diff --git a/src/content/docs/vulnerability-management/change-vulnerability-status.mdx b/src/content/docs/vulnerability-management/change-vulnerability-status.mdx new file mode 100644 index 00000000000..c7fd1b0c794 --- /dev/null +++ b/src/content/docs/vulnerability-management/change-vulnerability-status.mdx @@ -0,0 +1,202 @@ +--- +title: Change vulnerability status +metaDescription: Use Vulnerability Management to overcome blindspots and assign remediation to developers as a security team. +freshnessValidatedDate: never +--- + +import vmIgnoreEntityVulnList from 'images/security_screenshot-ignore-entity-vulnlist.webp' + +import vmIgnoreEntityDetails from 'images/security_screenshot-ignore-entity-details.webp' + +import vmIgnoreEntityForm from 'images/security_screenshot-ignore-entity-form.webp' + +import vmIgnoreBulkVulnList from 'images/security_screenshot-ignore-bulk-vulnlist.webp' + +import vmIgnoreBulkDetails from 'images/security_screenshot-ignore-bulk-details.webp' + +import vmIgnoreBulkForm from 'images/security_screenshot-ignore-bulk-form.webp' + +import vmAffectedEntityVulnList from 'images/security_screenshot-affected-entity-vulnlist.webp' + +import vmAffectedEntityDetails from 'images/security_screenshot-affected-entity-details.webp' + +import vmAffectedEntityFiltered from 'images/security_screenshot-affected-entity-filtered.webp' + +import vmAffectedEntityForm from 'images/security_screenshot-affected-entity-form.webp' + +import vmAffectedBulkVulnList from 'images/security_screenshot-affected-bulk-vulnlist.webp' + +import vmAffectedBulkSelection from 'images/security_screenshot-affected-bulk-selection.webp' + +import vmAffectedBulkDetails from 'images/security_screenshot-affected-bulk-details.webp' + +import vmAffectedBulkForm from 'images/security_screenshot-affected-bulk-form.webp' + +New Relic Vulnerability Management may detect an overwhelming amount of vulnerabilities across your system. Most of these vulnerabilities may need remediation, but many might be low risk, or have limited external exposure. You can manage your vulnerabilities by: + +* Assigning individual entities the `Ignored` status so their vulnerabilities no longer appear in Vulnerability Management +* Ignoring a certain kind of vulnerability in bulk so it no longer appears across multiple entities +* Removing the `Ignored` status at a later date if you want to detect those vulnerabilities again + +## Ignore a vulnerability [#ignore-vulnerability] + +You can manually ignore vulnerabilities on a per entity basis. Once you set the status of an instance to `Ignored`, we’ll exclude this instance from the summary tiles and vulnerability list by default. Other instances of this vulnerability on other entities will still keep the `Affected` status. + + + + +1. Go to **[one.newrelic.com](https://one.newrelic.com/) > All entities > (select your entity) > Vulnerability Management** > Click the **Vulnerabilities** tab, then select the vulnerability you want to ignore. If you don't see the vulnerability you want to manage, it might already have the `Ignored` status. + + An image showing the scoped vulnerabilities tab of Vulnerability Management + +1. To update the status to `Ignored`, click the **Change to ignored** button. + + An image showing the change to ignored button on vulnerability instance details page + +1. Fill out the form to explain the reasoning behind ignoring this vulnerability. Include a time period that the vulnerability should be ignored. + + An image showing the ignore form on vulnerability instance details page + + + + +1. Go to **[one.newrelic.com](https://one.newrelic.com/) > All capabilities > Vulnerability Management** > Click the **Vulnerabilities** tab, then choose the vulnerability you want to ignore. By default, this vulnerability view filters To vulnerabilities where at least one entity is marked `Affected`. + + An image showing the all entities vulnerabilities tab of Vulnerability Management + +1. Referring to **Area of Impact**, select each entity you want to ignore, then click the **Change to ignored** button. + + An image showing the selection of specific entities + +1. Fill out the form to explain the reasoning behind ignoring th is vulnerability. Include a time period that the vulnerability should be ignored. + + An image showing