What are the resultslevel options?

[huntantr]

Describe the bug The help does not specify what the results level options are. --resultlevels Specify the ResultLevels to report

To Reproduce Steps to reproduce the behavior:

1. Run 'asa export-collect --resultlevels'
2. See error: ERROR(S): Option 'resultlevels' has no value.

Expected behavior Help should clearly indicate what the options are for this parameter.

System Configuration (please complete the following information):

• OS: Windows 10
• OS Version: Windows 10 Pro 21H2 v19044.2846
• Application Version: v.2.3.297+8f3ee6911a
• CLI or GUI: CLI

[gfs]

Hi @huntantr,

The result levels correspond to the values of this enum

https://github.com/microsoft/AttackSurfaceAnalyzer/blob/8f3ee6911ae19650e0dc433aecddef60d7cca151/Lib/Objects/Types.cs#L54

And conceptually explained on the wiki page about authoring rules:

https://github.com/microsoft/AttackSurfaceAnalyzer/wiki/Authoring-Analysis-Rules#rule-basics-1

Hopefully that unblocks you for now, but I agree we could make it more obvious from the cli context itself.

[huntantr]

Yes that helps. That will let me move on.

I assume that NONE = 0 is the default?

Thank you.

[gfs]

@huntantr

The default level for each result type is specified in the analyses/rules configuration - either the default one or your own custom one if you choose. The default rules are intended so the lowest level most users would be interested in is INFORMATION, which contains detected changes for some object types which may be interesting even without a specific rule that applies to them, while other results that merely have changed but don't have a specific detection may be less interesting and are marked DEBUG. If specific rules apply to a change that was detected, instead of the default the level is set to the highest level among rules that applied to that change. If you look only for WARNING and up I believe you'll only get results which have a specific rule that detects something interesting - and not just the existence of a change.

I hope that helps clarify. I'm leaving this issue open to track adding this additional detail somewhere more obvious in the documentation.

https://github.com/microsoft/AttackSurfaceAnalyzer/blob/b0059c467b598d844ba5c562f6a32f33f1b72387/analyses.json#L2054-L2072

[huntantr]

If each rule has it's own default, how does the --resultlevels argument work? Does it just set the new default for all collectors?

[gfs]

If each rule has it's own default, how does the --resultlevels argument work? Does it just set the new default for all collectors?

The default levels type is object/collector type based (ie the value in default levels for "file" will be the level used for all files where no rule applies and so forth) rather tied to any specific rule, and is defined once per rule set.

ASA Analysis has two steps:

1. Determine what has changed
2. Check the rule logic against anything that has changed

The default levels apply to anything detected from the first step that doesn't match any rules from the second.

Then, the results which will be output to the user are filtered using the ResultLevels argument (when set) to export to the user only findings which match the specified levels they requested.

[huntantr]

Thanks for clarifying.

[gfs]

I believe this is resolved but reach back out if you still have any issues.

[gfs]

The options available for result levels are also defined here in the wiki: https://github.com/microsoft/AttackSurfaceAnalyzer/wiki/Authoring-Analysis-Rules#flags-1