> For the complete documentation index, see [llms.txt](https://docs.burpgpt.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.burpgpt.app/analysis-and-prompts/analyse-http-traffic.md).

# Analyse HTTP traffic

Analyse HTTP traffic with targeted analysis, active scanning, or AI Chat.

Configure your model provider and confirm that `Test request` succeeds before analysing traffic. Provider requests and responses appear in Burp's `Logger`.

## Before you start

* [Activate your licence](/getting-started/activate-your-licence.md) and [test your provider](/model-setup/test-and-validate-model-provider-settings.md).
* Configure the role and prompt in `AI scanner` for both targeted analysis and active scans. Start with the `user` role; include [placeholders](/analysis-and-prompts/use-placeholder-reference.md) for the traffic you want analysed.
* For targeted analysis, capture or select the requests you want to review. For active scanning, have a Burp active scan ready to run.

## Active scanning

1. Open the `BurpGPT Pro` tab and select `AI scanner`.
2. Configure the message role and prompt template.
3. Enable scanning so the toggle displays `Scan: On`.
4. Start an active scan in Burp Suite.

{% hint style="info" %}
`Scan: On` enables AI checks for active scans; it does not start a scan or analyse every request in Proxy history. Automatic AI scanning is off by default.
{% endhint %}

The **LLM Vulnerability Analysis** check runs on a per-request basis. Burp's selected checks and scheduling determine whether and when it runs.

**Expected result:** Each completed AI analysis creates a **GPT-generated insights** issue in Burp. See [Review AI-generated insights](/analysis-and-prompts/view-gpt-generated-results.md).

Supported [placeholders](/analysis-and-prompts/use-placeholder-reference.md) are replaced with values from each HTTP exchange before the prompt is sent to the model. Turn the toggle off when you want active scans to run without AI analysis.

The scanner sends a single message. `Role` is case-insensitive: `system` sends a system message, `assistant` or `ai` sends an assistant message, and other values send a user message. Some providers reject particular roles or message arrangements; start with `user` and validate your configuration with `Test request`.

On the `AI scanner` page, `Manage global settings` → `Reset to defaults` restores the role and prompt only. It does not change `Scan: On` / `Scan: Off`; turn scanning off explicitly when needed.

## Targeted analysis

1. Select one or more requests in Burp Suite.
2. Right-click and choose `Extensions` → `BurpGPT Pro` → `Scan with AI (results in Target → Site map)`.
3. Review the generated issues in `Target` → `Site map`.

Targeted analysis uses the scanner's configured role and prompt. It is available even when the automatic scan toggle is off.

**Expected result:** A **GPT-generated insights** issue appears under each successfully analysed request in `Target` → `Site map`.

Requests in a selected batch are processed one after another. Each request and its available response get a separate model request and issue; the batch is not combined into one analysis. Results appear as each analysis completes. If one request fails, the failure is logged and the remaining selected requests are still processed.

## AI Chat

Select a request, open its `AI Chat` editor tab, and ask a question. Choose whether to include the request, response, or both with the next message. See [Use AI Chat](/analysis-and-prompts/use-ai-chat.md).

Scan results are [reported as Burp issues](/analysis-and-prompts/view-gpt-generated-results.md); chat responses appear in the chat history. Validate any suspected vulnerability before reporting it.