Viewing issues in Invicti Enterprise

TIP: You can also view issues using the Issues API Endpoints, enabling you to easily integrate with other applications or internal systems.

Page/

Sub-menu

Description

To Do

This page displays a list of all the issues that have been assigned to you. You can take action by fixing them, assigning them to someone else, or changing their status.

Waiting for Retest

This page displays a list of all the issues with the status Fixed (Unconfirmed). They are waiting to be tested automatically by Invicti Enterprise.

Addressed Issues

This page displays a list of all the issues that have been addressed and whose status has been updated to one of the following:

• Accepted Risk: This indicates that the issue has been considered and marked as a low risk vulnerability.
• False Positive: This indicates that the issue has been considered and marked as not a genuine vulnerability.
• Fixed (Confirmed): This indicates that the issue has been fixed, and Invicti Enterprise has confirmed that the vulnerability is no longer present; therefore, it requires no further action.

All Issues

This page displays a list of all issues detected in scans run by your entire team. The entire team can view all issues in a scan report, even if they only have the Manage Issues (Restricted) permission.

Column name

Description

Title

This is the name of the vulnerability, for example Insecure Frame (External).

Click on an issue title to view more detailed information about the vulnerability.

Some issues are grouped, meaning they are reported only once per target. In these cases, a message is displayed when you click through to the issue details page.

Severity

This is the vulnerability severity level. The options are:

• Critical
• High
• Medium
• Low
• Information
• Best Practice

For more information, refer to Vulnerability Severity Levels.

Target Group

This is the name of the target group that the scanned target belongs to.

Target

This is the name of the scanned target website.

URL/File

This is the URL or file path of the detected issue.

First Seen

This is the date and time the issue was first detected.

Last Seen

This is when the issue was most recently detected.

Tags

These are labels you can apply to group issues together or give additional context.

For more information, refer to Tagging issues in Invicti Enterprise.

Assignee

This is the name of the person who has been assigned to the issues. It may be:

• The technical contact for the scanned target website
• The team member who initiated the scan
• Any other member of the team

Retestable

This indicates whether the issue can be retested. For more information, refer to Managing Issues.

Source Type

This is the scan type that detected the vulnerability. For example, Invicti DAST, or Mend SAST.

Status

This indicates the current status of the issue. All issues are initially marked as Present. The status options are:

• Present: This indicates that the issue has been detected.
• Accepted Risk: This indicates that the issue has been considered and marked as a low risk vulnerability.
• False Positive: This indicates that the issue has been considered and marked as not a genuine vulnerability.
• Fixed (Unconfirmed): This indicates that the issue has been fixed but not confirmed by Invicti Enterprise.
• Fixed (Confirmed): This indicates that the issue has been fixed, and Invicti Enterprise has confirmed it is no longer present; therefore, it requires no further action.
• Fixed (Can't Retest): This indicates that the issue has been found, but Invicti Enterprise cannot retest to confirm whether it has been fixed.
• Ignored: This indicates that the issue was marked as ignored by a user. In Invicti Enterprise, to ignore an issue, you update its status as "accepted risk".
• Revived: This indicates that the issue had been fixed in previous scans but is now present again.
• Scanning: This indicates that Invicti Enterprise is currently scanning the vulnerability.