Exclusion Lists

Use Global Settings

Now you can exclude sensitive resources that you don't want to scan across the entire subscription. For this web application, opt to either use global exclusions defined in global settings, or configure exclusions specific to this web application.

Select the check box to use global exclusions defined in global settings. Clear the check box to ignore global exclusions. Want to customize exclusions for this web app? Just click Add Exclusion.

Allow List

The allow list identifies the links (URLs) in the web application that you want to be scanned. For each string specified, the crawler performs a string match against each link it encounters. When a match is found, the crawler submits a request for the link. When there is an allow list only (no exclude list), no links will be crawled unless they match an allow list entry.

The allow list can consist of URLs and/or regular expressions.

URLs - Select the check box to enter the URLs for the allow list. Each URL must be a fully qualified domain name. Enter each URL on a new line. You can enter a maximum of 2048 characters for each URL.

Regular Expressions - Select the check box to enter regular expressions for the white list. Enter each regular expression on a new line. For example, specify /my/path/.* for all URLs under the /my/path/ directory. You can enter a maximum of 2048 characters for each regular expression.

Comments - You can provide comments along with allow list scanning entries. The comments visibly aid users on why specific allow list entries were created. You can enter a maximum of 1024 characters for each comment.

Exclude List

The exclude list identifies the links (URLs) in the web application that you do not want to be scanned. For each string specified, the crawler performs a string match against each link it encounters. When a match is found, the crawler does not submit a request for the link unless it also matches an allow list entry.

The exclude list can consist of URLs and/or regular expressions.

URLs - Select the check box to enter URLs for the exclude list. Each URL must be a fully qualified domain name. Enter each URL on a new line. You can enter a maximum of 2048 characters for each URL.

Regular Expressions - Select the check box to enter regular expressions for the exclude list. Enter each regular expression on a new line. For example, specify /my/path/.* for all URLs under the /my/path/ directory. You can enter a maximum of 2048 characters for each regular expression.

Comments - You can provide comments along with exclude list scanning entries. The comments visibly aid users on why specific exclude list entries were created. You can enter a maximum of 1024 characters for each comment.

POST Data Exclude List

The POST data exclude list identifies POST requests with body for which you want to block form submission, as this could have unwanted side effects like mass emailing. The entries for POST Data Exclude List should match something that appears in the body of the POST request. When specified, our service blocks form submission for any POST request with body that matches the specified entries and does not submit the blocked POST data (for example, form fields) during all scan phases.

Regular Expressions - Select to set up a list of POST request with body for the form submissions you want to block. Specify each entry on a separate line in the field provided. You can enter a maximum of 2048 characters for each entry.

Logout Regular Expression

The logout regular expression lists the logout links you want to exclude from scanning.

Regular Expressions - Select the check box for the logout regular expression. Select to set up a list of regular expressions to identify logout links you want to exclude form scanning. Enter each regular expression on a separate line in the field provided. You can enter a maximum of 2048 characters for each regular expression.

Parameters

Define the parameters you want to exclude from scanning. You could choose a type: ANY, COOKIE, POST, URL and then specify the name of the parameter.

Regular Expressions - Select the check box to enter regular expression to exclude parameter.