Assets
Where assets come from, how to add them by hand or import repositories, and how to move or delete them.
An asset is one thing a product is made of. There are five types:
| Type | Value | Example |
|---|---|---|
| Repository | the SSH clone URL | git@gitlab.com:whitespots-public/appsec-portal.git |
| Docker Image | the image name without a tag | registry.gitlab.com/whitespots-public/appsec-portal/back/auto_validator |
| Domain | a domain name | whitespots.io |
| Host | an IP address | 0.0.0.0 |
| Cloud Account | a readable account name, plus an IAM key ID and secret | production-aws |
Assets in the sidebar lists the assets of all products, one link per type. On a product’s page, Assets lists only that product’s assets.
Where assets come from
Most assets come in by themselves:
- Pushes. With the version control webhook, the first push to a repository adds it to the default product and scans it.
- Container registries. New images in a connected container registry are added and scanned.
- Scans. A domain audit with Subfinder or Naabu adds the subdomains and hosts it finds to the audit’s product. See Scanners.
- Imports. A scan result that names an asset adds it to its product if it isn’t there yet. See Import scan results.
You can also add them yourself:
- From version control. Import repositories from GitLab, GitHub, Bitbucket or Azure DevOps, for example ones that nobody pushes to (see below).
- By hand. Click Add Repository, Add Docker Image and so on above the list.
New assets that don’t name a product land in the default product, Unsorted: move them to their products from time to time (see below).
Add an asset by hand
Open Assets, pick the type in the sidebar and click the add button. Fill in:
- Asset type and the value (see the table above). The form shows an example for each type.
- Product, when you add it from the list of all assets.
- Repository Link Config, for repositories: how to build links from a finding to the file and line in the repository. See Version control.
- Job sequence: the scans that an audit of this asset runs. See Sequences.
- Asset tags: tags to filter assets and findings by.
The value is also what Auditor scans: it receives it as a variable of the audit jobs.
Import repositories from version control
With the push webhook, repositories come in on their own as people push. Import them by hand to bring in the ones that nobody pushes to, or to put many repositories into their products at once.
Connect your version control first (see Version control). Then open a product’s Assets, or Assets in the sidebar, and click Import Repositories.
- Select the version control integration.
- Select the repositories. In the list of all assets, choose a product for each repository, or Set Default Product for All.
- Click Import.
Repositories that are already in the product are marked. The list shows the repositories that the integration’s token can see. If users sign in with SSO through your version control, their repositories are imported the first time they log in.
Open an asset
Click the asset’s row in the list, or View in its menu. The asset page shows the same fields as the form, and you can change them there.
In the list of all assets, View in product opens the asset inside its product.
Move an asset to another product
Change the asset’s Product, or select assets in the list and use the product button in the toolbar to move them all at once, for example to sort what came into Unsorted. The assets’ findings move with them.
If the other product already has the same asset, the moved asset is merged into it: its findings move and the duplicate is deleted. Portal asks you to confirm first.
Delete an asset
Use Delete in the asset’s menu, or select assets and click Delete in the toolbar. Choose whether to delete only the asset or also its findings.