CVSS rules
Rules that set the CVSS vector of findings, and with it their severity.
Scanners rate severity in their own way: the same weakness is critical for one scanner and medium for another. A CVSS rule sets one CVSS vector for every finding of a kind, so findings are rated by your own judgment, and in the same way across scanners.
A CVSS rule sets the CVSS 3.1 vector, the CVSS 4.0 vector or both of the findings it matches. The finding’s severity then follows the score: from the 4.0 vector when it has one, from the 3.1 vector otherwise. Their task tracker tasks are updated with the new priority and description.
Unlike the Auto Validator, CVSS rules apply to findings in any triage status.
Create a rule
Open CVSS in the sidebar and click Create Rule:
- Build the CVSS vector by choosing a value for each metric. The Score is shown as you go.
- Set the scope: the products or assets the rule applies to, or Global.
- Add the conditions, as in Auto Validator rules. For example,
Scanner Type is Secrets and Title contains
AWS.
Findings to be affected shows which findings the rule would change now.
Make sure that two rules don’t match the same finding: which of them sets the vector then isn’t defined.
Settings and ready-made rules
The settings at the top of the CVSS page turn the rules on and off (Enable CVSS) and set how often they run (Launch frequency (seconds)).
Click Import Rules to upload a rule set file, for example the one for the built-in scanners.