Release 1.16
September 25, 2024
What's New?
Create Widget from Query Option in Data List Tabs
Earlier, the option to create a widget from a query added to the data list tabs - Create Widget from Query- was available only in the Web Applications and Detections tab.
With this release, the Create Widget from Query option is available in the Scan List, Reports, and Schedules tab in Scans and Reports.
When you add a query and click Create Widget from Query, you are navigated to the widget creation workflow, where you can select a widget name and other settings.
Create New Option Profile in Web Application Workflow
With this release, you can create a new option profile while creating or editing the web application.
Certificate Data in Web Application Details
With this release, Web Application Scanning displays the certificate data generated during the SSL scan from WAS scan normalization. The certificate information processed by Certificate View is displayed in the Certificate tab in the Application Details.
If you click the certificate link, the certificate details page contains all the details related to the certificate, such as its validity, issued to, issued by, fingerprints, hosts, certificate path, and so on. You can also search through the list of certificates using QQL tokens in the Certificate View. For the token help, refer to Certificate View Online Help.
Purge Detections
With this release, you can remove the selected detections without losing the scan history. This is useful in scenarios where redundant links are added and you want to remove duplicate findings against URLs with redundant links.
The Purge option is available in the Quick Actions and Actions menu for purging single and multiple detections.
New Fields in Detection Details
With this release, the following new fields are available in the detection details:
CVSS V3 Vector String
CISA Added Date
CISA Due Date
New Tokens
The following new tokens are added to the Detections tab.
Token | Description |
---|---|
vulnerability.cisaKnownExploits. cisaKEVAddedDate |
Use this token to search detections based on the date when CISA known exploitable vulnerability is added. The date is added in the YYYY-MM-DD format. |
vulnerability.cisaKnownExploits. cisaKEVDueDate |
Use this token to search for detections based on the due date for CISA known exploitable vulnerability. The date is added in the YYYY-MM-DD format. |
The following new tokens are added to the Knowledge Base tab.
Token | Description |
---|---|
vulnDef.type | Use this token to search for QIDs that match the selected vulnerability type—INFORMATION GATHERED, POTENTIAL_VULNERABILITY, CONFIRMED_VULNERABILITY, POTENTIAL_CONFIRMED_VULNERABILITY, SENSITIVE_CONTENT. |
vulnDef.discoveryType | Use this token to search for QIDs with the selected discovery type with which the finding is detected. Discovery types—AUTHENTICATED, REMOTE, and REMOTE_AUTHENTICATED. |
vulnDef.authenticationType | Use this token to search for QIDs with the selected authentication type—DB2, FORM, HTTP_BASIC, ORACLE, SNMP, UNIX, VMWARE, WINDOWS. |
vulnDef.malware.name | Use this token to search for QIDs associated with the specified malware. |
vulnDef.malware.aliases | Use this token to search for QIDs associated with the specified malware aliases. |
vulnDef.malware.type | Use this token to search for QIDs associated with the specified malware type. |
vulnDef.malware.platform | Use this token to search for QIDs associated with the specified malware platform. |
vulnDef.malware.vendor | Use this token to search for QIDs associated with the specified malware vendor. |
vulnDef.exploitAvailable | Use this token to search for QIDs with the known exploits available for the vulnerability. |
vulnDef.malwareAvailable | Use this token to search for QIDs with the known malware available for the vulnerability. |
vulnDef.cvss3Info.attackVector | Use this token to search for QIDs with specified CVSS3 attack vector—NOT_DEFINED, NETWORK, ADJACENT_NETWORK, LOCAL_ACCESS, PHYSICAL_ACCESS |
vulnDef.complianceTypes | Use this token to search for QIDs with the specified compliance type—HIPAA, GLBA, COBIT, SOX, or PCI. |
vulnDefcomplianceSection | Use this token to search for QIDs with specified compliance section. |
vulnDef.complianceDescription | Use this token to search for QIDs for which the compliance description matches the specified description. |
vulnDef.owaspTopTen.code | Use this token to search for QIDs matching the OWASP Top Ten code—A01-A10. |
vulnDef.owaspApiTopTen.code | Use this token to search for QIDs matching the OWASP API Top Ten code—API01 - API10. |
vulnDef.listInclusion | Use this token to search for QIDs in the specified list—QUALYS_EXT_10, QUALYS_INT_10, SANS_20. |
vulnDef.bugtraqIds | Use this token to search for QIDs with the specified Bugtraq ID. |
Renamed the Severity Filter to Security Type
Earlier, the Severity filter in the left pane of the Web Applications tab displayed a value of 0 and listed the web applications that are not scanned or scanned with no detections.
With this release, the Severity filter is renamed to By Security Risk to display the web application data correctly.
Issues Addressed
The following reported and notable customer issues have been fixed in this release.
Category/Component | Issue Description |
Scan Schedule Start Date |
We have fixed an issue where the Start Date is displayed in a format different than the date format in the user profile settings. This was observed while scheduling a scan. |
Web Application Creation |
An issue was observed while creating a web application having a long URL with a slash (/), and the crawl scope was set to Limit to URL hostname and specified sub-domain; when the user tried to add a subdomain value, the application stopped responding. The issue is resolved now. |
Scanner Appliance |
An issue was observed where, in the scheduled multi-scans, some web applications were scanned with external scanners even though the user had selected the tag for the internal scanner pool in the Scanner Appliance. This resulted in scan failure. This issue is resolved, and all the web applications are mapped to the scanner pool. |
Web Application Import |
We have fixed an issue the user faced while importing a web application using a .txt file. |
Crawl Settings |
We have fixed an issue where the domain description message displayed multiple domain names. Now, the description message contains only the first domain name. |
Reports |
An issue was observed where a sub user could not generate a web application report and scan report. This issue was observed when create, edit, and delete report permissions were assigned to the sub-user; however, the user was not assigned read report permission. The issue is resolved now. Now, the sub-user with create, edit, and delete report permissions can create a web application and scan reports even when the read report permission is not assigned. |
Scan Report Download |
When downloading the scan reports, an issue was observed: The scan report generation encountered an error due to corrupted data. The issue is resolved now. |
Web Applications, EASM-related tag |
We have fixed an issue where the user encountered an issue while editing web applications with the EASM Confidence Medium or EASM Confidence High tags assigned. The issue is resolved now. |
Crawl Scope, Web Application Creation |
Earlier, while creating a web application, the user could not enter URLs to the Explicit URLs to Crawl field when the Crawl Scope was set to Limit to Content Located at or below URL subdirectory. The issue is resolved, and the user can add an explicit URL using a subdomain while creating a web application. |
Detection Status |
An issue was observed where the status of the finding did not change to Fixed even though the setting to close the finding when the URL could not be found was done. The issue is resolved now. |
Dashboard Widgets |
The user encountered issues while editing the TruRisk-related widgets in the dashboard created in the Web Application Scanning version earlier to 1.15. For example, if the user added a detection query, no data was displayed upon saving the query. If the users deleted the detection query and tried to add the application query, the Detection Query field was added. These issues are resolved now, and the user can edit the dashboard widgets related to the TruRisk™ score. |