Updated
Add or import findings
A finding enters your project by hand, from a vulnerability library write-up, or from a Nessus, Burp Suite, Nuclei, SARIF or JSON report produced by your own tools.
In the app: Exposure › FindingsWho can do this: Contributor or above
Record a manual finding
- Open Exposure › Findings and choose Manual finding.
- Choose an existing Asset, or type a host, IP address or URL under Manual asset, host or URL and choose its asset type.
- Under What was found, pick the type that fits what you found, then fill in the fields that appear.
- Set the Severity and describe what you saw, such as the banner, the response or how you confirmed it.
- Choose Save finding.
Add a finding for a known weakness
- On Exposure › Findings, choose Add Finding.
- Enter a Name, pick the Asset and the Vulnerability, then choose Create Finding.
For a library write-up, open Exposure › Vulnerabilities, choose Add Vulnerability, then Choose from library, pick the write-up and the asset, and choose Report finding.
Import a scanner report
- On Exposure › Findings, choose Import.
- Pick the Report format your scanner produced and choose the file.
- If some results point at files rather than a host, as code-analysis results do, pick the asset they belong to under Asset for findings that name no host.
- Choose Preview and check what each entry would become. Nothing is saved yet.
- Choose Import to save.