urlscan.io Blog

We are thrilled to announce significant updates to the Incidents feature as part of urlscan Observe, which is now generally available. Since the launch of the beta version of Incidents in mid-2023, we have received valuable feedback from our customers about how they use this functionality. Based on that input, we have implemented several new features and improvements designed to make monitoring observables more effective and tailored to your requirements.

Release Highlights

• The introduction of so-called perpetual incidents which do not expire.
• The ability to select one (or multiple) scanner countries and user-agents for scanning.
• Custom stop-conditions which will automatically close an incident after a certain condition.
• The ability to specify a custom website scan interval for the indicident.
• The ability to control the observed attributes.
• Full API support and documentation.
• A simplified way incidents are accounted for against the team quota.
• Support for pre-defined Incident Profiles which can be applied to new incidents.
• An improved Incidents UI and common quick actions.
• Private Incidents which now include own private scan results as well.

We will cover some of the changes in more detail below.

Perpetual incidents, custom incident runtimes and stop conditions

Many of our customers have expressed the desire to monitor items in perpetuity. This could include their legitimate website, or a parked domain which they fear might eventually go live.

To support that use-case we have removed the fixed expiry time for incidents and now let you pick a custom duration after which the incident should automatically expire, i.e. automatically be closed down. Alternatively you can omit the expiry time and have the incident monitor its observable in perpetuity, or until you close it down manually.

Lastly you can also set up stop-conditions after which the incident should automatically be closed. You can choose to have the incident automatically be closed after its been inactive for a while, or unresolveable or after its been detected as malicious by urlscan.

Scanning options, monitored attributes, and incident profiles

For some incidents you might have very specific requirements about what you what to monitor for and how and how often website scans for the observable should be performed. To that end, you can now specify specific country locations to use for the scanning, as well the HTTP user agents that should be used during scanning. You can choose a custom scan interval if you want to scan an observable more or less frequently.

In case you don’t want to monitor for all state-changes you can exclude certain classes of monitored attributes, for example by excluding changes for the IP address or ASN of the website.

Incident Profiles can be used to create groups of pre-defined settings that you can easily apply to new incidents. These profiles can be applied to new incidents when you create them in the UI, via the API or via one of your Subscriptions within urlscan Pro.

API support and documentation

All Incident features are now accessible via a documented API, so you can create, retrieve and close down incidents in an automated fashion.

Incidents accounting

Incidents will have their own quotas and limits according which are calculated in a simple fashion: Each plan has a different Incident Limit which is a single number that governs how you can use incidents.

An incident limit of 100 means that you can have 100 unlisted incidents active at any one time, or 25 private incidents instead. You can create 100 incidents in a given 24-hour time interval.

Website scans will now be triggered for each incident and will be attributed to the owner of the incident.

Availability

The improvements to urlscan Observe are available starting today for all customers on our Professional, Enterprise and Ultimate plans. The incident limits per subscription level are included on our pricing page.

If you want to learn about urlscan Pro platform and how it might be valuable for your organisation feel free to reach out to us! We offer free trials with no strings attached. We would be happy to give you a passionate demo of what our platform can do for you. Reach out to us at sales@urlscan.io.