Giters

faloker / purify

All-in-one tool for managing vulnerability reports from AppSec pipelines

Home Page:https://faloker.gitbook.io/purify

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Group findings together

ylorgat opened this issue · comments

commented

Is it possible to create an entry within the template that groups the same security issue from different endpoints into one heading.

For example group all the "Strict transport security not enforced" issues into one and then when you click into it you see details on where these issues are found.

Thank you

commented

Hey @ylorgat,

Yes, this is possible with templates. Step-by-step documentation on templates is available here.

You will be most interested in Step 6 and Step 7. In the example all findings with the same offender field will be grouped and the values of the file field will be merged into one. You can group by multiple fields and merge multiple fields.

Hope this helps, lmk, if I can help you with something else. Thanks!

commented

Hi there,

Thank you very much for your response.

So I can merge findings together but I wanted to ask inside the description how can you then list the multiple paths that vulnerability is found on.

So take your example when you click the vulnerability under the section "File" inside it will list all the files where offender "..."
is found not just one.

commented

Screenshot 2020-08-24 at 12 51 52

The issue "Base64-encoded data in parameter" is found on multiple paths. But the template that I have created lists just the first one from the scan report and marks the others as duplicates.

The reason I want to do like this is to remove all the noise from multiple "Base64-encoded data in parameter" vulnerabilities inside the Unit but there's one overarching vulnerability that has details to all the places where that vulnerability is found

@faloker

commented

Hey @ylorgat,

Sorry for the delay, I am aware of this issue and it was fixed in the dev branch. To put it simply, there is a problem in the template creation process that leads to an incorrect merge, so the path field was not merged.

In about a week, there will be a new major release with breaking API changes, UI changes and bug fixes. With all due respect for your interest in this project, I kindly recommend coming back and re-evaluating Purify after the upcoming release.

Thanks!