Getting Started
Using the Platform
FAQs & Support
<aside> 🔗
</aside>
Any questions, issues, or feature requests related to the Sprocket platform can be directed to [email protected].
First, confirm that the finding State has been updated to Retest Ready. This notifies your Sprocket tester that a retest is needed. If that has been done, check the Comments section on the finding for any follow-up from the tester. See Updating State and Commenting for more details.
Users assigned as Points of Contact on the project the finding belongs to will receive a notification. If you are not receiving notifications, confirm that you are assigned as a POC on the relevant project by navigating to the Project page, then the Engagement Details tab, and find the Points of Contact section. See **Notification Preferences** for more details.
Questions about specific findings should always be asked in the Comments section of the finding. This keeps communication tied to the finding and visible to your Sprocket testing team. See Commenting for more details.
You will receive an email notification when your testing status changes. You can also check the current status of all active testing at any time by clicking Testing Status in the top right navigation of the platform. See Testing Status for more details.
Click the Resume Testing button in the yellow banner at the top of your screen. This banner appears after testing has been stopped. See Stop Testing for more details.
Sprocket's Attack Surface Management uses automated open-source intelligence techniques to discover assets associated with your organization. This can include assets discovered through DNS lookups, certificate transparency logs, and other reconnaissance sources. Not all discovered assets will belong to your organization. If you see an asset you do not recognize or do not own, you can dispute its ownership directly from the platform. See Managing Assets for more details.
Sprocket continuously performs reconnaissance against your attack surface. You can view recent reconnaissance activity and task execution history in the **Task Execution page** under Attack Surface.
Ownership reflects Sprocket's confidence that a discovered asset belongs to your organization, based on reconnaissance data and manual inputs. CPT Scope controls whether an asset is included in penetration testing. An asset can be confirmed as owned by your organization but still excluded from testing if it is out of bounds for your engagement. See Managing Assets for more details.
It depends on the report type. Attestation Letters can be shared directly with anyone via a unique access link, recipients do not need a Sprocket account. Reports generated from the Report Center can be exported as a PDF and shared manually, but cannot be shared via platform link with users outside your organization. See Reporting for more details.
When generating a report from the Report Center, use the Security Tag filter to include findings tagged with OWASP or PCI classifications. You can also generate an Attestation Letter to provide proof of testing for audit purposes. See Reporting for more details.
Client Managers can invite new users from the Team Members page. See Inviting a User for step-by-step instructions.
A Finding is a vulnerability or exploit identified by your Sprocket testing team, tracked from discovery through remediation. An Attack Narrative documents the route a tester used to attempt or simulate a breach, including the methods, expected outcome, and detection results. Not every attack results in a finding — Attack Narratives serve as proof of testing effort even when no vulnerability is discovered. The two are linked: you can navigate between a finding and its related Attack Narrative directly from either record. See Attack Narratives for more details.