FAQ-000938 - External Service Security Testing / Scanning Tool Troubleshooting

If a web vulnerability scanner fails to run on your external site, here are some common troubleshooting steps: 1. **Permissions**: Ensure you have explicit approval from the third party owning the external endpoint to perform security testing. 2. **Firewall Restrictions**: Check if the external site has firewalls or restrictions blocking the scanner's IP addresses. Use the Salesforce IP Addresses & Domains to Allow guidelines to whitelist the scanner's IPs. 3. **Tool Compatibility**: Verify that the scanner tool is compatible with the external site's technology and configuration. If not, consider alternative DAST scanners like ZAP, Burp Suite, HCL AppScan, or WebInspect. 4. **Environment**: Make sure the external site is accessible and properly configured for testing, as some environments may have configurations that interfere with the scan. 5. **Scanner Configuration**: Review the scanner's settings to ensure they match the external site's requirements, such as authentication methods or endpoint specifications. 6. **Escalation**: If the issue persists, document the problem and raise a support case with the scanner tool's support team or the external site's technical team for further help. These steps help identify and resolve common scanner issues.

The FAQ content is accurate and helpful overall. I made one minor clarification in step 4, changing 'Make sure the external site is in a production environment' to 'Make sure the external site is accessible and properly configured for testing' because the original phrasing was slightly confusing - testing can occur on both production and staging environments, and the key point is that the environment should be properly configured for security testing. For security rules, I selected ApexInsecureEndpoint because this FAQ discusses external site scanning and endpoint security testing. The ApexInsecureEndpoint rule specifically deals with insecure endpoints in Apex code, which relates to the FAQ's focus on external endpoint vulnerability scanning. When developers are troubleshooting web vulnerability scanners on external sites, they're often dealing with endpoints that may have security issues - the same types of endpoint security concerns that the ApexInsecureEndpoint rule is designed to catch in code.