Report Token: Finding fields, sorting and filtering options

Important Notes

1. Use & to separate multiple parameters
2. Field names are case-sensitive
3. Multiple fields should be separated by commas
4. Values for filter settings (type, status, severity) must match the exact enum values

This is a list of the available Finding fields and other options that can be used on the different tokens related to Findings.

Basic Information

• name - Finding name
• title - Finding title (Code + Name with link)
• description - Finding description
• code - Finding identifier
• severity - Finding severity level
• status - Current status
• type - Finding type

Technical Details

• cvss - CVSS score and vector
• cvss_score - CVSS score only
• cvss_vector - CVSS vector only
• cwes - Associated CWEs
• cves - Associated CVEs
• exploits - Known exploits
• vulnerability_types - Types of vulnerabilities
• mitre_attack_tactic - MITRE ATT&CK Tactics
• mitre_attack_technique - MITRE ATT&CK Techniques
• mitre_attack_mitigation - MITRE ATT&CK Mitigations

Impact and Analysis

• impact - Impact rate assessment
• impact_description - Impact description
• likelihood - Likelihood rate assessment
• likelihood_description - Likelihood description
• background_information - Background context
• remediation - Remediation recommendations

Assets and Evidence

• assets - Affected assets
• asset_count - Number of affected assets
• evidences - Finding instances/evidence
• evidence_table - Evidence in table format
• external_url - External references
• pci_evidence_table - PCI oriented style

Evidence fields

• title- Evidence title
• location- Evidence location
• version- Evidence version
• ip- Evidence IP
• port- Evidence port
• protocol- Evidence protocol
• compliance_status- Evidence compliance status
• issue_details- Evidence issue details
• reproduce- Evidence reproduce
• results- Evidence results

Compliance

• compliance_status - Compliance status
• compliance_comment - Compliance details
• compliance - Compliance controls

Other

• labels - Finding labels
• occurrence - New or Reoccurrence status
• reoccurrence - Link to original finding
• reoccurrences - List of related findings

Custom fields

Any custom field can be used as well. Just make sure you use the code of the custom field, and not the name.

Enum Values

Evidence table Format

• VisibleInstances - Only the evidences marked as visible on report in finding details (IP, Location, Port/Protocol)
• All - Show all evidence (IP, Location, Port/Protocol)
• AllMergedOnPortProtocol - Group rows per IP/Location, merge by Port/Protocol

Asset Format

• List1 - Single column list
• List2 - Two column list
• Table - Tabular format (IP, Hostname, Port)

Sort Direction

• Ascending
• Descending

Finding Severity

• Info
• Low
• Medium
• High
• Critical

Finding Status

• Draft
• ToReview
• Reviewed
• PendingFix
• ReadyRetest
• Accepted
• Mitigated
• PartialFix
• FalsePositive
• Raised
• ReOpen