Quick Links
- Self Guided Onboarding
- How onboarding works
- Task types
- Working through tasks
- Roles and permissions during onboarding
- External Network Project Tasks
- Internal Network Project Tasks
- Web Application Project Tasks
Self Guided Onboarding
Onboarding is a self-guided setup in Platform that prepares your environment for testing. You complete a short set of tasks at your own pace, and each one you finish moves you closer to your kickoff call and the start of testing.
How onboarding works
A banner at the top of your dashboard tracks your path to testing across four steps:
- Scope set. Your testing scope is set from your signed order form by Sprocket before you arrive, so this step is already done when you log in.
- Complete setup. The active step, where you work through your setup tasks. It completes when all required tasks are done.
- Kickoff call. Schedule and complete your kickoff call with Sprocket Customer Success.
- Baseline testing. Testing begins after your kickoff call.
Setup tasks are grouped into a tab for each project you have contracted for, and you can work through the tabs in any order.
Setup Tasks are required for three projects:
- External Network Testing
- Internal Network Testing
- Web Application Testing
Two progress bars, one for your overall progress [1] and one for the project [2] you are viewing, update as you complete tasks. Your progress saves automatically, so you can leave and return without losing your place.
Task types
Each task is labeled so you know what it takes to start testing:
| Type | What it means |
|---|---|
| Required | Must be completed before testing can start for that project. |
| Optional | Helpful, but not needed to begin testing. |
| Gated | A required task that stays locked until a condition is met. |
The one gated task is Schedule Kickoff Call, which unlocks only after every other required task is complete. The kickoff call is where you meet with your Customer Success Manager to discuss the success of your partnership with Sprocket.
Working through tasks
To start a task, click Start. This takes you to the place in the platform where you complete it.
If a task is better handled by someone else on your team, click Delegate and select an existing user from your organization. If your organization has no other users yet, add them and send an account invitation under Team Members.
Roles and permissions during onboarding
Everyone on your team can see all tasks, projects, and progress. What you can do to complete onboarding tasks depends on your role:
| Role | What they can do |
|---|---|
| Onboarding point of contact | Complete any task and assign tasks to other team members. |
| User with a task assigned | Complete their assigned tasks. Cannot act on tasks assigned to teammates. |
| User with no tasks assigned | Follow progress, but cannot complete tasks until one is assigned to them. |
External Network Project Tasks
There are three tasks required to complete onboarding for the External Network Project:
- Configure your company profile
- validate scope
- tag assets
Configure your company profile
Company Profile is where you set the details Sprocket keeps on file for your organization. When you start this task, you complete the following:
- Company Address. The address kept on record for your organization, used for non-billing contact.
- Team Contacts. The key people Sprocket coordinates with during your engagement, reviewed and confirmed on your kickoff call. This includes your day-to-day contact (an existing team member), your commercial or partnership contact for contract terms and renewals, and your escalation contact for urgent needs.
- Service-Level Agreements. Your SLA policy, which sets how long findings may remain open before a violation is triggered. Set a threshold for each severity level; for example 24 hours for Critical, and 30 days for High. These organization-level thresholds apply across all your projects and can be overridden per project later from a project's Engagement Details page. All users are notified when a finding violates your SLA policy.
Validate your scope
Validate Scope is where you review the assets included in testing and confirm they are correct. Starting this task takes you to your Attack Surface (ASM), filtered to the assets in scope for testing (CPT). Review the assets tab by tab to confirm they are correct.
When you have finished reviewing, return to onboarding and either approve the scope or request changes:
- Approve. [1] Confirms the scope is correct and completes the task.
-
Reject. [2] Opens the Request scope changes dialog. Select what needs to change (assets added, assets excluded, or both), then describe which assets and why. This goes to the team fixing your scope, so name the specific assets you mean. Click Submit Request to send it.
Reviewing your scope carefully at this stage means Sprocket tests the right assets and nothing in scope is missed.
Asset tagging
Asset tagging is where you set up custom tags in your Attack Surface for your organization to help you track and filter groups of assets. Additional directions can be found here.
How many tags you want to add to your assets is up to you and how your organization wants to be able to view the data in your ASM. Tags can also be applied to assist with creating tailored reports, as you can create reports by tags.
