Auto Validator

Rules that verify, reject or accept new findings, and tag and group them, as they arrive.

Updated

The Auto Validator triages new findings by rules, so the security team only looks at the findings that no rule recognizes. A rule says which findings it applies to and what to do with them: for example, reject the findings of a secret scanner in test files, or verify every critical finding of a dependency scanner.

Rules act on Unverified findings only. A finding that someone has already triaged is never changed by a rule.

Create a rule

Open Auto Validator in the sidebar and click Create Rule:

  • Status change: what the rule does with the findings:

    ActionResult
    ConfirmVerified
    RejectRejected
    Temporarily AcceptTemporarily Risk Accepted, for the number of days in the workflow settings
    Permanently AcceptPermanently Risk Accepted
    Add Tags and Groupsthe status doesn’t change

  • Add tags to validated findings and Group validated findings: tags and finding groups to add to the findings. A group is created in each product if it doesn’t exist.

  • Create a task in the task tracker when a finding is verified: Use task tracker settings, Always create or Never create. See Task trackers.

  • The scope: the products or assets the rule applies to, or Global for all of them, now and in the future.

  • The conditions (see below).

  • Active: turn a rule off without deleting it.

Findings to be affected shows the Unverified findings that the rule would change now. Check it before you save: a rule that is too broad rejects real vulnerabilities.

The quickest way to start a rule is from a finding: Create Validator Rule on the finding fills in the conditions from its title, description, severity and scanner, and the status change from its status. The rule starts with all products in scope; click Edit next to Affected products to narrow it. See A finding.

Conditions

A condition checks one field of the finding. All conditions of a rule must match (AND).

FieldExample
Title, DescriptionHardcoded password
SeverityCritical
File Path, Line.*/tests?/.*
Dependency, Vulnerable Url, Docker Image Tag, Branch, Custom Field
Scanner, Scanner TypeGitleaks Scan; Secrets
Tagfalse-positive
Import SourceInternal, or External for findings imported from DefectDojo

Each text condition is Equals, Contains value or Matches regex (PostgreSQL regular expressions). NOT inverts it.

In which order rules run

When several rules match one finding, they run by action: first Add Tags and Groups, then Reject, Temporarily Accept, Permanently Accept, and Confirm last. So a finding that both a reject rule and a confirm rule match is rejected. Overlapping rules are fine.

When rules run

  • Validate findings on import: each import runs the rules on its new findings.
  • Launch frequency (seconds): the rules also run on all Unverified findings at this interval, so a new rule applies to the findings that are already there.

Both are in the settings at the top of the Auto Validator page, with Enable Autovalidator to turn all rules off.

Ready-made rules

Click Import Rules and upload a rule set file, for example the one for the built-in scanners. Allow for products sets the scope of the imported rules. Importing rules needs access to all products.

Rules need a paid license. See License.