diff options
Diffstat (limited to 'doc/user/application_security/vulnerability_report/index.md')
| -rw-r--r-- | doc/user/application_security/vulnerability_report/index.md | 168 |
1 files changed, 112 insertions, 56 deletions
diff --git a/doc/user/application_security/vulnerability_report/index.md b/doc/user/application_security/vulnerability_report/index.md index 28083e09f1c..583859e2541 100644 --- a/doc/user/application_security/vulnerability_report/index.md +++ b/doc/user/application_security/vulnerability_report/index.md @@ -5,91 +5,147 @@ group: Threat Insights info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments --- -# GitLab Vulnerability Reports **(ULTIMATE)** +# Vulnerability Report **(ULTIMATE)** -Each vulnerability report contains vulnerabilities from the scans of the most recent branch merged into the default branch. +The Vulnerability Report provides information about vulnerabilities from scans of the branch most +recently merged into the default branch. It is available at the instance, group, and project level. -The vulnerability reports display the total number of vulnerabilities by severity (for example, -Critical, High, Medium, Low, Info, Unknown). Below this, a table shows each vulnerability's detected date, status, severity, description, identifier, the scanner where it was detected, and activity (including related issues or available solutions). By default, the vulnerability report is filtered to display all detected and confirmed vulnerabilities. +At all levels, the Vulnerability Report contains: + +- Totals of vulnerabilities per severity level. +- Filters for common vulnerability attributes. +- Details of each vulnerability, presented in tabular layout.  -You can filter which vulnerabilities display by: +## Project-level Vulnerability Report -| Filter | Available Options | -| --- | --- | -| Status | Detected, Confirmed, Dismissed, Resolved | -| Severity | Critical, High, Medium, Low, Info, Unknown | -| Scanner | [Available Scanners](../index.md#security-scanning-tools) | -| Project | Projects configured in the Security Center settings, or all projects in the group for the group level report. This filter is not displayed on the project level vulnerability report | -| Activity | Vulnerabilities with issues and vulnerabilities that are no longer detected in the default branch | +> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/6165) in GitLab 11.1. -The Activity filter behaves differently from the other Vulnerability Report filters. The other filter options all OR together to show results from any vulnerability matching one of the filter criteria. With the Activity filter, the selected values form mutually exclusive sets to allow for precisely locating the desired vulnerability records. Additionally, not all options can be selected in combination. Selection behavior when using the Activity filter: +The project-level Vulnerability Report also contains: -| Activity Selection | Results Displayed | -| --- | --- | -| All | Vulnerabilities with any Activity status (same as ignoring this filter). Selecting this will deselect any other Activity filter options. | -| No activity | Only vulnerabilities without either an associated Issue or that are no longer detected. Selecting this will deselect any other Activity filter options. | -| With issues | Only vulnerabilities with one or more associated issues. Does not include vulnerabilities that also are no longer detected. | -| No longer detected | Only vulnerabilities that are no longer detected in the latest pipeline scan of the `default` branch. Does not include vulnerabilities with one or more associated issues. | -| With issues and No longer detected | Only vulnerabilities that have one or more associated issues and also are no longer detected in the latest pipeline scan of the `default` branch. | +- A time stamp showing when it was updated, including a link to the latest pipeline. +- The number of failures that occurred in the most recent pipeline. Select the failure + notification to view the **Failed jobs** tab of the pipeline's page. -Clicking any vulnerability in the table takes you to its -[vulnerability details](../vulnerabilities) page to see more information on that vulnerability. +To access the report, navigate to **Security & Compliance > Vulnerability Report**. -The **Activity** column indicates the number of issues that have been created for the vulnerability. -Hover over an **Activity** entry and select a link go to that issue. +## Vulnerability Report actions - +From the Vulnerability Report you can: -Contents of the unfiltered vulnerability report can be exported using our [export feature](#export-vulnerabilities). +- [Filter the list of vulnerabilities](#filter-the-list-of-vulnerabilities). +- [View more details about a vulnerability](#view-details-of-a-vulnerability). +- [View an issue raised for a vulnerability](#view-issues-raised-for-a-vulnerability). +- [Change the status of vulnerabilities](#change-status-of-vulnerabilities). +- [Export details of vulnerabilities](#export-vulnerability-details). -You can also dismiss vulnerabilities in the table: +## Vulnerability Report filters -1. Select the checkbox for each vulnerability you want to dismiss. -1. In the menu that appears, select the reason for dismissal and click **Dismiss Selected**. +You can filter the vulnerabilities table by: - +| Filter | Available options | +|:---------|:------------------| +| Status | Detected, Confirmed, Dismissed, Resolved. | +| Severity | Critical, High, Medium, Low, Info, Unknown. | +| Scanner | [Available scanners](../index.md#security-scanning-tools). | +| Project | For more details, see [Project filter](#project-filter). | +| Activity | For more details, see [Activity filter](#activity-filter). | -## Project Vulnerability Report +### Filter the list of vulnerabilities -> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/6165) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.1. +To filter the list of vulnerabilities: -The vulnerabilities that exist in your project's -[default branch](../../project/repository/branches/index.md#default-branch) are accessed by navigating to -**Security & Compliance > Vulnerability Report**. +1. Select a filter. +1. Select values from the dropdown. +1. Repeat the above steps for each desired filter. -The project vulnerability report first displays the time at which the last pipeline completed on the project's -default branch. There's also a link to view this in more detail. In the case of any pipeline failures, -the number of failures is indicated. The failure notification takes you directly to -the **Failed jobs** tab of the pipeline page. +The vulnerability table is applied immediately. The vulnerability severity totals are also updated. - +The filters' criteria are combined to show only vulnerabilities matching all criteria. +An exception to this behavior is the Activity filter. For more details about how it works, see +[Activity filter](#activity-filter). -## Export vulnerabilities +### Project filter -> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/213014) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.10. +The content of the Project filter depends on the current level: -You can export all your vulnerabilities in CSV (comma separated values) format by clicking the -**{upload}** **Export** button located at top right of the Security Dashboard. When the report is -ready, the CSV report downloads to your local machine. The report contains all vulnerabilities for -the projects defined in the Security Dashboard, as filters don't apply to the export function. +| Level | Content of the Project filter | +|:---------------|:------------------------------| +| Instance level | Only projects you've [added to the instance-level Security Center](../security_dashboard/index.md#adding-projects-to-the-security-center). | +| Group level | All projects in the group. | +| Project level | Not applicable. | -NOTE: -It may take several minutes for the download to start if your project contains -thousands of vulnerabilities. Don't close the page until the download finishes. +### Activity filter + +> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/259255) in GitLab 13.9 -The fields in the export include: +The Activity filter behaves differently from the other filters. The selected values form mutually +exclusive sets to allow for precisely locating the desired vulnerability records. Additionally, not +all options can be selected in combination. + +Selection behavior when using the Activity filter: + +| Activity selection | Results displayed | +|:------------------------------------|:------------------| +| All | Vulnerabilities with any Activity status (same as ignoring this filter). Selecting this will deselect any other Activity filter options. | +| No activity | Only vulnerabilities without either an associated Issue or that are no longer detected. Selecting this will deselect any other Activity filter options. | +| With issues | Only vulnerabilities with one or more associated issues. Does not include vulnerabilities that also are no longer detected. | +| No longer detected | Only vulnerabilities that are no longer detected in the latest pipeline scan of the `default` branch. Does not include vulnerabilities with one or more associated issues. | +| With issues and No longer detected | Only vulnerabilities that have one or more associated issues and also are no longer detected in the latest pipeline scan of the `default` branch. | + +## View details of a vulnerability + +To view more details of a vulnerability, select the vulnerability's **Description**. The +[vulnerability's details](../vulnerabilities) page is opened. + +## View issues raised for a vulnerability + +The **Activity** column indicates the number of issues that have been created for the vulnerability. +Hover over an **Activity** entry and select a link go to that issue. -- Group Name -- Project Name -- Scanner Type -- Scanner Name + + +## Change status of vulnerabilities + +To change the status of vulnerabilities in the table: + +1. Select the checkbox for each vulnerability you want to update the status of. +1. In the dropdown that appears select the desired status, then select **Change status**. + + + +## Export vulnerability details + +> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/213014) in the Security Center (previously known as the Instance Security Dashboard) and project-level Vulnerability Report (previously known as the Project Security Dashboard) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 13.0. +> - [Added](https://gitlab.com/gitlab-org/gitlab/-/issues/213013) to the group-level Vulnerability Report in [GitLab Ultimate](https://about.gitlab.com/pricing/) 13.1. + +You can export details of the vulnerabilities listed in the Vulnerability Report. The export format +is CSV (comma separated values). Note that all vulnerabilities are included because filters don't +apply to the export. + +Fields included are: + +- Group name +- Project name +- Scanner type +- Scanner name - Status - Vulnerability - Details -- Additional Information +- Additional information - Severity - [CVE](https://cve.mitre.org/) (Common Vulnerabilities and Exposures) - [CWE](https://cwe.mitre.org/) (Common Weakness Enumeration) -- Other Identifiers +- Other identifiers + +### Export details in CSV format + +To export details of all vulnerabilities listed in the Vulnerability Report, select **Export**. + +The details are retrieved from the database, then the CSV file is downloaded to your local +computer. + +NOTE: +It may take several minutes for the download to start if your project contains +thousands of vulnerabilities. Don't close the page until the download finishes. |