Custom scenarios
Author your own attack templates and run them like any built-in catalogue entry. Pro plan and above.
Custom scenarios let a tenant author its own attack templates — pinned to the stack it actually ships — and run them through the same pipeline, grading, and evidence rules as any built-in catalogue entry. Available on the Pro plan and above.
The point is coverage of your threat shape, not a second engine. This page states when authoring one is worth it, and what a custom scenario deliberately does not do.
Key points
- A scenario is a RunRequest template — target_scope, scan_profile, attack_depth and a compliance_tags array.
- Authored scenarios live alongside the built-in catalogue and can be triggered from /runs/new like any other.
- Templates are stored per-tenant and versioned by the same audit chain as runs.
- Pro+ is enforced server-side: a downgraded tenant keeps read access to existing scenarios but cannot create or edit.
When to author one
- Your stack ships a recurring threat shape the built-in catalogue does not cover yet.
- You want to pin a scenario to a specific compliance frame for audit replay.
- You want to share a tenant-private playbook between teammates without forking the catalogue.
The recurring cases: a threat pattern your stack exhibits that the catalogue does not cover yet, a scenario pinned to a compliance frame for audit replay, or a tenant-private playbook shared between teammates without forking the public catalogue.
What it does not do
- It does not bypass target_scope checks — every run still requires an approved target.
- It does not replace the catalogue — built-in probes still execute on top of your scenario.
- It is not a sharing surface across tenants. Scenarios stay tenant-private.
A custom scenario never bypasses target_scope checks, never replaces the built-in probes (they still run on top), and never leaves the tenant — there is no cross-tenant sharing surface. Same pipeline, same evidence rules, your template.
Related resources