Filter or mute third-party vulnerabilities

Once you enable Application Security and you see the list of third-party vulnerabilities appear on the Third-party vulnerabilities page, there are several ways you can organize them for easy management and to prioritize problems:

• You can filter vulnerabilities by

  • Recommended fixes
  • Vulnerability details, global timeframe, and management zone (you can combine any of these filters)

• You can mute (silence) vulnerabilities that are

  • Open, if you don't consider them important
  • Resolved, if you don't want to deal with them if they get reopened

See below for details.

Filter by vulnerability details

The following filters are available:

• Risk assessment: Public internet exposure, Reachable data assets, Public exploit available, Vulnerable functions in use , Reduced accuracy (infra-only).

  Note: Reduced accuracy (infra-only) filters for vulnerabilities which have related hosts running in Infrastructure Monitoring mode. For details, see Monitoring modes.

• Risk level: Critical, High, Medium, Low, None

• Snyk/CVE ID: If you filter by the Snyk ID or CVE ID, it must be a perfect match

• Status: Open, Resolved, Muted

• Technology: Kubernetes, Node.js,Java, .NET, PHP, Go

• Technology runtimes: Displays only library-based (only vulnerable libraries) or runtime-based (only vulnerable runtimes) vulnerabilities.

• Vulnerable component: Part of the vulnerable component name

• Vulnerability ID: Select a vulnerability based on the 'S' string that represents its ID

• Affected or related entity: Select and enter any combination of the following: Process group name, Host name, Kubernetes workload name, Kubernetes cluster name, Tag

  Notes:

  • You can't add an entity more than once.
  • For Tag, you can use tags on a host, process, and process group, with the syntax key:value or key. For more information about tagging, see Define and apply tags.
  • If a vulnerability affects more than 5,000 processes, the Affected or related entity filter may not be able to find all vulnerabilities impacted by the entered entity.

Filter by global timeframe

You can use the global timeframe selector to filter third-party vulnerabilities on the following pages:

• On the Third-party vulnerabilities page, it displays vulnerabilities that were open within the selected global timeframe. However, the data displayed about an entry reflects the current status of the entry, not the historical status.

• On the vulnerability details page, it displays entities that were affected and libraries that were vulnerable during the selected global timeframe. An affected entity or a vulnerable component is shown:

  • If it was already affected or vulnerable during the selected timeframe
  • If it's still affected or vulnerable

Filter by management zone

You can use the management zones filter on the following pages. Note that for each case, the filter applies to different components:

• On the Third-party vulnerabilities page, filtering by management zone applies to third-party vulnerabilities. The management zone filter doesn't affect the other vulnerability fields, such as Public internet exposure or Reachable data assets; other than Vulnerability, all values on this page are based on the whole environment.
• On the vulnerability details page, filtering by management zone applies to vulnerable components and affected entities (processes, process groups, hosts, services, etc.). The management zone filter doesn't affect the majority of data on the infographic; other than Affected entities, all values on this page are based on the whole environment.

Note:

• When a vulnerability stops affecting a management zone, it won't show up when you filter for that management zone.
• When a vulnerability is resolved (when it has stopped affecting the whole environment), it shows up regardless of the selected management zone.

For more information on how to set up and apply management zones, and about the rules that define and limit the entities that can be accessed within a management zone, see Management zones.

Management zone calculation is based on processes. Management zones are calculated when a vulnerability is opened and every 15 minutes after that until the vulnerability is resolved. A management zone is affected by a vulnerability if a process of the management zone uses a software component that has the reported vulnerability.

Mute vulnerabilities

There are two ways to mute a vulnerability:

Option 1: On the Third-party vulnerabilities page

1. Select expand for the vulnerability that you want to mute, then select Change status.
2. Under Select new status, select the status and reason for muting from the dropdown menu.
3. Optionally, provide additional information.
4. Select Save.

Option 2: On the details page of the third-party vulnerability

1. Select Mute problem in the upper-right corner.
2. Select a reason for muting the vulnerability and, optionally, provide additional information.
3. Select Save.

Note: You need to wait up to a minute for the change to take effect. Refresh the page to see your change.

Muted problems don't appear on the list of vulnerabilities unless you filter for them.

The status change of the vulnerability is logged under the Vulnerability evolution section of the vulnerability details page. Select Details to see who muted the vulnerability, the reason for muting, and any additional comments. Note that Vulnerability evolution shows only the last five events that occurred within the last 30 days.

You can unmute a vulnerability by selecting Unmute problem

• On the Third-party vulnerabilities overview page, in the details section of the respective vulnerability.
• On the details page of the respective vulnerability.

Note that

• Unmuting an open vulnerability makes it active again—its status changes back to Open, and the vulnerability shows up again in the list of vulnerabilities when you filter for Open vulnerabilities.
• Unmuting a resolved vulnerability changes its status back to Resolved, and the vulnerability shows up again in the list of vulnerabilities when you filter for Resolved vulnerabilities.

Note: You won't be able to mute/unmute a vulnerability if

• Muting/unmuting is already in progress
• Required permissions are missing

Hover over Mute problem/Unmute problem to see why muting/unmuting isn't possible.

Filter by recommended fixes with Davis Security Advisor

To filter by recommended fixes, on the Third-party vulnerabilities page, select an upgrade and then select Add as filter.

• After adding a recommended fix as a filter, you can extend filtering by vulnerability details.
• You can add multiple filters for recommended fixes all at once. In this case, you will get a cumulated list of vulnerabilities based on the selected fixes.
• If you use the management zones filter, you'll get a list of third-party vulnerabilities that affect the selected management zone.

Note: You won't receive recommendations for

• Muted vulnerabilities
• Vulnerabilities filtered by the global filter in a past timeframe
• Resolved vulnerabilities

For more information about Davis Security Advisor, see Davis Security Advisor calculations.