I'd like to ask, are there any online scan policies? It seems there are only a few policies. Can they be updated? Or can I add them myself? Or is there an online version of the latest scan policies?

[浩宇]

I'd like to ask, are there any online scan policies? It seems there are only a few policies. Can they be updated? Or can I add them myself? Or is there an online version of the latest scan policies?

[kingthorin+zap]

There's a Scan Policies add-on which packages some pre-configured Active Scan policies.

Yes you can create your own in the GUI. (Or I suppose manually editing the XML 🤮)

[Simon Bennetts]

The scan Policy add-on help is here: https://www.zaproxy.org/docs/desktop/addons/scan-policies/ - that links to all of the rules in every policy.

You can also create any scan policies you like, via the ZAP Desktop GUI, the Automation Framework, or by just creating them in the right format.

• https://www.zaproxy.org/docs/desktop/ui/dialogs/scanpolicymgr/
• https://www.zaproxy.org/docs/desktop/addons/automation-framework/job-ascanpolicy/