> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/metasploit-scanner-reference.md). # Metasploit step configuration You can scan your application instances and ingest results from [Metasploit Framework](https://docs.rapid7.com/metasploit/msf-overview/). ### Workflow descriptions

Orchestration/extraction workflows

Ingestion workflows

### Custom Scan step settings for Metasploit scans in STO #### Scanner settings These settings are required for most scanners. For more information, go to the reference for the scanner integration you're setting up. * [Product name](#product-name) * [Scan type](#scan-type) * [Policy type](#policy-type) * [Product config name](#product-config-name) **Product name** The scanner name. This is required for all Custom Scan steps. **Key** ``` product_name ``` **Value** ``` metasploit ``` **Scan type** The target type to scan. **Key** ``` scan_type ``` **Value** ``` instance ``` **Policy type** The [scan mode](/security-testing-orchestration/3.0/new-to-sto/key-concepts/sto-workflows-overview.md) to use. **Key** ``` policy_type ``` **Value** ``` orchestratedScan ``` ``` ingestionOnly ``` **Product config name** **Key** ``` product_config_name ``` **Value** Specify one of the following if you're setting up an orchestration scan. Brute-force test a host for SSH weak ssh/pass: ``` metasploit-weak-ssh ``` Check HTTPS (443) for Heartbleed vulnerability: ``` metasploit-openssl-heartbleed ``` Finds and applies Metaspoit module by CVE: ``` dynamic-by-cve ``` #### Target and variant #### Instance scan settings #### Ingestion file #### Fail on Severity