Creating a Host Finding Manually
Summary: How to create a host finding manually within the platform
The platform allows you to manually create a finding either from the Host Findings page or the Hosts page. Before you proceed, make sure that you complete the following tasks:
- Make sure you have access to a custom Host scanner. For more information on how to create one, visit Creating a Scanner from the Scanners Page.
- Make sure you have access to an unlocked assessment.
Creating a Finding from the Host Findings Page
Open up the Actions menu and select Create Finding.
To begin, enter the names of your scanner and unlocked assessment.
On the next step, you can select up to 25 hosts to associate with the new vulnerability. At the top, you can search assets by common host identifiers like IP Address and Host Name or scanner-specific fields.
To add a host to the list of Hosts Selected, check the box next to a host.
The table has a configurable column at the end. You can configure that column to show an additional field if you need more information to distinguish between hosts.
Once you have finished with selecting hosts, move on to entering finding properties. At minimum, you must fill out the fields Title, Severity, and Source ID (scanner plugin). You can also provide an optional description.
The scanner plugin for the finding will be a combination of the scanner UUID and the source ID that you provide. If you place any spaces in the source ID, the system will replace them with hyphens.
In the final step, you can fill out optional fields. The available sections include
- Plugin Output: This section allows you to enter a possible solution for the vulnerability or add additional scanner output.
- Vulnerabilities: In this section, you can enter CVEs associated with this plugin as a comma-delimited list.
- Finding Details: In this section, you can provide the First Discovered On and Last Discovered On dates for the finding as well as the service and port with which the scanner has associated with the vulnerability. Note that if you provide the service name, you must also provide the port number.
Click CREATE HOST FINDING to submit. After all jobs finish, you will be able to see the new host finding in the list view.
Creating a Host Finding from the Hosts Page
If you need to choose more than 25 hosts or prefer to have access to all host filters, you can also create a finding on the Hosts page. You can assign the new finding to up to 1000 hosts.
Select assets by checking the boxes on the left or by using the Select All option in the header row.
Go to the Actions menu and select Create Finding.
You will see the count of assets that you have selected at the top of the form. Since you have already selected assets, you will skip the step of selecting assets within the dialogue.
