Skip to content

Testing Windows

Testing windows let you declare the client-approved times an engagement is allowed to run, and have Raven enforce them — so a scan can't accidentally fire outside your authorized window.

Why

Most SOWs constrain when you can test ("10pm–6am ET nightly", "business hours only", "Day 1 kickoff"). Testing windows turn that contractual constraint into an enforced guardrail instead of a thing you have to remember at 2am.

What enforcement does

Enforcement has two modes: Warn only (the default) and Block launches. When enabled and you're outside every configured window, both modes do this:

  • Persistent red banner across every page: "OUTSIDE TESTING WINDOW", showing the next allowed window in your local time.
  • Auto-stop running jobs — any running job is SIGTERM'd the moment a window closes; its status flips to paused with reason window.
  • Auto-resume — those paused jobs restart the moment the next window opens, along with anything you queued as scheduled.

Block launches mode adds one more:

  • Run-now is refused — manually starting a module out-of-window is blocked. In the default Warn only mode the banner warns you but the launch still goes through — the default deliberately errs toward not hard-blocking a real engagement over something like a skewed laptop clock.

Out-of-band authorization

If you have explicit client approval to run outside the window, use Warn only (or just proceed past the banner). Prefer switching the mode over untoggling the card entirely — untoggling also drops the auto-stop / auto-resume safety net.

Configure

Config → Settings → Testing Windows.

  1. Toggle the card on, and pick a mode: Warn only (banner + auto-stop/resume, but launches still go through) or Block launches (also refuses out-of-window run-now).
  2. Add one or more windows:
  3. Recurring (daily) — for "nightly 10pm–6am" style rules. Set a timezone (a named zone like America/New_York, so DST is handled correctly), a daily start/end, the days of week it applies, and an optional date range to bound the engagement.
  4. One-off — a single fixed block with an absolute start and end datetime (e.g. "Day-1 Kickoff").
  5. Save windows.

The banner and enforcement update immediately. When you're inside a window, there's no banner and jobs run normally.

Notes

  • Times you enter are stored against the window's timezone; the banner and UI render them in your local time, so a nightly ET window shows correctly wherever you're sitting.
  • Enforcement is about timing, not authorization scope — pair it with Scope for the "where" side of the rules of engagement.