Uploading Technology Vulnerabilities

You can upload technology vulnerability data to OpenRMF^® Professional as well. You must have the System Owner or Vulnerability Administrator permission to use this feature. To go to it, from the system package dashboard click on the Other Technologies menu and choose the Upload Vulnerability Scan Data option.

The format of the data required is at the bottom of this page for you to do any ETL or transforming of data to match. As we get more native imports available we will update the software and documentation to match.

Uploading Data

On the Upload Vulnerability Results page you specify the category type of Software, Container, Log or Other. Then drag and drop a file or click in the file area to select a valid JSON file with the results. Click the Upload File button to upload the file and process it for your system package. The data is parsed, saved, and the score for the source projects in the file are generated. Then all automation below kicks in.

OpenRMF^® Professional can natively read in .xml scan result files from Burp for software scans. And the Trivy .json output files when running a command similar to trivy image {image-name}:{tag} -f json > {filename}.json to get results in JSON format. Otherwise, you can import data directly or use the general format listed below for vulnerability data.

Automation from Uploading Data

Once the technology vulnerability data is uploaded, there are several automated actions that are started. This is the same as when you import data.

The score generated is used to update the total technology vulnerability score for all projects for the specific category of data you imported. And then the total vulnerability score across all categories and source projects is updated as well. This data will be available in seconds on the scores page for this area.

If you have a live POAM created, any updates on vulnerability data is tracked in the POAM as well. Any items that are marked as Open or Won’t Fix are set as Open in the POAM. And any items already on the POAM that are now not Open or Won’t Fix are marked as Completed automatically with the date of the import as the completed date.

Format of General Format JSON Data

The format of the data required is just below in the case of a general JSON format that OpenRMF^® Professional can universally ingest. It is a JSON format of data in an array, where each object is in essence the class structure to hold the technology vulnerability data. The list of values / enumeration information is at the bottom of the page.

[
    {
      "issueId": string,
      "severityType": severityType,
      "statusType": statusType,
      "component": string,
      "project": string,
      "source": string,
      "line": int,
      "message": string,
      "issueCreationDate": string,
      "issueUpdateDate": string,
      "organization": string,
      "resolution": resolutionType,
      "issueUrl": string,
      "categoryType": categoryType
    },
    {
        ...
    }
]

An example data payload is below for a software scan results file

[
    {
      "issueId": "AX8eLlJ1rfhk7pr0BEyg",
      "severityType": 40,
      "statusType": 20,
      "component": "Classes/MyClient.cs",
      "project": "myorg_myproject-title",
      "source": "SonarQube",
      "line": 115,
      "message": "Enable server certificate validation on this SSL/TLS connection",
      "issueCreationDate": "02/13/2022 09:49:40",
      "issueUpdateDate": "03/18/2022 13:11:59",
      "organization": "myorg",
      "resolution": "FALSE-POSITIVE",
      "issueUrl": "https://sonarcloud.io/project/issues?types=VULNERABILITY&id=myorg_myproject-title&open=AX8eLlJ1rfhk7pr0BEyg",
      "categoryType": 10
    },
    {
      "issueId": "AX8eLlJ1rfhk7pr0BEed",
      "severityType": 40,
      "statusType": 20,
      "component": "Classes/MyCLient.cs",
      "project": "myorg_myproject-title",
      "source": "SonarQube",
      "line": 169,
      "message": "Enable server certificate validation on this SSL/TLS connection",
      "issueCreationDate": "02/13/2022 09:49:40",
      "issueUpdateDate": "03/18/2022 13:11:59",
      "organization": "myorg",
      "resolution": "FALSE-POSITIVE",
      "issueUrl": "https://sonarcloud.io/project/issues?types=VULNERABILITY&id=myorg_myproject-title&open=AX8eLlJ1rfhk7pr0BEed",
      "categoryType": 10
    }    
  ]

For the categoryType field you have these options:

• Software = 10
• Container = 20
• Log = 30
• Other = 40

For the severityType field you have these options:

• Info = 10,
• Low = 20,
• Medium = 30,
• High = 40,
• Critical = 50

For the statusType field you have these options:

• Closed = 10,
• FalsePositive = 20,
• Fixed = 30,
• WontFix = 40,
• Open = 50

Specifically for the SonarQube ResolutionType, you have these options:

• Fixed
• False-Positive
• FalsePositive
• WontFix