A finding is a group of vulnerabilities on your system related to the same attack vector.
Number of vulnerabilities without a remediation plan specified by one of your managers.
- Each grey dot represents a resource (IP, URL, or repository).
- Red and green dots represent the open and closed findings for that system, respectively.
- Size and darkness are proportional to the security impact on that system.
These are all your findings categorized by tag. Tags can be assigned at the moment of defining a treatment for your vulnerabiities, for more information click here.
These are the analytics based on the information of your usage of the DevSecOps Agent.
Here you can see if the Agent is active or inactive.
Number of times your team used the agent to check for vulnerabilities.
The agent performs security testing of your source-code, deployed environment and infrastructure. Single units of security problems found are displayed here.
You can run the agent in any of your repositories at any of its versions (commits or branches).
The agent's objective is to help your team overcome security vulnerabilities. For this to work, we put two things in your hands:
- The strict mode (which is enabled by default) helps you stop builds or deployments if there are open vulnerabilities, and thus protects your system from vulnerable code introduction.
- However, accepted vulnerabilities on the ASM are ignored by the strict mode, and the agent will (by decision of your team) allow them to be built or deployed.
The maximum benefit is reached when the accepted risk is low, and the strict mode high.
Risk is proportional to the number of vulnerable changes introduced into your system:
- A build is considered vulnerable if it contains security issues.
- The agent in strict mode stops those security issues from being delivered to your end users.