When testing .NET web services, AppScan targets SOAP parameters since these are the primary input mechanism for SOAP-based web services. Unlike REST services that might use GET/POST parameters, .NET SOAP services communicate through XML-formatted SOAP messages, making SOAP parameters the correct attack surface.