> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/nmap-scanner-reference.md).

# Nmap (Network Mapper) step configuration

You can scan your application instances and ingest results from [Nmap](https://nmap.org/).

### Important notes for running Nmap scans in STO <a href="#important-notes-for-running-nmap-scans-in-sto" id="important-notes-for-running-nmap-scans-in-sto"></a>

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).

### Nmap step settings for STO <a href="#nmap-step-settings-for-sto" id="nmap-step-settings-for-sto"></a>

The recommended workflow is to add an Nmap step to a Security or Build stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

Accepted values(s):

* **Default** Run a scan with [the following CLI flags](https://nmap.org/book/man-briefoptions.html) to support most common use cases:\
  `-sS -sU -T4 -A -v -PE -PP -PS80,443 -PA3389 -PU40125 -PY -g 53 –script "default"`
* **No Default CLI Flags** Run a scan with no CLI flags. This is useful when you want to set up a highly customized scan with your own flags in the [Additional CLI flags](#additional-cli-flags) field.
* [**Firewall Bypass**](https://nmap.org/nsedoc/scripts/firewall-bypass.html)
* [**Unusual Port**](https://nmap.org/nsedoc/scripts/unusual-port.html)
* [**SMB Security Mode**](https://nmap.org/nsedoc/scripts/smb-security-mode.html)
* [**Vuln**](https://nmap.org/nsedoc/categories/vuln.html)
* [**Exploit**](https://nmap.org/nsedoc/categories/exploit.html)

#### Target <a href="#target" id="target"></a>

**Type**

**Target and variant detection**

**Name**

**Variant**

#### Instance <a href="#instance" id="instance"></a>

**Domain**

**Protocol**

**Port**

**Path**

#### Ingestion <a href="#ingestion" id="ingestion"></a>

**Ingestion File**

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

Use this field to run the [Nmap scanner](https://nmap.org/book/man-briefoptions.html) with specific command-line arguments. For example, the following flag includes IPv6 tests: `-6`.

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>