NM257998 (Community Member) asked a question.
Our goal is that we are trying to identify which specific vulnerabilities require mitigation to adhere to our company policy within the Veracode platform.
Ideally in the Triage Flaws report if there was another column to identify if it failed the policy assigned to the application – it would provide quick visibility to the engineer to identify that even though it’s a Low Severity issue, it doesn’t adhere to our policy and should be resolved.
What is required instead, is that we have to flip over Entire Report View, click on the Policy Control. Scroll down to the Policy Standards section, make note of the Flaw count by the title of issue and cross reference that list back to the Low’s that were identified in the Triage Flaw.
Use case: Our company allows more time for fix low severity flaws, but if it is violates the policy then it has to be fixed before the time allotted to the normal low severity flaws. So the software engineer should be able to identify those flaws easily in the Triage Flaws section or some where else!
.png){kind=logo}
Hello @NM257998 (Community Member) ,
In the Triage Flaw viewer, there is a way to see if a flaw violates the policy. If there is a red shield with an X through it, then it violates the policy and if there isn't one, it doesn't violate policy (see screenshot).
Also, there is a filter on the Triage Flaws page called "Fix for Policy" that will limit the flaws to only those currently violating the policy, so it won't show mitigated flaws that are already accepted. Lastly, you can always customize and export a report that includes all this information and we have a Help Center article on it here: https://help.veracode.com/r/t_download_custom_report
If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.
Jason
Veracode Support Engineer