Improve Findings Format

The Findings Format is used e.g. to export data to other Applications like DefectDojo, however some necessary and/or useful information is not included in the Findings.

Therefore we will collect a List of possible Improvements here. We are happy about any suggestions by the community.

Release 4.0 Scope

Add Timestamp of when a Finding was identified (called identified_at), it should be optional as we do not always have this exact information. Added optional identified at parameter to findings #1434
Add Timestamp of when a Finding was parsed (called parsed_at) as a fallback when identified_at is not present. Will be solved by Added Timestamps to Findings JSON File #492
Add additional JSON attributes, that give information about how a Finding was identified ("evidence", "steps_to_reproduce"?) or what impact it has ("impact"?), see ⚙️ Add a generic (SCB) finding importer to the DefectDojo Integration Hook #332 (comment) @secureCodeBox/contributer-team do we have any data available to do this?
Add optional JSON attribute "mitigation" for solutions how the vulnerability might be fixed, can be populated i.e. by "zap_solution" in zap Added optional mitigation attribute to findings #1639
Make severity, category and name required breaking => update findings format check
Add optional JSON attribute "cve" for CVEas present i.e. in trivy Added references attribute to findings #1676
Add optional JSON attribute "cwe" for CWE as present i.e. in ZAP Added references attribute to findings #1676
Add optional JSON attribute "notes"/"other"/"additional_info" for other important information text that clarifies the vulnerability.

Additional Ideas for further development

Add optional JSON attribute "vulnerability_id_from_tool" for ids of vulnerabilities assigned by the specific scanners

@secureCodeBox/contributer-team please share any ideas you have in the comments.

@damiencarol

@damiencarol when you were talking about the Request/Answer Part here, do those resemble the mitigation and impact fields in your Findings format or what other fields would be populated with this information?

@damiencarol

Some Scanners like nikto seem to supply vulnerability IDs like in the following examle. Could this be useful information for the "vulnerability_id_from_tool" field in DefectDojo @damiencarol? Maybe we could include the same field in the SCB Format. We could also set this value in zap scans that also provide IDs for different "Alerts"

[
  {
    "id":"999996",
    "OSVDB":"0",
    "method":"GET",
    "url":"/robots.txt",
    "msg":"\"robots.txt\" contains 1 entry which should be manually viewed."
  },
  {
    "id":"740001",
    "OSVDB":"0",
    "method":"HEAD",
    "url":"/10.96.193.17.zip",
    "msg":"Potentially interesting backup/cert file found. "
  },
  {
    "id":"740001",
    "OSVDB":"0",
    "method":"HEAD",
    "url":"/backup.tar",
    "msg":"Potentially interesting backup/cert file found. "
  }
]

Relates also to #322

"Request/Answer Part" means the HTTP requests/answer that the pen-test tools record during a scan. We have data structure to support that and a UI to show them
"vulnerability_id_from_tool" => it depends. Basically we have 2 attributes:
- vuln_id_from_tool , could be a rule, a check name, a kind a vulnerability,... by it's not unique, you can have it multiple time for one tool. For ex for Bandit: B105 hardcoded_password_string or for ZAP the id of the scan rule : 10055 (CSP)
- unique_id_from_tool is really unique. For ex it could be a GUID from an API.

feature(finding-schema): Added `identified at` parameter to amass fin…

#519: Added reference attribute in nikto findings

#519: Added reference attribute in nuclei findings

#519 Refactored parsing to improve perforamance and use of immutable…

#519 Added references attribute to cmseek findings

#519 Added references attribute to trivy findings

#519 Made CVE value attribute uppercase in cmseek for consistency

#519: Added references attribute to semgrep findings

#519 Added references attribute to wpscan findings

#519 type in references is always uppercase

#519 Added references attribute to zap findings

#519: Added reference attribute in nikto findings

#519: Added reference attribute in nuclei findings

#519 Refactored parsing to improve perforamance and use of immutable…

Navigation Menu

Repository navigation

Improve Findings Format #519

Release 4.0 Scope

Additional Ideas for further development

91 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Improve Findings Format #519

Description

Release 4.0 Scope

Additional Ideas for further development

Activity

JohannesZahn commented on Jun 24, 2021

JohannesZahn commented on Jun 24, 2021

rfelber commented on Jun 24, 2021

damiencarol commented on Jun 24, 2021

91 remaining items

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions