---
title: "Scan Criteria Evaluation Hierarchy"
canonical: "https://docs.infoblox.com/space/DeploymentGuideIPAMTDwithRapid7/1631879296/Scan%20Criteria%20Evaluation%20Hierarchy"
format: markdown
---
- For **Threat Defense logs**, the solution uses a **hierarchical approach** to apply **Rapid7 scan criteria**, ensuring that **the most specific rules** are enforced first.
- The script checks for the `Rapid7_Scan_Criteria` tag in the following **priority order**:
  - **IP Range**
  - **Subnet**
  - **IP Space** *(for DFP service)* **or** **Endpoint Group** *(for Endpoint service)*
  - **Global/Default** scan criteria from **Destination Parameters** (least specific)

> 📝 The **most specific (granular)** tag found is applied. Object-level tags (like IP range or subnet) take precedence over broader tags like IP Space or global settings.

###  Example Scenarios

- **Scenario 1: Subnet-Based Scan Criteria**  
Add a tag to the **subnet** (e.g., defining DHCP range):
  `Key: Rapid7_Scan_Criteria   Value: (Severity = high and Confidence = high) and (policy_name = Default Global Policy)   `
  Assets within this subnet will use this scan filter when flagged by Threat Defense.
- **Scenario 2: Endpoint Group-Based Scan Criteria**  
 Add the same tag to an **Endpoint Group**:
  `Key: Rapid7_Scan_Criteria   Value: (Severity = high and Confidence = high) and (policy_name = Default Global Policy)   `
  Any device in this group triggering a TD event will use this scan logic.
- **Scenario 3: Global Fallback Scan Criteria**  
 If no object-level tags are found, the `scanCriteria` parameter from the **Destination Configuration** is applied as the default.