--- description: "View the execution details of the Fluid Attacks CI Gate, the security measure that acts as a security gate in CI/CD environments and breaks the build." keywords: "Fluid Attacks platform, CI Gate, CI CD, Break the build, DevSecOps, CI Gate execution logs, CI Gate execution details, Fluid Attacks documentation " other: private: false title: View details of the security of your builds --- # View details of the security of your builds import { Image } from "@/components/image"; Fluid Attacks' CI Gate supports the [DevSecOps methodology](https://fluidattacks.com/pt/cybersecurity-essentials/what-is-devsecops) applied in your projects. This tool acts as a security gate within your continuous integration and continuous deployment (CI/CD) environments, preventing vulnerable code from reaching production. That is, CI Gate monitors your software versions and, if it detects vulnerabilities that have not been remediated nor [accepted](https://help.fluidattacks.com/portal/en/kb/articles/assign-treatments), automatically [breaks the build](https://help.fluidattacks.com/portal/en/kb/articles/prevent-the-deployment-of-builds-with-vulnerabilities) to enforce their remediation, upholding your security standards. The [rules to break the build](https://help.fluidattacks.com/portal/en/kb/articles/manage-security-gates) can be configured at the organization and group levels in the platform's Policies section. You can see details of each of CI Gate's executions in the DevSecOps section. This page guides you through it. ## DevSecOps table Your group's DevSecOps section features a comprehensive table that shows the execution history of CI Gate within your pipeline. A banner reminds you of your relevant policies currently applied in executions. Gain deeper insights into each execution by simply clicking on the corresponding date. Know the DevSecOps table on the Fluid Attacks platform

Know the DevSecOps table on the Fluid Attacks platform

The following are brief descriptions of the table columns: - **Date:** The date and time the CI Gate was executed in your pipeline - **Status:** Whether vulnerabilities were found in the execution: - **Vulnerable:** Indicates that CI Gate identified at least one vulnerability that has not been fixed - **Secure:** Indicates that no unfixed vulnerabilities were found - \***\*Accepted vulnerabilities:\*\*** The total number of vulnerabilities detected that are [tolerated by your policies](https://help.fluidattacks.com/portal/en/kb/articles/manage-security-gates) - **Unmanaged vulnerabilities:** The total number of vulnerabilities detected that break the build - **Strictness:** Whether breaking the build was enabled: - **Strict:** CI Gate is configured to break the build if unmanaged vulnerabilities are detected, preventing deployment into production - **Tolerant:** CI Gate only issues warnings for unfixed vulnerabilities, allowing deployment into production - **Type:** The security testing technique(s) with which the vulnerabilities were detected, where the following values are offered: - **STATIC:** Static application security testing (SAST) - **DYNAMIC:** Dynamic application security testing (DAST) - **ALL:** At least one vulnerability was found through SAST and at least one through DAST - **Git repository:** The nickname of the [Git repository](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots#Add_a_new_Git_Root) whose changes were scanned by CI Gate - **Identifier:** The first eight characters of the CI Gate run's unique alphanumerical identifier ### Filter the DevSecOps table > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager By clicking on the filters button (

), you access several options to limit the information shown in the table. Filter the DevSecOps table on the Fluid Attacks platform

Choose filters in **DevSecOps** Apply filter in DevSecOps on the Fluid Attacks platform

Apply filter ### Search the DevSecOps table > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager Type on the search bar for the table to show you only the rows that contain your exact search term.

Search the DevSecOps table on the Fluid Attacks platform

### Download a report of the CI Gate executions > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager The platform allows you to download the information contained by the DevSecOps table in a comma-separated values (CSV) file. You just need to click on the **Generate a report** button. The report is made available in [Downloads](https://help.fluidattacks.com/portal/en/kb/articles/access-recent-downloads) after a few minutes. Download DevSecOps table on the Fluid Attacks platform

Download DevSecOps table on the Fluid Attacks platform

**Generate report** button Confirm DevSecOps report delivery on the Fluid Attacks platform

Notification ## View CI Gate execution details > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager In the **DevSecOps** section, to gain more details about a specific CI Gate execution, click on its date. Select a CI Gate execution on the Fluid Attacks platform

Select a CI Gate execution on the Fluid Attacks platform

A pop-up window appears, which provides a wealth of details about that specific run. You are presented with two tabs: [Summary](https://help.fluidattacks.com/portal/en/kb/articles/view-details-of-the-security-of-your-builds#Summary) and [Execution log](https://help.fluidattacks.com/portal/en/kb/articles/view-details-of-the-security-of-your-builds#Execution_log). ### Summary The first data in Summary is that already present [in the table](https://help.fluidattacks.com/portal/en/kb/articles/view-details-of-the-security-of-your-builds#DevSecOps_table) plus the indication of the value of three policies applied in that execution. All this data is again presented in the second tab. View Agent execution policy details on the Fluid Attacks platform

