Page |5

Scan Scheduling

To schedule a scan, go to the schedules

tab and click on Create New Scan
Schedule

Scheduling an External Scan

Enter the scan name, choose to run on

demand or for later date/ time.
Pick the date/ time and how often you
would like to scan.
Choose the scan type EXTERNAL

Dallas | Denver | Los Angeles | New York | San Francisco | Seattle | Washington DC

8 7 7 . 2 2 4 . 8 0 7 7

w w w . c o a l f i r e . c o m

Page |6
Scheduling an Internal Scan
Enter the scan name, choose to run on
demand or for later date/ time.
Pick the date/ time and how often you
would like to scan

Your Targets have already been

defined for you.
Firehost automatically sends Coalfire a
list of IPs used by your organization
within their hosted environment.
There is no need to add new IPs.

Choose whether you would like to run

an internal or an external scan. You
can choose the targets (IP addresses)
by clicking on Select Existing Target
If you choose to run an Internal scan
you will need to select a scan engine
located in the same regional
datacenter as your targets.

Dallas | Denver | Los Angeles | New York | San Francisco | Seattle | Washington DC

8 7 7 . 2 2 4 . 8 0 7 7

w w w . c o a l f i r e . c o m

Page |7

Scan Results View:

Once the scan is complete, the Navis
RapidScan will display the scan results:

There are a few options on how to view the scan

results. Results By IP Address, Results By
Vulnerability and Specials Hosts.

Results By IP Address will show you which IP,

what the vulerabilty is and the compliance
status of that IP (pass or fail).

Dallas | Denver | Los Angeles | New York | San Francisco | Seattle | Washington DC

8 7 7 . 2 2 4 . 8 0 7 7

w w w . c o a l f i r e . c o m

Page |8

Creating a Dispute:
Disputes can also be filed by leveraging Results by
Vulnerability. This is useful when you need to file disputes
(such as for items you believe to be false positives) for multiple
targets that have same vulnerabilities

Details will show you the

vulnerabilty, the severity
level and the specifics of
that vulerbaility (shown
on the right).

Dallas | Denver | Los Angeles | New York | San Francisco | Seattle | Washington DC

8 7 7 . 2 2 4 . 8 0 7 7

w w w . c o a l f i r e . c o m

Page |9

Submitting a Dispute:

To sumbit a dispute from the

Results By IP Address or Results by
Vulnerability tab, click on Create
Dispute.

There is section for you to add your

comments.
There is a link that will allow you to add or
modify the evidence from your evidence
library.
Lastly, there are four options for the
dispute type and click save.
Coalfire will receive a notification
regarding the dispute you created and
well review the dispute.

Dallas | Denver | Los Angeles | New York | San Francisco | Seattle | Washington DC

8 7 7 . 2 2 4 . 8 0 7 7

w w w . c o a l f i r e . c o m

P a g e | 10

Scan Reports Review:

To view the scan report, click the tab Reports.

In this section, you will see the scans that have runned. The schedule
name, compliance status (fail or pass) and the date of the reports.

You can run the reports and download with four different
views:
-Summary Report PCI Executive Summary
-Detail Report PCI Vulnerability Report
-Remediation Tracking Report PCI Vulnerbailities
-Attestation Attestion of Scan Compliance (AOSC)

Dallas | Denver | Los Angeles | New York | San Francisco | Seattle | Washington DC

8 7 7 . 2 2 4 . 8 0 7 7

w w w . c o a l f i r e . c o m

P a g e | 11

Summary Report PCI Executive Summary

The PCI Executive Summary Report is a high level scan report
that contains three sections:
Scan information (Customer name, scan completion date,
ASV company and scan expiration date).
Component Compliance Summary which lists the IP
Address(s) and if it passed or failed.

Vulnerabilities Noted for each IP Address

Detail Report PCI Vulnerability Report

The PCI Vulnerability Details Report is a detailed report that

explains each vulnerabilty in detail. The report includes the
severity level of the vulnerability, the description, which IP
address is affected, port number, compliance status, evidence
and Disputes, False Positives, or Compensating Controls Noted by
the ASV for this Vulnerability.
The report also provides the solution to the vulnerability.
Vulnerabilities Noted for each IP Address

Dallas | Denver | Los Angeles | New York | San Francisco | Seattle | Washington DC

8 7 7 . 2 2 4 . 8 0 7 7

w w w . c o a l f i r e . c o m

P a g e | 12
Remediation Tracking Report PCI Vulnerbailities

The remediation tracking report will provide

you with a Recommended Remediation plan
for all vulnerabilities.
The Remediation Tracking Report includes the
priority level, description, recommended
remediation; affected hosts and the status of
the IP (pass or fail).

Attestation Attestion of Scan Compliance (AOSC)

In this section you will also be able to

download the Attestation of Scan
Compliance (AOSC). The AOSC is what
you are required to submit to your
acquiring bank and or processor

Dallas | Denver | Los Angeles | New York | San Francisco | Seattle | Washington DC

8 7 7 . 2 2 4 . 8 0 7 7

w w w . c o a l f i r e . c o m