Products

Purpose

This article provides users with an overview of products in Informational findings.

Introduction

This document offers an overview of products related to Informational findings. It outlines the requirements for accessing the OUTSCAN™/HIAB account and describes how users can view products linked to specific assets. The document details the information available in the product details view, including product specifications, ports, and asset information, as well as commenting features for user interaction. Additionally, it explains how to manage products, including editing tags and marking items as false positives, along with the various columns available for product information display.

Product Overview

Requirements

It is assumed that the reader has basic access to the OUTSCAN™/HIAB account with Appsec subscription.

The Products view is visible without an Appsec subscription, but the view will be empty.

Products

In Findings > Informational > Products, the products that are linked to a specific asset are listed.

When clicking on a product, a details view is displayed on the right side of the window.

Details

The Details tab shows more information about the selected product.

This includes product information such as name, version, type, EOL, URL, CPE 2.2, CPE 2.3.

Ports

A list of all ports and information about them such as port name and port protocol.

Asset

The affected asset, and by clicking the asset name you are redirected to the asset view for more information.

First seen

When the port was first discovered on the specific asset.

Last Seen

When the port was last seen on the specific asset.

Created

The time since the product was created.

Created by

The name of the account that the product was created by.

Updated

The time since the product was last updated.

Updated by

The name of the account that the product was last updated by.

Comments

The Comments tab enables you to post comments on products, as well as sending messages to the Outpost24® Appsec team for review and response about the selected product.

Discussions and Commenting

Discussions about a finding are normally customer-internal. Only when eligible (via associated subscription) may a dialog between customer and the Outpost24 AppSec team be initiated.

Starting a Discussion

You can start a discussion about a finding:

Select a finding.
Click the Comments tab on the right side. The Comments tab shows all your ongoing discussions.
Add a new comment and click the blue Start Discussion button.
To reply to a discussion, enter your reply on the Reply to conversation line and click the blue Reply button.

Starting a Discussion with the Outpost24 AppSec Team

You can start a discussion about the findings with the Outpost24 AppSec Team for review and response.

Select a finding.
Click the Comments tab on the right side. The Comments tab shows all your ongoing discussions.
Toggle the Start a discussion with Outpost24 switch.

The Start a discussion with Outpost24 toggle is displayed if and when the underlying finding is eligible.

Add a new comment and click the blue Start Discussion button.
The comment is sent to the Outpost 24 AppSec team.
To reply to an ongoing discussion, enter your reply on the Reply to conversation line and click the blue Reply button.

When discussing with an Outpost 24 AppSec representative, the discussion card is marked clearly with a blue sign in the top left corner of the discussion card.

Deleting a Single Comment

To delete a comment in a discussion, click on the delete icon to the right. This removes the comment from the discussion.

The deleted comment is marked with the text "This message has been deleted".

You can only delete your own comments.

Deleting a Discussion Tree

To delete the entire discussion tree, click on the delete icon to the right on the first line in the card. This removes all conversation in the card.

The deleted discussion and all replies is marked with the text "This message has been deleted".

Removing the top discussion will remove all the following replies in that discussion recursively.

If no comment is given, a default message/comment stating “Transitioned information status from <original status> to <new status> without user's comment." is saved as a activity log to assist with the reviewing of the finding’s history.

The customer can also transition products from other status like FALSE_POSITIVE or PRESENT.

Example:

Starting discussions with the Outpost24® Appsec team requires an active Appsec subscription.

To access existing comments, enable the comments column and click on the comment icon to quickly launch the comments window.

Manage Products

Select one or more products, and choose one of the actions that is displayed on the bottom bar:

Right-clicking a product or a selected group of products opens a menu where the same tasks can be performed.

The possible user actions are:

Edit tags adds a tag to the selected product. See Tags for more information.
Mark as false positive marks a product as a false positive.
Unmark false positive reverts a product as a false positive.

Columns

By clicking the Column bar next to the Main Menu, you expand the column list available to Products. Select any Column to view in the main window.

Select a specific column to know that information about a product. All selected columns are displayed in the Products tab. The available options are described below.

Option	Format	Description
Age		Shows how old the product is in regards to when then it was first discovered in a scan.
Asset		Name of the asset associated to the product. Could consist of among others: FQDN IP-address Agent ID Container image name
Asset ID		The unique identifier of the Asset the Product belongs to.
Comments		Number of comments associated to the product.
CPE 2.2		Common Platform Enumeration, see for more details https://cpe.mitre.org/files/cpe-specification_2.2.pdf
CPE 2.3		Common Platform Enumeration, see https://web.archive.org/web/20210422160307/https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7695.pdf for more details
Created		When the finding object was first created. Counted from when a scan first resulted in this finding or when the Appsec team pushed it.
Created by		Who created it: System if it was from a scan Appsec team if they created it
Created by ID		ID of the account that created the port.
Customer ID		ID of the customer.
EOL (End of Life)		The timestamp when the product goes EOL.
First scan ID		ID of the scanlog entry this product was first found in.
First seen		Date shows when the product was first discovered on a specific asset during recurring scans. When not found in a scan, the first seen date resets.
ID		Unique identifier of the product.
Last scan ID		This is the last (latest) scan this product was found in.
Last seen		Date shows when the product was last seen on a specific asset. Checks if the product is present in recurring scans. If it is not found in one scan, the last seen date resets.
Match IDs		Reference ID to the scanners raw data output that the product is generated from and contains in depth information such as vhost, port, pattern, url, product versions, and so on.
Name		Name of the product.
Port names		List of all port names.
Port protocols		List of all port protocols.
Ports		Displays the ports which the product was found on. Hovering mouse on the port chip displays the port number and protocol as tool-tip. Number filter is applicable on the column.
Seen last scan		Boolean value that shows if the product was detected during the last scan of the linked asset.
Source		Which source scanner or product type does the product originate from.
Status		Indicates the different statuses for a product. Can be marked as: False Positive - The scanner is finding a risk that has been marked by someone to be a false positive and is not supposed to pick up on. Present - (Default) Shows that a Product is present after scanning
Tags		Displays the available tags associated with the product.
Type	PRODUCT	The type of informational finding
Updated		Timestamp of when the product was last updated at all for any reason, system- or user-initiated.
Updated by		Who did the last updating action, system, user, or AppSec team and so on.
Updated by ID		ID of the account that did the last updating cation
Version		The version of the product that was detected