Scan Profiles & Tools