Invite team members
Invite team members is optional. Invite people from your organization and assign them to projects. Get started by clicking Start on the task, then Add User on the Team Members page.
Schedule your kickoff call
Schedule Kickoff Call is the final required task. It is gated; it stays locked until every other required task across all your projects is complete. Once it unlocks, start the task to book your kickoff call with your CSM using the scheduling calendar.
The kickoff call is where Sprocket confirms testing scope, reviews access requirements, and makes sure your team is ready for testing to begin.
Internal Network Project Tasks
There are two tasks required to to complete onboarding for the Internal Network Project:
- Validate scope
- Configure Dropboxes
Validate your scope
Validate Scope is where you review the assets in scope and confirm they are correct. Starting this task takes you to the Network Scopes page of your Internal Pentest project. Review the assets there to confirm they are correct.
When you have finished reviewing, return to onboarding and either approve the scope or request changes:
- Approve. Confirms the scope is correct and completes the task.
- Reject. Opens the Request scope changes dialog. Select what needs to change (assets added, assets excluded, or both), then describe which assets and why. This goes to the team fixing your scope, so name the specific assets you mean. Click Submit Request to send it.
Configure your dropboxes
Configure Dropboxes is where you tell Sprocket how to build each dropbox, the virtual appliance Sprocket uses to test your internal network. Starting this task takes you to the Scope tab of your Internal Pentest project. Dropboxes that need your input are marked Action Required.
To configure a dropbox:
- Click Edit on the dropbox.
- Select the VM Type: OVA, VHD, or AMI.
- Select the IP Assignment:
- DHCP: No more information needed.
- Static: Enter the IP Address, Netmask, and DNS Servers.
- Optional. Add a Nickname and Notes for your Sprocket team.
- Click Save.
Sprocket builds the dropbox and notifies you when its configuration link is ready in Platform. Links expire after 21 days.
Before deploying, confirm with your infrastructure team:
- Resources: at least 4 vCPU, 8 GB RAM, 120 GB disk
-
Outbound access: TCP 443, 80, and 53 to
pttunnel.sprocketsecurity.io. No inbound rules. - Network: bridged adapter on a segment that can reach in-scope systems
- Endpoint detection: allowlist the dropbox for the engagement
For full deployment steps, see Dropbox Deployment.
Web Application Project Tasks
There are two tasks required to to complete onboarding for the Web Application Project:
- Validate scope
- Add Web Assets & Upload Credentials
Validate your scope
Validate Scope is where you review the assets included in testing and confirm they are correct. Starting this task takes you to the Web Assets tab of your Attack Surface (ASM), filtered to the assets in scope for testing (WebApp). Review the assets there to confirm they are correct.
When you have finished reviewing, return to onboarding and either approve the scope or request changes:
- Approve. Confirms the scope is correct and completes the task.
-
Reject. Opens the Request scope changes dialog. Select what needs to change (assets added, assets excluded, or both), then describe which assets and why. This goes to the team fixing your scope, so name the specific assets you mean. Click Submit Request to send it.
Add web assets and upload credentials
Add Web Assets and Upload Credentials is where you provide the testing URLs and the credentials Sprocket needs for authenticated testing. Credentials are added on the asset itself in Attack Surface.
To add credentials to a web application asset:
- Navigate to Web Assets in the Attack Surface section.
- Click a Web Asset record that has the WebApp badge to open the slideout.
- Select the Credentials tab.
- Enter the following information [2]:
- Name of User Role: The role this credential represents, such as Admin or Read Only
- Username: The username for the test account
- Password: The password for the test account
- Notes: Any additional context for your Sprocket testing team
- Click Save.
You can add multiple credentials to a single asset to cover different user roles being tested. Credentials cannot be edited after saving, and passwords cannot be viewed after saving. If a credential needs to be corrected, delete it and add a new one.
Note: Only users with the Client Manager role can add credentials.
Additional documentation here: Attack Surface - Web Application Credentials.
After Onboarding
Once you complete your last required task and your kickoff call, your setup is finished. Sprocket then moves your account into baseline testing, and your regular dashboard tracking metrics related to Continuous Penetration Testing (CPT) replaces the onboarding view.