Skip to content

Commit 39938dc

Browse files
mykhailo-sindieievmykhailo-sindieiev
committed
update parser documentation
1 parent a17b230 commit 39938dc

1 file changed

Lines changed: 83 additions & 3 deletions

File tree

  • docs/content/en/connecting_your_tools/parsers/file

‎docs/content/en/connecting_your_tools/parsers/file/generic.md‎

Lines changed: 83 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
---
2-
title: "Generic Findings Import"
2+
title: 'Generic Findings Import'
33
toc_hide: true
44
---
5+
56
Import Generic findings in CSV or JSON format.
67

78
Attributes supported for CSV:
9+
810
- Date: Date of the finding in mm/dd/yyyy format.
911
- Title: Title of the finding
1012
- CweId: Cwe identifier, must be an integer value.
@@ -18,13 +20,79 @@ Attributes supported for CSV:
1820
- Verified: Indicator if the finding has been verified. Must be empty, TRUE, or FALSE
1921
- FalsePositive: Indicator if the finding is a false positive. Must be TRUE, or FALSE.
2022
- Duplicate:Indicator if the finding is a duplicate. Must be TRUE, or FALSE
21-
- IsMitigated: Indicator if the finding is mitigated. Must be TRUE, or FALSE
23+
- IsMitigated: Indicator if the finding is mitigated. Must be TRUE, or FALSE
2224
- MitigatedDate: Date the finding was mitigated in mm/dd/yyyy format or ISO format
25+
- epss_score: Finding [EPSS score](https://www.first.org/epss/)
26+
- epss_percentile: Finding [EPSS percentile](https://www.first.org/epss/articles/prob_percentile_bins)
27+
- CVSSV3: CVSSv3 verctor of the finding
28+
- CVSSV3_score: CVSSv3 score of the finding
29+
- CVSSV4: CVSSv4 vector of the finding
30+
- CVSSV4_score: CVSSv4 score of the finding
31+
- known_exploited: Indicator if the finding is listed in Known Exploited List. Must be TRUE, or FALSE
32+
- ransomware_used: Indicator if the finding is used in Ransomware. Must be TRUE, or FALSE
33+
- fix_available: Indicator if fix available for the finding. Must be TRUE, or FALSE
34+
- kev_date: Date the finding was added to Known Exploited Vulnerabilities list in mm/dd/yyyy format or ISO format.
2335

2436
The CSV expects a header row with the names of the attributes.
2537

2638
Date fields are parsed using [dateutil.parse](https://dateutil.readthedocs.io/en/stable/parser.html) supporting a variety of formats such a YYYY-MM-DD or ISO-8601.
2739

40+
The list of supported fields in JSON format:
41+
42+
- title: **Required.** String
43+
- severity: **Required.** One of the "Critical", "High", "Medium", "Low", "Info"
44+
- description: **Required.** String
45+
- date: Date
46+
- cwe: Int
47+
- cve: String
48+
- epss_score: Float
49+
- epss_percentile: Float
50+
- cvssv3: String
51+
- cvssv3_score: Float
52+
- cvssv4: String
53+
- cvssv4_score: Float
54+
- mitigation: String
55+
- impact: String
56+
- steps_to_reproduce: String
57+
- severity_justification: String
58+
- references: String
59+
- active: Bool
60+
- verified: Bool
61+
- false_p: Bool
62+
- out_of_scope: Bool
63+
- risk_accepted: Bool
64+
- under_review: Bool
65+
- is_mitigated: Bool
66+
- thread_id: String
67+
- mitigated: Bool
68+
- numerical_severity: Int
69+
- param: String
70+
- payload: String
71+
- line: Int
72+
- file_path: String
73+
- component_name: String
74+
- component_version: String
75+
- static_finding: Bool
76+
- dynamic_finding: Bool
77+
- scanner_confidence: Int
78+
- unique_id_from_tool: String
79+
- vuln_id_from_tool: String
80+
- sast_source_object: String
81+
- sast_sink_object: String
82+
- sast_source_line: Int
83+
- sast_source_file_path: String
84+
- nb_occurences: Int
85+
- publish_date: Date
86+
- service: String
87+
- planned_remediation_date: Date
88+
- planned_remediation_version: String
89+
- effort_for_fixing: One of the "High", "Medium", "Low"
90+
- tags: List of Strings
91+
- kev_date: Date
92+
- known_exploited: Bool
93+
- ransomware_used: Bool
94+
- fix_available: Bool
95+
2896
Example of JSON format:
2997

3098
```JSON
@@ -39,13 +107,23 @@ Example of JSON format:
39107
"cve": "CVE-2020-36234",
40108
"cwe": 261,
41109
"cvssv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
110+
"cvssv4": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
111+
"cvssv4_score": 7.3,
112+
"known_exploited": true,
113+
"ransomware_used": true,
114+
"fix_available": true,
115+
"kev_date": "2024-05-01",
42116
"file_path": "src/first.cpp",
43117
"line": 13,
44118
"endpoints": [
45119
{
46120
"host": "exemple.com"
47121
}
48-
]
122+
],
123+
"tags": [
124+
"security",
125+
"myTag"
126+
],
49127
},
50128
{
51129
"title": "test title with endpoints as strings",
@@ -144,9 +222,11 @@ Example:
144222
```
145223

146224
### Sample Scan Data
225+
147226
Sample Generic Findings Import scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/generic).
148227

149228
### Default Deduplication Hashcode Fields
229+
150230
By default, DefectDojo identifies duplicate Findings using these [hashcode fields](https://docs.defectdojo.com/en/working_with_findings/finding_deduplication/about_deduplication/):
151231

152232
- title

0 commit comments

Comments
 (0)