Smart Scan
Use passive detections and rules to decide which active checks to run.
Smart Scan uses Pro rules to select active tests from passive observations. A passive request profile might identify a debug parameter; the rule can then launch a specific active profile or tag against that request.
Manual workflow
Enable the required passive trigger profiles, active action profiles and rule.
Select requests and choose Burp Bounty Pro → Local Scanner → Smart Scan.
Review the selected requests, passive processing settings, active concurrency and RPS.
Watch Scanners → Smart for the rule match and launched profiles.
Follow the resulting active work in Scanners → Active.
Live Smart Scan
Enable Live Smart Scan in Settings → General to apply the workflow to observed traffic. Configure scope and exclusions first. Smart Scan can send active requests even though its trigger is passive.
Rules are a Pro feature
Server does not load Pro rules or accept .bbre workflows. Current rule files use .bb within the pack's rules directory. MCP agents can implement their own decision flow, but that is not execution of Pro's rule engine.
See creating rules for the actual serialized format. In particular, read the current rule limitations before relying on And or First Match as strict execution constraints.
Last updated