the ignore form on vulnerability instance details page + + + +## Change Ignored status to Affected [#bulk-manage] + +It's good practice to review ignored vulnerabilities and validate whether they should stay ignored. Changing the status from Ignored to Affected reintroduces the vulnerability back into default views and counts on this entity, but other instances of this vulnerability on other entities will still remain ignored. + + + + +1. Go to **[one.newrelic.com](https://one.newrelic.com/) > All entities > (select the entity you want to update) > Vulnerability Management** > Click the **Vulnerabilities** tab. +1. Update the filter from `Status = Affected` to `Status = Ignored`. This updates the default `Affected` view to instead display all the ignored vulnerabilities. + + An image showing the scoped vulnerabilities tab of Vulnerability Management with filter tab open + +1. Choose the vulnerability that you want to update, then click **Change to affected**. + + An image showing the scoped vulnerabilities tab of Vulnerability Management filtered to only ignored instances + +1. Fill out the form to explain the reasoning behind changing this vulnerability to `Affected`. + + An image showing the affected form on vulnerability instance details page + + + + +1. Go to **[one.newrelic.com](https://one.newrelic.com/) > All capabilities > Vulnerability Management** > Click the **Vulnerabilities** tab +1. From the settings cog, click the **Ignored** checkbox. This adds an ignore column to your vulnerability table. + + An image showing the all entities vulnerabilities tab with an ignore column added + +1. Select a vulnerability with an **Ignored** count greater than 0. +1. Update the filter from `Status = Affected` to `Status = Ignored`. + + An image showing the vulnerability details page with the status dropdown open + +1. In the **Area of Impact** section, select the entities you want to mark `Affected`. + + An image showing the vulnerability details page with affected instances selected + +1. Fill out the form to explain the reasoning behind changing this vulnerability to `Affected`. + + An image showing the vulnerability details page with form to change instances to affected + + + + +## Surface vulnerabilities assigned `Ignored` [#surface-vulnerabilities] + +Before you assign `Ignored` to a vulnerability or entity, it's important to understand that the change affects how other code owners manage that particular instance. For example, marking a vulnerability or entity as `Ignored` prevents other users with account access from seeing that vulnerability. + +* You can surface `Ignored` vulnerabilities with the filter bar. From the filter bar, you can add `Status = Ignored` to view `Ignored` vulnerabilities. +* From the the **Vulnerabilities** table, select **Ignored** to surface ignored vulnerabilities. + +At minimum, we recommend reviewing your vulnerabilities every 90 days to ensure you aren't introducing risk into your system. + +## Why ignore a vulnerability? [#why-ignore] + +When you choose to ignore a vulnerability, you'll be prompted to explain the rationale behind the decision. For example, you might say that the vulnerable code is not used in the system, and therefore isn't currently relevant for maintaining the system. We recommend that when you give this context, you also provide supplemental documentation when possible. + +We'll also prompt you to set a duration for the `Ignored` status. Vulnerability Management will perform an automatic update that changes it from `Ignored` to `Affected`. If an instance is already considered **No Longer Detected**, the status will remain no longer detected. + +## Permissions [#permissions] + +Can't change a vulnerability status? Ask your administrator if you have permissions. diff --git a/src/images/security_screenshot-affected-bulk-details.webp b/src/images/security_screenshot-affected-bulk-details.webp new file mode 100644 index 00000000000..959a046d1c0 Binary files /dev/null and b/src/images/security_screenshot-affected-bulk-details.webp differ diff --git a/src/images/security_screenshot-affected-bulk-form.webp b/src/images/security_screenshot-affected-bulk-form.webp new file mode 100644 index 00000000000..8cdf2e8bd53 Binary files /dev/null and b/src/images/security_screenshot-affected-bulk-form.webp