Commit a35a9fd1 authored by Russell Dickenson's avatar Russell Dickenson

Merge branch 'docs-interact-vulns' into 'master'

Docs updates for interacting with standalone vulnerabilities

See merge request gitlab-org/gitlab!31659
parents f2375df8 62feb696
...@@ -101,25 +101,27 @@ information with several options: ...@@ -101,25 +101,27 @@ information with several options:
- [Solution](#solutions-for-vulnerabilities-auto-remediation): For some vulnerabilities, - [Solution](#solutions-for-vulnerabilities-auto-remediation): For some vulnerabilities,
a solution is provided for how to fix the vulnerability. a solution is provided for how to fix the vulnerability.
![Interacting with security reports](img/interactive_reports.png) ![Interacting with security reports](img/interacting_with_vulnerability_v13_0.png)
### Dismissing a vulnerability ### Dismissing a vulnerability
You can dismiss vulnerabilities by clicking the **Dismiss vulnerability** button. To dismiss a vulnerability, you must set its status to Dismissed. Follow these steps to do so:
This will dismiss the vulnerability and re-render it to reflect its dismissed state.
If you wish to undo this dismissal, you can click the **Undo dismiss** button. 1. Select the vulnerability in the Security Dashboard.
1. Select **Dismissed** from the **Status** selector menu at the top-right.
You can undo this action by selecting a different status from the same menu.
#### Adding a dismissal reason #### Adding a dismissal reason
> Introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.0. > Introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.0.
When dismissing a vulnerability, it's often helpful to provide a reason for doing so. When dismissing a vulnerability, it's often helpful to provide a reason for doing so. Upon setting a
If you press the comment button next to **Dismiss vulnerability** in the modal, vulnerability's status to Dismissed, a text box appears for you to add a comment with your
a text box appears for you to add a comment with your dismissal. dismissal. Once added, you can edit or delete it. This allows you to add and update context for a
Once added, you can edit or delete it. This allows you to add and update vulnerability as you learn more over time.
context for a vulnerability as you learn more over time.
![Dismissed vulnerability comment](img/dismissed_info_v12_3.png) ![Dismissed vulnerability comment](img/adding_a_dismissal_reason_v13_0.png)
#### Dismissing multiple vulnerabilities #### Dismissing multiple vulnerabilities
......
...@@ -51,11 +51,10 @@ A pipeline consists of multiple jobs, including SAST and DAST scanning. If any j ...@@ -51,11 +51,10 @@ A pipeline consists of multiple jobs, including SAST and DAST scanning. If any j
> [Introduced](https://gitlab.com/gitlab-org/gitlab/issues/6165) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.1. > [Introduced](https://gitlab.com/gitlab-org/gitlab/issues/6165) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 11.1.
At the project level, the Security Dashboard displays the latest security reports At the project level, the Security Dashboard displays the latest security reports for your project.
for your project from the last successful pipeline. Use it to find and fix vulnerabilities affecting the Use it to find and fix vulnerabilities.
[default branch](../../project/repository/branches/index.md#default-branch).
![Project Security Dashboard](img/project_security_dashboard_v12_3.png) ![Project Security Dashboard](img/project_security_dashboard_v13_0.png)
### Export vulnerabilities ### Export vulnerabilities
...@@ -81,32 +80,27 @@ First, navigate to the Security Dashboard found under your group's ...@@ -81,32 +80,27 @@ First, navigate to the Security Dashboard found under your group's
Once you're on the dashboard, at the top you should see a series of filters for: Once you're on the dashboard, at the top you should see a series of filters for:
- Status
- Severity - Severity
- Confidence
- Report type - Report type
- Project
To the right of the filters, you should see a **Hide dismissed** toggle button.
NOTE: **Note:** NOTE: **Note:**
The dashboard only shows projects with [security reports](#supported-reports) enabled in a group The dashboard only shows projects with [security reports](#supported-reports) enabled in a group.
according to the last successful projects' pipelines.
![dashboard with action buttons and metrics](img/group_security_dashboard_v12_6.png) ![Dashboard with action buttons and metrics](img/group_security_dashboard_v13_0.png)
Selecting one or more filters will filter the results in this page. Disabling the **Hide dismissed** Selecting one or more filters will filter the results in this page.
toggle button will let you also see vulnerabilities that have been dismissed.
The main section is a list of all the vulnerabilities in the group, sorted by severity. The main section is a list of all the vulnerabilities in the group, sorted by severity.
In that list, you can see the severity of the vulnerability, its name, its In that list, you can see the severity of the vulnerability, its name, its
confidence (likelihood of the vulnerability to be a positive one), and the project confidence (likelihood of the vulnerability to be a positive one), and the project
it's from. it's from.
If you hover over a row, there will appear some actions you can take: If you hover over a row, the following actions appear:
- "More info" - More info
- "Create issue" - Create issue
- "Dismiss vulnerability" - Dismiss vulnerability
Next to the list is a timeline chart that shows how many open Next to the list is a timeline chart that shows how many open
vulnerabilities your projects had at various points in time. You can filter among 30, 60, and vulnerabilities your projects had at various points in time. You can filter among 30, 60, and
...@@ -150,7 +144,7 @@ To add projects to the dashboard: ...@@ -150,7 +144,7 @@ To add projects to the dashboard:
Once added, the dashboard will display the vulnerabilities found in your chosen Once added, the dashboard will display the vulnerabilities found in your chosen
projects. projects.
![Instance Security Dashboard with projects](img/instance_security_dashboard_with_projects_v12_8.png) ![Instance Security Dashboard with projects](img/instance_security_dashboard_with_projects_v13_0.png)
### Export vulnerabilities ### Export vulnerabilities
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment