Help Centre
Updated

Add or import findings

A finding enters your project by hand, from a vulnerability library write-up, or from a Nessus, Burp Suite, Nuclei, SARIF or JSON report produced by your own tools.

In the app: Exposure › FindingsWho can do this: Contributor or above

Record a manual finding

  1. Open Exposure › Findings and choose Manual finding.
  2. Choose an existing Asset, or type a host, IP address or URL under Manual asset, host or URL and choose its asset type.
  3. Under What was found, pick the type that fits what you found, then fill in the fields that appear.
  4. Set the Severity and describe what you saw, such as the banner, the response or how you confirmed it.
  5. Choose Save finding.

Add a finding for a known weakness

  1. On Exposure › Findings, choose Add Finding.
  2. Enter a Name, pick the Asset and the Vulnerability, then choose Create Finding.

For a library write-up, open Exposure › Vulnerabilities, choose Add Vulnerability, then Choose from library, pick the write-up and the asset, and choose Report finding.

Import a scanner report

  1. On Exposure › Findings, choose Import.
  2. Pick the Report format your scanner produced and choose the file.
  3. If some results point at files rather than a host, as code-analysis results do, pick the asset they belong to under Asset for findings that name no host.
  4. Choose Preview and check what each entry would become. Nothing is saved yet.
  5. Choose Import to save.

Did this answer your question?

On this page