differ diff --git a/src/images/security_screenshot-affected-bulk-selection.webp b/src/images/security_screenshot-affected-bulk-selection.webp new file mode 100644 index 00000000000..7a7eea69cf1 Binary files /dev/null and b/src/images/security_screenshot-affected-bulk-selection.webp differ diff --git a/src/images/security_screenshot-affected-bulk-vulnlist.webp b/src/images/security_screenshot-affected-bulk-vulnlist.webp new file mode 100644 index 00000000000..e9faab73d5d Binary files /dev/null and b/src/images/security_screenshot-affected-bulk-vulnlist.webp differ diff --git a/src/images/security_screenshot-affected-entity-details.webp b/src/images/security_screenshot-affected-entity-details.webp new file mode 100644 index 00000000000..5f8cebd453b Binary files /dev/null and b/src/images/security_screenshot-affected-entity-details.webp differ diff --git a/src/images/security_screenshot-affected-entity-filtered.webp b/src/images/security_screenshot-affected-entity-filtered.webp new file mode 100644 index 00000000000..49277884a92 Binary files /dev/null and b/src/images/security_screenshot-affected-entity-filtered.webp differ diff --git a/src/images/security_screenshot-affected-entity-form.webp b/src/images/security_screenshot-affected-entity-form.webp new file mode 100644 index 00000000000..4b776579eb6 Binary files /dev/null and b/src/images/security_screenshot-affected-entity-form.webp differ diff --git a/src/images/security_screenshot-affected-entity-vulnlist.webp b/src/images/security_screenshot-affected-entity-vulnlist.webp new file mode 100644 index 00000000000..df6a936196a Binary files /dev/null and b/src/images/security_screenshot-affected-entity-vulnlist.webp differ diff --git a/src/images/security_screenshot-ignore-bulk-details.webp b/src/images/security_screenshot-ignore-bulk-details.webp new file mode 100644 index 00000000000..8359b1c79c4 Binary files /dev/null and b/src/images/security_screenshot-ignore-bulk-details.webp differ diff --git a/src/images/security_screenshot-ignore-bulk-form.webp b/src/images/security_screenshot-ignore-bulk-form.webp new file mode 100644 index 00000000000..c1b7d7e27fe Binary files /dev/null and b/src/images/security_screenshot-ignore-bulk-form.webp differ diff --git a/src/images/security_screenshot-ignore-bulk-vulnlist.webp b/src/images/security_screenshot-ignore-bulk-vulnlist.webp new file mode 100644 index 00000000000..72d886bf9fd Binary files /dev/null and b/src/images/security_screenshot-ignore-bulk-vulnlist.webp differ diff --git a/src/images/security_screenshot-ignore-entity-details.webp b/src/images/security_screenshot-ignore-entity-details.webp new file mode 100644 index 00000000000..346e29c5e4d Binary files /dev/null and b/src/images/security_screenshot-ignore-entity-details.webp differ diff --git a/src/images/security_screenshot-ignore-entity-form.webp b/src/images/security_screenshot-ignore-entity-form.webp new file mode 100644 index 00000000000..0a6aafb829c Binary files /dev/null and b/src/images/security_screenshot-ignore-entity-form.webp differ diff --git a/src/images/security_screenshot-ignore-entity-vulnlist.webp b/src/images/security_screenshot-ignore-entity-vulnlist.webp new file mode 100644 index 00000000000..0aa499a05c3 Binary files /dev/null and b/src/images/security_screenshot-ignore-entity-vulnlist.webp differ diff --git a/src/images/security_screenshot-ignore-security_screenshot-ignore-bulk-vulnlist.webp b/src/images/security_screenshot-ignore-security_screenshot-ignore-bulk-vulnlist.webp new file mode 100644 index 00000000000..a908ce3a4a0 Binary files /dev/null and b/src/images/security_screenshot-ignore-security_screenshot-ignore-bulk-vulnlist.webp differ diff --git a/src/nav/vuln-management.yml b/src/nav/vuln-management.yml index 601eb2cebbe..f9ad3a1c528 100644 --- a/src/nav/vuln-management.yml +++ b/src/nav/vuln-management.yml @@ -5,6 +5,8 @@ pages: path: /docs/vulnerability-management/overview - title: Understanding vulnerability prioritization path: /docs/vulnerability-management/understanding-prioritization + - title: Change vulnerability status + path: /docs/vulnerability-management/change-vulnerability-status - title: Manage vulnerabilities as a developer path: /docs/vulnerability-management/dev-workflow - title: Manage vulnerabilities as a security team