---
title: "Run an audit"
description: "Scan assets with Auditor now, or on a schedule."
url: https://whitespots.io/docs/appsec-portal/find-vulnerabilities/audits/run-an-audit
slug: appsec-portal/find-vulnerabilities/audits/run-an-audit
publish_date: 2026-10-30T19:42:15.000Z
last_modified: 2026-10-30T19:42:15.000Z
---

# Run an audit

Before the first audit, [connect Auditor](https://whitespots.io/docs/appsec-portal/get-started/install-the-auditor) and
check its [sequences](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/audits/sequences).

## Run an audit now

1. Click **Run Audit**. It is on the **Products** list, on a product's page, above the findings
   and on the **Audits** list. Started from a product, the audit covers that product's assets.
2. Under **Select assets or products**, choose what to scan. For one product, you can leave out
   some of its assets.
3. Under **Additional Parameters**, optionally:
   - choose a **Job sequence**;
   - enter a **Branch** to scan instead of the default branch;
   - enter a **Docker image tag** to scan a specific tag of the images.
4. Click **Run Audit**. The audit appears in **Audits**, and its findings arrive as each scanner
   finishes.

Each asset is scanned with one sequence, chosen in this order:

1. the **Job sequence** chosen for this audit;
2. the sequence set on the asset;
3. the default sequence.

So leave **Job sequence** empty when you scan different asset types at once, and set a sequence
on each asset that needs a different one: a repository sequence can't scan a domain.

## Schedule audits

1. Open the settings, then **Auditor** and **Schedule**.
2. Click **Create Task**.
3. Fill in the task:
   - **Title**.
   - **Schedule**: click it to choose how often and at what time, or click **Set manually** to
     enter a crontab expression.
   - **Job sequence**.
   - **Scope type**: **Products** or **Assets**, and which ones. Choose **Global** to scan all
     current and future products or assets, and narrow it down by tags or asset types.
     Only users who manage all products can choose **Global**.
4. Click **Create**.

A task scans every asset with its **Job sequence**, even assets that have a sequence of their
own. Make one task per asset type, for example one for repositories and one for domains: scope it
by asset types, or by products that hold one type.

The scope is resolved at each run: assets added later to a product in the task are scanned too.
Turn a task off with **Active** instead of deleting it.

Mind how much the tasks start at once. Auditor runs a limited number of scans at a
time, and the rest wait in a queue: when several large tasks start at the same hour, their audits
start only as earlier ones finish, and pushes and audits started by hand wait behind them. Spread
the tasks over the night or the weekend, and leave time for one task to finish before the next one
starts.

---

## Navigation

- Location: [Docs](https://whitespots.io/docs) > [Application Security Portal](https://whitespots.io/docs/appsec-portal) > [Find vulnerabilities](https://whitespots.io/docs/appsec-portal/find-vulnerabilities) > [Audits](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/audits)
- Previous: [Audits](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/audits)
- Next: [Sequences and jobs](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/audits/sequences)