View Agent execution policy details on the Fluid Attacks platform

Here are brief definitions of these policies: 1. **[Severity threshold](https://help.fluidattacks.com/portal/en/kb/articles/manage-security-gates#Minimum_CVSS_score_of_an_open_vulnerability_to_break_the_build):** The minimum CVSS score required for an unfixed vulnerability to break the build 1. [**Grace period**](https://help.fluidattacks.com/portal/en/kb/articles/manage-security-gates#Grace_period_where_newly_reported_vulnerabilities_will_not_break_the_build)**:** The number of days during which newly discovered vulnerabilities do not break the build 1. **[Days to technical debt](https://help.fluidattacks.com/portal/en/kb/articles/manage-security-gates#Number_of_days_until_vulnerabilities_are_considered_technical_debt_and_do_not_break_the_build):** The number of days until vulnerabilities are considered technical debt and do not break the build Below these details is a table with information about all vulnerabilities identified by CI Gate in its execution. See Agent execution summary on the Fluid Attacks platform

See Agent execution summary on the Fluid Attacks platform

The table has the following columns: 1. **Exploit Maturity:** The degree to which the vulnerability might lead to a successful attack, as measured by the [CVSS](https://help.fluidattacks.com/portal/en/kb/articles/glossary#CVSS) (Common Vulnerability Scoring System) v4.0 1. **Status:** Indicates that the vulnerability is **Open** (is present) in the lines of code, inputs or ports 1. **Type:** The security testing technique(s) with which the vulnerabilities were detected, as defined [above](https://help.fluidattacks.com/portal/en/kb/articles/view-details-of-the-security-of-your-builds#DevSecOps_table) 1. **Specific:** The exact lines of code, inputs (e.g., password fields) or ports where the vulnerability was found 1. **Where:** The file path where this vulnerability was found You can apply filters to narrow down the information displayed in the table, facilitating targeted analysis. Filter execution summary table on the Fluid Attacks platform

Filter execution summary table on the Fluid Attacks platform

Moreover, you can simply type what you are looking for in the search box, so that only the rows whose content matches your search are shown.

Search the execution summary table on the Fluid Attacks platform

### Execution log > [!TIP] > > You can get the execution log in a JSON format by either using the `--output` [CLI option](https://help.fluidattacks.com/portal/en/kb/articles/install-the-ci-agent-to-break-the-build#Optional) and outputting the report to a file, or by querying the `jsonLog` attribute of `forcesExecution` in the platform's [API](https://app.fluidattacks.com/api). Understanding CI Gate's execution log content can sometimes be challenging. This page section offers valuable tips and key information to help you interpret it effectively and extract maximum value from the data. The following are main elements to take into account: 1. **[Arguments](https://help.fluidattacks.com/portal/en/kb/articles/install-ci-gate-to-break-the-build#Arguments):** The log's content depends on the parameters or arguments used during agent execution. For illustration purposes, the screenshots below show an example of an execution with the argument `--strict`. View arguments in execution log on the Fluid Attacks platform

View arguments in execution log on the Fluid Attacks platform

1. **Report body:** The core of the report is the detailed information about the detected vulnerabilities. Here is a brief explanation of the content characteristics shown for each of the latter: 1. `title`: The category that best describes the vulnerability following [Fluid Attacks' own classification](https://db.fluidattacks.com/wek/) 1. `url`: The [vulnerability URL](https://help.fluidattacks.com/portal/en/kb/articles/see-where-vulnerabilities-are-and-more-details#Get_the_link_to_share_the_details_of_a_vulnerability) on the platform 1. `state`: Indicates the condition of the group regarding the type of vulnerability, where it is **Vulnerable** if the weakness is present 1. `exploit`: From the [CVSS](https://help.fluidattacks.com/portal/en/kb/articles/glossary#CVSS), probability of exploitation given the current state of techniques for it, exploit code availability, and actual exploitation "in the wild" 1. `severity`: The type of vulnerability's severity score (from 0.1 to 10.0) using the CVSS 1. `vulnerable`: The total number of unfixed vulnerabilities 1. `locations`: The vulnerabilities that were identified, for which the following is informed: 1. `type`: Whether it is a vulnerability found by looking at the source code (static) or attacking the running application (dynamic) 1. `technique`: The security testing technique with which the vulnerability was detected 1. `where`: The file path where this vulnerability was found 1. `specific`: The indication of the exact lines of code, inputs (e.g., password fields) or ports where the vulnerability was found 1. `state`: Indicates that the lines of code, inputs or ports are **Vulnerable** (the vulnerability is present) 1. `severity`: This specific vulnerability's severity score using the CVSS 1. `compliance`: Whether the vulnerability breaks the build View Agent execution log on the Fluid Attacks platform

View Agent execution log on the Fluid Attacks platform

1. **Summary:** The report concludes with a summary highlighting the total number of unfixed vulnerabilities, the CI Gate execution time, the [policies](https://help.fluidattacks.com/portal/en/kb/articles/view-details-of-the-security-of-your-builds#View_Agent_execution_details) verified, the vulnerability type's name and age, and the information of whether the build was broken or passed. View execution log summary on the Fluid Attacks platform

View execution log summary on the Fluid Attacks platform

> [!TIP] > > **Free trial**Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your [21-day free trial](https://app.fluidattacks.com/SignUp) and discover the benefits of the [Continuous Hacking](https://fluidattacks.com/services/continuous-hacking/) [Essential plan](https://fluidattacks.com/plans/). If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out [this contact form](https://fluidattacks.com/contact-us/).