> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/new-to-sto/key-concepts/sto-workflows-overview.md).

# STO scan modes

STO supports three scan modes to ingest scan results into a pipeline:

* [Orchestration scans](#orchestration-workflows-in-sto)
* [Ingestion scans](#ingestion-only-workflows-in-sto)
* [Extraction scans](#extraction-workflows-in-sto)

#### Orchestration scans in STO <a href="#orchestration-scans-in-sto" id="orchestration-scans-in-sto"></a>

In an *orchestration scan*, you scan a target and ingest the results in one step. This is the easiest workflow to implement and is good for running scans with default settings.

For more information, go to [Run an Orchestration Scan in an STO Pipeline](/security-testing-orchestration/new-to-sto/key-concepts/run-an-orchestrated-scan-in-sto.md).

#### Ingestion scans in STO <a href="#ingestion-scans-in-sto" id="ingestion-scans-in-sto"></a>

In an *ingestion scan*, you configure a step to ingest scan results from a data file. You can generate your scan data in a previous step of the pipeline, or download your data from an outside source. Ingestion scans provide the most flexibility and robustness, but might require more work to set up.

An ingestion scan requires at least two steps:

1. A Run step saves the scan data to a shared folder.
2. A Security or Security Tests step ingests the data from the shared folder.

For more information, go to [Ingest Scan Results into an STO Pipeline](/security-testing-orchestration/new-to-sto/key-concepts/ingest-scan-results-into-an-sto-pipeline.md).

#### Extraction scans in STO <a href="#extraction-scans-in-sto" id="extraction-scans-in-sto"></a>

*Extraction scans* are useful when you're working with SaaS-based scanners such as [SonarQube](/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/sonarqube-sonar-scanner-reference.md) and [Burp Enterprise](/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/burp-scanner-reference.md), where you can extract scan results from an API endpoint.

For more information, go to [Extraction mode for SaaS scan tools](/security-testing-orchestration/new-to-sto/key-concepts/extraction-scans.md).