Vulnerator / Vulnerator

The official distribution of the vulnerability parsing utility.
https://vulnerator.github.io/Vulnerator/
MIT License
205 stars 70 forks source link

Most SCAs reject NA and not a finding w/o comments - need some kind of indicator to make blank comments stand out #109

Open ibjohn opened 7 years ago

ibjohn commented 7 years ago

Prerequisites

Before submitting a new issue, please ensure you have completed the following (replace the space in the box with an "x" to denote that it has been completed)

Category

Please select a category for the item being created

Description

Please provide a brief synopsis of the feature request or issue; if the item being created is due to a bug, please complete the "Expected Outcome", "Actual Outcome", and "Reproduction Steps" sections as well, otherwise, check the boxes to show that it doesn't apply

Synopsis

Place your description here, please! (Replace this line)

Expected Outcome

What did you think was going to happen? (Replace this line)

Actual Outcome

What really happened? (Replace this line)

Reproduction Steps

How did you get Vulnerator to do that? (Replace this line)

Attachments

Please provide any relevant attachments, as you see fit (e.g. screenshots); if supplying vulnerability data (e.g. CKL/Nessus files or reports), please ensure that they are sanitized of IP addresses and host names and email them to alex.kuchta@navy.mil - DO NOT POST VULNERABILITY FILES HERE

amkuchta commented 7 years ago

@ibjohn is there any reason that filtering does not suit your needs? And on which reports would you want the color coding to be?

ibjohn commented 7 years ago

For many of us, you are absolutely correct. Just thinking of just making it easier to not overlook for the users. That means less chance of me and others rejecting RARs.

CyberSecDef commented 7 years ago

I've found when I've generated RAR/POAMs that setting the cell background to yellow when data was missing was helpful for our team mates. Maybe set something on the output generator to do the same for vulnerator?

-----Original Message----- From: ibjohn [mailto:notifications@github.com] Sent: Tuesday, May 16, 2017 8:08 AM To: Vulnerator/Vulnerator Cc: Subscribed Subject: [Non-DoD Source] Re: [Vulnerator/Vulnerator] Most SCAs reject NA and not a finding w/o comments - need some kind of indicator to make blank comments stand out (#109)

For many of us, you are absolutely correct. Just thinking of just making it easier to not overlook for the users. That means less chance of me and others rejecting RARs.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/Vulnerator/Vulnerator/issues/109#issuecomment-301761699 , or mute the thread https://github.com/notifications/unsubscribe-auth/AQyCjLiAm6iWVihuhjusPXNOSjqcfMx9ks5r6ZGSgaJpZM4NNXt8 . https://github.com/notifications/beacon/AQyCjFilkUTMg_Y77GBwTpQgrWStdNRHks5r6ZGSgaJpZM4NNXt8.gif

amkuchta commented 7 years ago

@CyberSecDef @ibjohn I can definitely look into creating some coloring options... The question is, how do we want coloring done?

@Vulnerator/user-reps please feel free to weigh in!

CyberSecDef commented 7 years ago

I normally use like a yellow/orange on blank comments (normally just for remediations, mitigations and comments columns).

I would think the Status column should never be blank.....but that’s an important one so maybe make that red?

-----Original Message----- From: Alex Kuchta [mailto:notifications@github.com] Sent: Wednesday, August 09, 2017 9:45 AM To: Vulnerator/Vulnerator Cc: Weber, Robert Jr CTR NSWCDD, B0I; Mention Subject: [Non-DoD Source] Re: [Vulnerator/Vulnerator] Most SCAs reject NA and not a finding w/o comments - need some kind of indicator to make blank comments stand out (#109)

@CyberSecDef https://github.com/cybersecdef @ibjohn https://github.com/ibjohn I can definitely look into creating some coloring options... The question is, how do we want coloring done?

@Vulnerator/user-reps https://github.com/orgs/Vulnerator/teams/user-reps please feel free to weigh in!

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/Vulnerator/Vulnerator/issues/109#issuecomment-321259493 , or mute the thread https://github.com/notifications/unsubscribe-auth/AQyCjPvfnI3x_gcJSFgyZ8c1_ubnygR0ks5sWbfQgaJpZM4NNXt8 . https://github.com/notifications/beacon/AQyCjI167FouYo2RMAFrQWga06WJvmzAks5sWbfQgaJpZM4NNXt8.gif

amkuchta commented 7 years ago

@CyberSecDef I need to learn to be clearer in my conveyance of thoughts... I was thinking of highlighting Status based on the text (e.g. green for "Completed", grey for "Not Applicable", etc.). "Finding Type" would be handled in a similar fashion (i.e. "ACAS" is green, "CKL" is blue, etc.)

CyberSecDef commented 7 years ago

Gotcha. That makes sense. Doing it that way also lets you 'filter' within Excel based on color. I like it.

-----Original Message----- From: Alex Kuchta [mailto:notifications@github.com] Sent: Wednesday, August 09, 2017 10:03 AM To: Vulnerator/Vulnerator Cc: Weber, Robert Jr CTR NSWCDD, B0I; Mention Subject: [Non-DoD Source] Re: [Vulnerator/Vulnerator] Most SCAs reject NA and not a finding w/o comments - need some kind of indicator to make blank comments stand out (#109)

@CyberSecDef https://github.com/cybersecdef I need to learn to be clearer in my conveyance of thoughts... I was thinking of highlighting Status based on the text (e.g. green for "Completed", grey for "Not Applicable", etc.). "Finding Type" would be handled in a similar fashion (i.e. "ACAS" is green, "CKL" is blue, etc.)

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/Vulnerator/Vulnerator/issues/109#issuecomment-321264614 , or mute the thread https://github.com/notifications/unsubscribe-auth/AQyCjK-RNOPChHRsy5a0TXG5m7ZAnF4Xks5sWbwDgaJpZM4NNXt8 . https://github.com/notifications/beacon/AQyCjB2hchj_7wmt7b71QFb_XIM5TNSdks5sWbwDgaJpZM4NNXt8.gif

ibjohn commented 7 years ago

This is on hold. What information are you waiting on? I think your status color indicator is good.