In the Policies section on the platform, you can select and configure the conditions or policies that the agent must validate for breaking the build.
The DevSecOps section has a table showing a cumulative record of the execution of our DevSecOps agent in your pipeline. This table contains dates, numbers of vulnerabilities, types of testing, repositories assessed, among other data. You can access more details about each execution by clicking on the corresponding table row. These details include a new table with each vulnerability and its exploitability, status and location, among others.
In total, we have seven columns which are described below:
In the DevSecOps section, you can see the following functionalities:
In the DevSecOps section, there are five filters available for the table. You can find them on the top left.
In the DevSecOps section, there is the Export button on the top right. Clicking on this button, you can download a CSV (comma-separated values) file containing all the information in the table of this section.
The search bar filters the information contained in the columns of the table.
Clicking on any of our DevSecOps agent executions, you will see a pop-up window that provides more detailed information about that execution.
This window offers us the information that the agent table gives us including the two policies that you specified in policies section which are: "DevSecOps: Days before agent starts breaking the build for new vulnerabilities" represented by Grace period and Severity Threshold refers to the policy "DevSecOps: Minimum CVSS 3.1 score from which agent breaks the build for open vulnerabilities." You can enter here if you want to know more about the policies.
You can also see in this view two tabs: Summary and Execution log.
This tab shows a table that provides you with concise and clear information about all the vulnerabilities reported by our agent in a specific execution. You can see each vulnerability's location, exploitability, status and type (according to the technique that detected it).
It has the following columns:
Clicking on the Columns button, you can open a window to show or hide columns from the table, depending on the data you want to observe.
Clicking on the Filters button, you can use to restrict the set of information visible in the table.
--output
CLI option and outputting the report to a file, or by querying the jsonLog
attribute of forcesExecution
in our platform's API.First, you have to understand that depending on what parameters or arguments we add to our execution, we will get the information. For this example, we will analyze this execution with the following arguments: **-vv, -static, and --lax.**
If you want to know what other parameters you can pass to the execution of the agent, you can enter them here.
When you run the agent, you can see the result of the execution from Fluid Attacks' platform in the tab called DevSecOps, or you can also see it from your CI/CD or in the terminal of your local machine.
You first see general information about how the agent was executed with the INFO
tag. Next, you can see an informative WARNING
which informs you if you specify the repository name; follow the other INFO
tag, which tells you how the whole run was.
Next, you will find the Findings Report,
which will give you a report of the vulnerable Findings that were found. Note that it will provide different findings depending on how you ran the agent. Here is a brief explanation of its contents.
This way, you will see the content of your report, where according to a specific location, it will give you this information.
Once the report is finished, you will see a summary that tells you the total number of vulnerabilities with Untreated status and those with accepted treatment. It also tells you how long it took to execute the agent.
Remember that your summary's content may change according to the parameters with which you ran the agent. You may also get information on what criteria will be applied to break the Build; it is re-emphasized that it is given according to the stipulated Policies.