Processing security issues

System users can perform the following actions on security issues:

• view the issue history;
• change the issue status;
• change the issue severity;
• create tasks from issues;
• assign responsible users to issues;
• add comments to issues;
• delete issues.

Viewing the security issue history

You can view the history of detections and actions for security issues, as well as the reasons for changes, on the History tab.

The system uses the following reasons for changes to security issues:

• Reason not specified—the reason for detecting the security issue isn't specified;
• System—the security issue was detected when configured rules were triggered;
• Manually—the security issue was detected when a scan was started manually;
• Not detected—the security issue wasn't detected during a rescan;
• Detected again—the security issue was detected during a rescan.

Changing the security issue severity

You can manually change security issue severity levels in the following ways:

1. in the general Issues section;
2. on the Issues tab of the selected project.

Method 1

To change the security issue severity, follow these steps:

1. Go to the Issues section.
2. Select the new issue severity from the drop-down list in the Severity column.

Method 2

You can also change the issue severity within a selected project. Follow these steps:

1. Go to the Projects section.
2. Select the required project from the list.
3. Go to the Issues tab.
4. Select the new issue severity from the drop-down list in the Severity column.

danger

The Duplicate and False-Positive indicators aren't issue statuses, and using these indicators doesn't change the issue status.

info

You can configure a status model in the system to switch statuses manually or automatically according to their transitions. For more information about configuring the status model, see Status model.

Changing the security issue status

You can manually change security issue statuses in the following ways:

1. in the general Issues section;
2. on the Issues tab of the selected project.

Method 1

To change the security issue status, follow these steps:

1. Go to the Issues section.
2. Select the new issue status from the drop-down list in the Status column.

Method 2

You can also change the issue status within a selected project. Follow these steps:

1. Go to the Projects section.
2. Select the required project from the list.
3. Go to the Issues tab.
4. Select the new issue status from the drop-down list in the Status column.

Working with tasks and security issues

TRON.ASOC users can perform the following actions with tasks and security issues:

• create tasks from one or more security issues;
• remove the link between a security issue and a task;
• assign a responsible user to security issues;
• mention a user in comments on a security issue;
• add comments to security issues;
• delete one or more security issues.

Creating tasks from security issues

To create a task from a security issue, follow these steps:

1. Go to the Security issues section.

2. Open the issue card by selecting its ID in the Vulnerability ID column.

3. On the Information tab, select Actions.

4. Select Create tasks.

5. In the window that opens, select the task tracker where you want to create the task from the Task tracker drop-down list.

6. Specify the following task parameters:

   • name;
   • assignee—the task tracker user;
   • type—bug, task, or story;
   • labels.
   tip

   You can create custom labels for tasks. To create a new label, enter its name in the Labels field and press Enter.

7. Select Create.

After you complete all the steps, the task tracker creates a new task that contains information about the selected security issue.

To create tasks from multiple security issues, follow these steps:

1. Go to the Security issues section.

2. Select the required issues using the checkboxes.

3. Select the Actions drop-down list above the issues table.

4. Select Create tasks from issues.

5. In the window that opens, select the task tracker where you want to create the task from the Task tracker drop-down list.

6. Specify the following task parameters:

   • name;
   info

   When you create tasks from multiple issues, each task name includes:

   • an editable common prefix;
   • a noneditable summary that's unique to each task.
   • assignee—the task tracker user;
   • type—bug, task, or story;
   • labels.
   tip

   You can create custom labels for tasks. To create a new label, enter its name in the Labels field and press Enter.

7. Select Create.

After you complete all the steps, the task tracker creates a new task that contains information about the selected security issues.

warning

When you create tasks, consider the limit of 50 security issues per task. If you need to add more than 50 issues, for example, 75, you must create two tasks.

Removing the link between a security issue and a task

To remove the link between a security issue and a task, follow these steps:

1. Open the security issue card.
2. Select Manage in the Created tasks section.

3. In the list of tasks that opens, select Detach () in the task row.
4. Confirm that you want to remove the link in the window that opens.

To remove the link between a security issue and multiple tasks, follow these steps:

1. Select Manage in the Created tasks section.

2. Select the tasks using the checkboxes ().
3. Select Detach above the table.
4. Confirm that you want to remove the link in the window that opens.

Assigning responsible users to security issues

You can assign a user or group of users to each security issue to handle it. Assigning responsible users helps you track issue processing and distribute the workload among specialists.

To assign a responsible user to one issue, follow these steps:

1. Go to the Security issues section.
2. Open the issue card by selecting its ID in the Vulnerability ID column.
3. Go to the Information tab.
4. Select a user or group of users from the Responsible drop-down list.

Changes are saved automatically. After you select a responsible user, the Responsible user assigned notification appears in the upper-right corner of the page.

To assign a responsible user to multiple issues, follow these steps:

1. Go to the Security issues section.
2. Select the required issues using the checkboxes.
3. Select the Actions drop-down list above the issues table.
4. Select Assign responsible user.
5. In the window that opens, select a user or group of users.
6. Select Assign new responsible user.

Mentioning a user in comments on a security issue

You can mention a system user or a user from a connected task tracker in comments on a security issue.

To mention a user, follow these steps:

1. Go to the comments in the task card.
2. Enter @.
3. In the menu that opens, select a user from the list—a system or task tracker user.
4. Enter a comment and press Enter.

Adding comments to security issues

System users can add comments to security issues. Comments let specialists discuss the issue and its progress.

In addition to adding regular comments, users can:

• mention colleagues in their comments;
• reply to a specific comment;
• track unread comments.
• delete other users' comments—this feature is available only to system administrators.

To add a comment to an issue, follow these steps:

1. Go to the Security issues section.
2. Open the issue card by selecting its ID in the Vulnerability ID column.
3. Enter the comment text in the comment field on the right side of the issue card.
4. If necessary, mention a user with @.
5. Select Enter to send the comment.

To add the same comment to multiple issues at once, follow these steps:

1. Go to the Security issues section.
2. Select the required issues using the checkboxes.
3. Select the Actions drop-down list above the issues table.
4. Select Add comment.
5. Enter the comment text in the form that opens.

6. Select Add comment.

For more information about filtering by comment parameters, see Viewing security issues.

Deleting security issues

To delete one security issue, follow these steps:

1. In the Issues section, select Delete () next to the required issue.
2. In the modal window that opens, confirm that you want to delete the security issue.

To delete multiple security issues, follow these steps:

1. In the Issues section, select the security issues using the checkboxes ().
2. Select the delete button () above the security issues table.
3. In the modal window that opens, confirm that you want to delete the security issues.