Vulnerability and Client Statistics

[0xkhaled]

Is your feature request related to a problem? Please describe.
it's a new feature request that will help us a security service provider to provide a nice and clear vision for our clients about how vulnerable they are towards a specific type of attack

Describe the solution you'd like
a searching feature where we select the vulnerability from our findings database and client and we got a nice statistics bar that tells us how many times we reported this type of attack for this client.
Or another query that shows top reported vulnerabilities for a specific client which means for him he needs to increase awareness for his developers or system admins towards this attack category and this standalone statistics could be another service that worth to paid or it could be an open door to sell a training service for this client to help his guys to fix such a common security issue.

[chrismaddalena]

Thanks for submitting this, @0xkhaled. This would be an interesting addition to the client dashboards. In the meantime, you can also do this now with the GraphQL API and some light scripting. For example:

query MyQuery {
  reportedFinding(where: {report: {project: {clientId: {_eq: "1"}}}}) {
    title
    cvss_score
  }
  reportedFinding_aggregate(where: {report: {project: {clientId: {_eq: "1"}}}}) {
    nodes {
      title
      cvss_score
    }
    aggregate {
      avg {
        cvss_score
      }
      count
      max {
        cvss_score
      }
      min {
        cvss_score
      }
    }
  }
}

That query returns a list of titles and CVSS scores for all findings from all reports for the given clientId value. It also includes an aggregate query that returns the same list with the addition of the average, maximum, and minimum CVSS scores.

To get exactly what you want would require some minor post-processing. You'd loop over the results to count how many times you reported each finding to make your top X list. You could also include other fields, like finding type and affected entities, to sort by the most prominent finding type or find hosts/applications that appeared the most often.

query MyQuery {
  reportedFinding_aggregate(where: {report: {project: {clientId: {_eq: "1"}}}}) {
    nodes {
      title
      cvss_score
      findingtype {
        findingType
      }
      affectedEntities
    }
    aggregate {
      avg {
        cvss_score
      }
      max {
        cvss_score
      }
      min {
        cvss_score
      }
    }
  }
}

[github-actions]

This issue has been labeled as stale because it has been open for 30 days with no activity.

[github-actions]

This issue is closed because it has been inactive for 14 days since being labeled stale. Feel free to re-open the issue with a comment. If this needs further discussion (e.g., a feature request), it might be better to open a topic under the Discussions tab.