Backlog and Context Engine

Overview

The Backlog page centralizes all security findings, allowing teams to efficiently search, filter, and export critical data, ensuring streamlined management and resolution of findings.

Each finding in the backlog has the following properties:

Understanding the finding's priority and the 'Context Engine'

Why do we need a context engine?

In vulnerability management, context is key. While the CVSS severity score measures the inherent risk of a vulnerability, it doesn't account for the environment in which the vulnerability exists. For example, a high CVSS score might be less critical if it affects a non-critical part of your infrastructure. In contrast, a medium CVSS score could be more urgent if it impacts a business-critical system. The Context Engine enhances prioritization by factoring in both the likelihood of exploitation and the potential impact within your specific environment. This ensures that security efforts focus on the most significant risks, not just those with the highest severity scores.

"How the Context Engine Maps, Prioritizes, and Scores Findings."

1. Resource Connection Mapping:

The Context Engine identifies all resources linked to a particular finding. Starting with the resource where the finding was detected, the engine maps out all connected resources that could influence the exposure of the initial resource. For example, a finding related to a GitHub repository might reveal connections to a Lambda function, which in turn is connected to an internet-facing API.

This mapping can be visualized in the context engine graph:

2. Priority Factor Generation and Propagation:

Priority Factors are criteria the Context Engine uses to rank the importance of security findings based on the characteristics of affected resources, such as being in a production environment or involving sensitive credentials. These factors are assigned to findings and propagate through connected resources. For example, if an API marked as internet-facing is connected to a Lambda function and a repository, both the Lambda function and the repository inherit the "internet-facing" Priority Factor, ensuring consistent prioritization across the system.

Examples of Priority Factors include:

• Business-critical Service
• Database Access
• Production Environment
• Sensitive Credentials
• Internet-facing

These factors are visible as labels on the resources in the context engine graph:

3. Priority calculation:

Each Priority Factor in the Context Engine has a specific weight based on its significance. When a security finding is identified, its overall score is calculated by summing the weights of all relevant Priority Factors. This score reflects the criticality of the finding, taking into account the context provided by these factors. For instance, a finding with Priority Factors like "Production Environment" and "Critical Severity" would score higher than one with less critical factors, effectively guiding the prioritization process.

Viewing finding details and the context engine graph

It is possible to take a more in-depth look at the contents of a finding than what is visible from the table.

To view the details of a specific finding
Select the individual finding you wish to view. Details are displayed in a panel on the far right side of the page.

Finding Details Overview

The finding details contain additional information about the finding, such as:

• Security Tool - The security tool that detected the finding.
• Finding Description - A short explanation about the finding was found.
• Context graph - The Finding Graph visually represents how a specific security finding is connected to other elements within your environment, such as repositories, cloud services, and APIs. This graph illustrates the relationships between a finding, its related resources, and the broader infrastructure, providing a clear view of potential security implications.

Filtering and custom views

You can filter the findings list by selecting parameters in the widgets at the top of the page or by modifying the applied filters list by selecting filter options from the Add Filter + drop-down. Select Clear Filter to return to the complete list of findings. Use custom views to save discrete combinations of filter parameters for clear, consistent monitoring of your organization's security stance. Custom views are also used to determine which findings appear in Slack. The default custom view displays whenever you navigate to the backlog page after logging in to a new session.

To create a custom view—

1. Use the Add Filter + button to select the filters you wish to include in this view.
2. Select the Save button.
3. Enter a Name and Description for this filter. If you wish to receive Slack notifications of findings that are visible in this custom view, select the Get real-time notifications checkbox.
4. Select Create.

To edit a custom view—

1. From the Choose view dropdown, select the custom view you wish to modify.
2. Select the menu icon adjacent to the custom view name.
3. Select Edit.
4. Modify the fields as needed.
5. Select Save.

To designate a default custom view—

1. From the Choose view dropdown, select the custom view you wish to modify.
2. Select the menu icon adjacent to the custom view name.
3. Select Set as default.

Changing finding status

Jit enables you to set findings to either open or ignore for easy management within your organization. To change the status of a finding, use the drop-down under the status column for the finding you wish to update.

Creating tickets

To create tickets for findings, you must first integrate Jit with your ticket management system. For instructions, see Integrating with Third-Party Products and Services.

To create a JIRA issue—

1. Use the check boxes to select the findings you want to include in the issue.
2. At the bottom of the UI, select Create JIRA Issue.

To create a Shortcut story—

1. Use the check boxes to select the findings you want to include in the story.
2. At the bottom of the UI, select Create Shortcut Story.

To create a Linear issue—

1. Use the check boxes to select the findings you want to include in the story.
2. At the bottom of the UI, select Create Linear Issue.

Copying finding data to the clipboard

From the findings detail panel, select the copy icon (located to the right of the Status dropdown) to copy the contents of this panel to the clipboard.

📘

Note:

Finding status can also be changed from within the findings detail panel.

Exporting finding data

Jit enables you to export your finding data as a CSV file. To do this, select the Export CSV button in the top right corner of the page to begin the download.