One finding, one row.
Seven scanners describe problems seven different ways. Aegis turns each report into the same record, recognizes the same problem when it shows up again, and keeps track of whether it is still there.
What a finding stores
The same fields for every scanner, whether the finding is a line of code, a dependency, a secret, or a misconfigured resource.
| Field | What it holds |
|---|---|
scanner, rule_id | Which scanner reported it, and that scanner's own rule identifier. |
severity | CRITICAL, HIGH, MEDIUM, LOW, or INFO, after the scanner's native level is mapped. |
cwe, cve | CWE identifiers when the scanner or Aegis's mapping supplies them, and the CVE for a dependency finding. |
file_path, line_start, line_end | Where in the scanned directory the finding sits. |
code_context, message, remediation, references | The code excerpt, what the scanner said, fix guidance when there is any, and links. |
dedup_hash | The content hash that makes the finding one row no matter how many scans see it. |
status | open, accepted, suppressed, or fixed. |
first_seen_at, last_seen_at, fixed_at | When scans first saw it, last saw it, and stopped seeing it. |
Scanning the same code twice makes no new rows
A finding's identity is a hash of the scanner, the rule, the file path, the code excerpt, and the severity. Whitespace in the excerpt is normalized before hashing, so reformatting a file does not create a new finding. When a scan sees a finding that already exists, Aegis updates when it was last seen and leaves the rest alone.
sha256(scanner | rule_id | file_path | normalized_code_context | severity)From open to fixed, and back
A finding's status follows what the scans see.
Open
A scan sees a problem it has not seen before, and Aegis records it as open.
Accepted or suppressed
Someone sets the status through the API. Later scans leave it as it is.
Fixed
A later scan, in which the finding's scanner completed, no longer sees an open finding, so it becomes fixed and gets a fixed time.
Reopened
If a fixed finding shows up again, it goes back to open and the fixed time is cleared.
Every status change leaves an event
Setting a finding's status through the API writes a finding event with the previous status, the new status, and the time. Events are only added, never edited. Who made the change is not recorded yet, and it is on the Coming list on the home page.
Questions about this tool?
Write to Renkara Media Group and a person will answer.