Filter vulnerabilities

Once you enable Application Security and you see the list of vulnerabilities appear on the Vulnerabilities page, there are several ways you can organize them for easy management and to prioritize problems:

  • You can filter vulnerabilities by vulnerability details, global timeframe, and management zone. You can combine any of these filters.
  • You can mute (silence) vulnerabilities that you don't consider important.
  • You can filter vulnerabilities by recommended fixes.

See below for details.

Filter by vulnerability details

On the Vulnerabilities page, you can filter the vulnerabilities table by the following:

  • Risk assessment (Public internet exposure, Sensitive data affected, Public exploit available)

  • Risk level (Critical, High, Medium, Low, None)

  • Snyk/CVE ID (if you filter by the Snyk ID or CVE ID, it must be a perfect match)

  • Status (Open, Resolved, Muted)

  • Technology (Kubernetes, Node.js,Java, .NET, PHP)

  • Vulnerable component (part of the vulnerable component name)

  • Vulnerability ID (select a vulnerability based on the 'S' string that represents its ID)

  • Affected or related entity (select and enter any combination of the following: Process group name, Host name, Kubernetes workload name, Kubernetes cluster name, Tag)

    Notes:

    • You can't add an entity more than once.
    • For Tag, you can use tags on host, process group, and process group instance, with the syntax key:value or key.
    • If a security problem affects more than 5,000 processes, the Affected or related entity filter may not be able to find all security problems impacted by the entered entity.

Filter by global timeframe

You can use the global timeframe selector to filter vulnerabilities on the Vulnerabilities page and on the vulnerability details page.

  • The Vulnerabilities page displays vulnerabilities that were open within the selected global timeframe. However, the data displayed about an entry reflects the current state of the entry, not the historical state.
  • The vulnerability details page displays entities that were affected and libraries that were vulnerable during the selected global timeframe. An affected entity or a vulnerable component is shown:
    • If it was already affected or vulnerable during the selected timeframe
    • If it's still affected or vulnerable

Filter by management zone

You can use the management zones filter on the Vulnerabilities page and on the vulnerabilities details page. Note that for each case, the filter applies to different components:

  • On the Vulnerabilities page, filtering by management zone applies to vulnerabilities. The management zone filter doesn't affect the other vulnerability fields, such as Public internet exposure or Sensitive data affected; other than Vulnerability, all values on this page are based on the whole environment.
  • On the vulnerability details page, filtering by management zone applies to vulnerable components and affected entities (processes, process groups, hosts, services, etc.). The management zone filter doesn't affect the majority of data on the infographic; other than Affected entities, all values on this page are based on the whole environment.

Note:

  • When a vulnerability stops affecting a management zone, it won't show up when you filter for that management zone.
  • When a vulnerability is resolved (when it has stopped affecting the whole environment), it shows up regardless of the selected management zone.

For more information on how to set up and apply management zones, and about the rules that define and limit the entities that can be accessed within a management zone, see Management zones.

Management zone calculation is based on processes (process group instances). Management zones are calculated when a vulnerability is opened and every 15 minutes after that until the vulnerability is resolved. A management zone is affected by a vulnerability if a process (process group instance) of the management zone uses a software component that has the reported vulnerability.

Mute vulnerabilities

If you determine that a vulnerability isn't serious and you want to filter it out from the list of vulnerability, you can mute (silence) it. Dynatrace analyzes muted vulnerabilities periodically, but you can filter them out by Open or Resolved status.

To mute a vulnerability

  1. Go to the details page of the vulnerability and select Mute problem in the upper-right corner.
  2. Select a reason for muting the vulnerability and, optionally, provide additional information.
  3. Select Save.

Note: You need to wait up to a minute for the change to take effect. Refresh the page to see your change.

Muted problems don't appear on the list of vulnerabilities unless you filter for them.

The status change of the vulnerability is logged under the Problem evolution section of the vulnerability details page. Select Details to see who muted the vulnerability, the reason for muting, and any additional comments. Note that Problem evolution shows only the last five events that occurred within the last 30 days.

You can unmute a vulnerability by selecting Unmute problem on the details page of the respective vulnerability. Unmuting a vulnerability makes it active again—its status changes back to Open.

Note: You won't be able to mute/unmute a vulnerability if

  • Muting/unmuting is already in progress
  • Required permissions are missing
  • The vulnerability status is Resolved
  • The vulnerability status is Muted - Resolved

Hover over Mute problem/Unmute problem to see why muting/unmuting isn't possible.

To calculate recommended fixes, Davis Security Advisor takes into consideration all vulnerabilities that are currently open. Fixes are tailored to your environment and ranked based on how much they improve the overall security of your environment.

To filter by recommended fixes, on the Vulnerabilities page, select an upgrade and then select Add as filter.

  • After adding a recommended fix as a filter, you can extend filtering by vulnerability details.
  • You can add multiple filters for recommended fixes all at once. In this case, you will get a cumulated list of vulnerabilities based on the selected fixes.
  • If you use the management zones filter, you'll get a list of vulnerabilities that affect the selected management zone.

Note: You won't receive recommendations for

  • Muted vulnerabilities
  • Vulnerabilities filtered by the global filter in a past timeframe
  • Resolved vulnerabilities