Creating efficient and targeted test suites is critical for maximizing coverage and minimizing runtime while testing your application ecosystem. This page highlights the recommended ways to structure your suites based on the following:
Attack type, plugin groupings, and execution schedules
Number of tests and assets
These recommendations are designed to help you optimize performance, focus scans on relevant assets, and ensure continuous security improvement.
Attack Types
The following breakdown groups attacks into logical suites based on common categories and test volumes. Each suite recommendation also includes approximate test counts and suggested scan frequency. You can use the below Attack Selections while creating a policy, and then utilize the policy while creating a Suite. While creating the suite, you can also use the recommended schedule. For information on how you can split suites based on the attack types and assets, see Number of Tests and Assets.
Suite Type | Attack Selections | Recommended Schedule | Approximate Tests |
|---|---|---|---|
Remote Code Execution Suite |
| Weekly | 800,000 |
DB Attacks Suite |
| Weekly | 800,000 |
XSS Attacks Suite |
| Weekly | 900,000 |
Design and Configuration Attacks Suite |
| Daily | 235,000 |
Protocol Attacks Suite |
| Daily | 200,000 |
Auth and Business Attacks Suite |
| Daily | 113,000 |
Number of Tests and Assets
Traceable recommends splitting a large suite into multiple smaller suites in scenarios where the number of attack types or assets (APIs) is significantly high. This helps:
Ensure that scans run efficiently without overutilizing resources
Prevent long-running scans that may result in a timeout or other connectivity issues
This section highlights the recommendations for splitting suites, enabling you to create suites efficiently based on the scale of your application testing.
You can break down suites in either of the following ways:
Split by Attack — Divide the attack selections into multiple sets and create a separate policy for each set. You can then use each policy in its own suite.
For example, in the above table, if the DB Attacks Suite contains ~800,000 tests across three attack selections, you can split it into three policies, each with a single attack selection. Further, you can assign them to three separate suites. This helps distribute the tests and allows for efficient testing.
Split by Assets — Divide the list of APIs across multiple suites while keeping the same attack policy.
For example, if you are testing Cross-Site Scripting on 5,000 APIs using the XSS Attacks Suite (~900,000 tests) from the above table, you can create one policy with the Reflected Cross-Site Scripting attack selection. Further, you can assign this policy to two separate suites, each covering 2,500 APIs.
For information on the steps to create a suite, see Creating a Suite.