Services

Purpose

This article provides users with an overview of services in Informational findings.

Introduction

The article provides an overview of the Informational findings services, detailing prerequisites for access and management actions. Users are assumed to have basic access to the OUTSCAN™/HIAB account. The article outlines how users can view linked services for specific assets, access details about these services, and manage them through various options such as editing tags or marking items as false positives. Additionally, it explains how to engage with the Appsec team and manage comments related to the services.

Service Overview

Requirements

It is assumed that the reader has basic access to the OUTSCAN™/HIAB account.

The Services view is visible without an Appsec subscription, but the view will be empty.

Services

In Findings > Informational > Services, the services that are linked to a specific asset are listed.

When clicking on a service, a details view is displayed on the right side of the window.

Details

The Details tab shows more information about the selected service.

This includes service information such as name, configuration, type, service type and status.

Asset

The affected asset, and by clicking the asset name you are redirected to the asset view for more information.

First seen

When the service was first discovered on the specific asset.

Last Seen

When the service was last seen on the specific asset.

Comments

The Comments tab enables you to post comments on products, as well as sending messages to the Outpost24® Appsec team for review and response about the selected product.

Discussions and Commenting

Discussions about a finding are normally customer-internal. Only when eligible (via associated subscription) may a dialog between customer and the Outpost24 AppSec team be initiated.

Starting a Discussion

You can start a discussion about a finding:

Select a finding.
Click the Comments tab on the right side. The Comments tab shows all your ongoing discussions.
Add a new comment and click the blue Start Discussion button.
To reply to a discussion, enter your reply on the Reply to conversation line and click the blue Reply button.

Starting a Discussion with the Outpost24 AppSec Team

You can start a discussion about the findings with the Outpost24 AppSec Team for review and response.

Select a finding.
Click the Comments tab on the right side. The Comments tab shows all your ongoing discussions.
Toggle the Start a discussion with Outpost24 switch.

The Start a discussion with Outpost24 toggle is displayed if and when the underlying finding is eligible.

Add a new comment and click the blue Start Discussion button.
The comment is sent to the Outpost 24 AppSec team.
To reply to an ongoing discussion, enter your reply on the Reply to conversation line and click the blue Reply button.

When discussing with an Outpost 24 AppSec representative, the discussion card is marked clearly with a blue sign in the top left corner of the discussion card.

Deleting a Single Comment

To delete a comment in a discussion, click on the delete icon to the right. This removes the comment from the discussion.

The deleted comment is marked with the text "This message has been deleted".

You can only delete your own comments.

Deleting a Discussion Tree

To delete the entire discussion tree, click on the delete icon to the right on the first line in the card. This removes all conversation in the card.

The deleted discussion and all replies is marked with the text "This message has been deleted".

Removing the top discussion will remove all the following replies in that discussion recursively.

If no comment is given, a default message/comment stating “Transitioned information status from <original status> to <new status> without user's comment." is saved as a activity log to assist with the reviewing of the finding’s history.

The customer can also transition services from other status like FALSE_POSITIVE or PRESENT.

Example:

Starting discussions with the Outpost24® Appsec team requires an active Appsec subscription.

To access existing comments, enable the comments column and click on the comment icon to quickly launch the comments window.

Manage Services

Select one or more services, and choose one of the actions that is displayed on the bottom bar:

Right-clicking a service or a selected group of services opens a menu where the same tasks can be performed.

The possible user actions are:

Edit tags adds a tag to the selected service. See Tags for more information.
Mark as false positive marks a service as a false positive.
Unmark false positive reverts a service as a false positive.

Columns

By clicking the Column bar next to the Main Menu, you expand the column list available to Services. Select any Column to view in the main window.

Select a specific column to know that information about a service. All selected columns are displayed in the Services tab. The available options are described below.

Option	Format	Description
Age		Shows how old the vulnerability is in regards to when then it was first discovered in a scan.
Asset		Name of the asset associated to the service. Could consist of among others: FQDN IP-address Agent ID Container image name
Asset group IDs		Group IDs attached to Asset that the Finding belongs to. See Vulnerabilities.
Asset ID		The unique identifier of the Asset the service belongs to.
Comments		Number of comments associated to the service.
Configuration		Service setting controlling how the service gets started.
Created		When the finding object was first created. Counted from when a scan first resulted in this finding or when the Appsec team pushed it.
Created by		Who created it: System if it was from a scan Appsec team if they created it
Created by ID		ID of the account that created the service
Customer ID		ID of the customer
First scan ID		ID of the scanlog entry this service was first found in.
First seen		Date shows when the service was first discovered on a specific asset during recurring scans. When not found in a scan, the first seen date resets.
ID		Unique identifier of the service.
Last scan ID		This is the last (latest) scan this service was found in.
Last seen		Date shows when the service was last seen on a specific asset. Checks if the service is present in recurring scans. If it is not found in one scan, the last seen date resets.
Match IDs		Reference ID to the scanners raw data output that the service is generated from and contains in depth information such as vhost, port, pattern, url, service versions, and so on.
Seen last scan		Boolean value that shows if the service was detected during the last scan of the linked asset.
Service name		Name of the service.
Service status		Status of the service.
Service type		Type of the service
Source		Which source scanner or service type does the service originate from.
Status		Indicates the different statuses for a service. Can be marked as: False Positive - The scanner is finding a risk that has been marked by someone to be a false positive and is not supposed to pick up on. Present - (Default) Shows that a service is present after scanning
Tags		Displays the available tags associated with the service.
Updated		Timestamp of when the service was last updated at all for any reason, system- or user-initiated.
Updated by		Who did the last updating action, system, user, or AppSec team and so on.
Updated by ID		ID of the account that did the last updating cation