Greater flexibility in risk/asset correlation

[praetorian-peter-mueller]

When creating a risk, one must associate that risk with a specific asset. Assets are apparently an IP:port combination. This is overly limiting. I request support for more kinds of assets, or for creating risks not associated with any particular asset.

For example, sometimes risks are not associated with an IP:port combination, but rather with one of the following things:

• GitHub repositories
• Source code files
• AWS accounts
• A named DLL
• A named BLE attribute
• A firmware image
• An API endpoint

Rather than adding support for an indefinite number of kinds of assets, I think some kind of flexibility in asset kind is the right idea.

[privateducky]

This is in scope for our direction.

[privateducky]

This is now solved; you can create risks that are associated to 'assets' which are loosely defined (by a simple label).

You can try this out using the 'create manual risk' option in the UI.