Find vulnerabilities
How findings get into AppSec Portal: audits run by Auditor, reports sent over the API, uploaded files and findings added by hand.
Findings get into Portal in four ways. Use the first one wherever you can.
| Way | When to use it |
|---|---|
| Audits run by Auditor | The main way. Auditor runs the scanners on your assets on demand, on a schedule, on every push and on every new image, and sends the results back. |
| The API | Your scanners already run somewhere else, for example in CI pipelines, and you can’t move them yet. |
| Upload a report | You got a report file from somewhere: a one-off scan, a vendor, a penetration test tool. |
| Add a finding by hand | A vulnerability that no scanner reports, for example from a manual review. |
Prefer audits over sending reports from CI pipelines. With audits, the scanners, their versions and their settings live in one place, every asset is scanned the same way, and a new repository is scanned without changing its pipeline. Reports from pipelines depend on each team keeping its pipeline up to date, which is hard to cover with many repositories, and a full set of scanners often makes a pipeline run too long. That’s why Portal moved from scanning in CI pipelines to Auditor audits.
Every way needs to know which scanner wrote the report. Portal reads the reports of the supported scanners. For any other scanner, set up how its reports are read first: see Bring your own scanner. Then run it as an Auditor job rather than uploading its reports.
Findings from audits, the API and uploads arrive Unverified and go through the triage rules in the same way. Then see Triage findings.