Scan
The Scan template is a new version of the current report available in CxSAST. It now has an expanded set of datapoints and a new and "refreshed" template with a user friendly interface.
The following template types are available:
Vulnerability Type oriented - the displayed results are grouped by the vulnerability type.
Results State oriented - the displayed results are grouped by the result state.
Permissions
To be able to generate the Scan report, the user must be associated with an Access Control role with the generate-scan-report permission.
Generic KPIs
The following KPIs are common to both Scan templates:
Scan Information
 |
Scan Information
The Scan Information card shows details related to the scanned project, such as Preset and Team, and to the scan itself, such as Scan Duration and Lines of Code Scanned.
Filtered By
In this card you can see the filters applied when generating the report:
 |
Applied Filters
Included: Data included in the report. All data available in the report is filtered according to the specified included filters.
Excluded: Data filtered out from the report.
Specific filters can be applied when generating the scan template to restrict and refine the data and the results to analyze.
The following filters can be defined when generating a scan template:
Severity: By default, Low and Informative results are excluded.
Allowed values that can be excluded from the report are: High, Medium, Low, and Information.
Result State: By default, all result states are included.
Allowed values that can be excluded are: To Verify, Confirmed, Urgent, Proposed Not Exploitable, Not Exploitable.
Query/Vulnerability Type: By default, all queries are included. By clicking on the link you are re-directed to the Vulnerability Type section.
Status: By default, only New and Recurrent are included.
Allowed values that can be excluded are: New, Recurrent and Resolved.
What happens when Resolved results are included?
The Resolved Results section is displayed in the report.
All other KPI calculations (that are not part of the Resolved Results section) are not affected by the resolved results.
What happens when Resolved results are excluded?
The Resolved Results section is not displayed in the report.
Results Limit: When applied it does not impact any KPI calculation, since all results are taken into consideration when calculating the data points. This filter only impacts the number of results displayed and printed in Scan Results section. By default the Results Limit value is set to 5000.
For further details on how to define and apply filters see the APIs page.
Scan Results Overview
Density grade
Density Grade
Show the ratio between the total of vulnerabilities and the lines of code. It is calculated based on (Total of vulnerabilities/Total lines of code)*1000.
By Status
 |
By Status
The pie chart shows the number of findings grouped by Status (New vs Recurrent). For each status, the total of number findings and its percentage is displayed.
By Language
By Language
The stacked chart shows the number of findings detected for each scanned language and severity. Trends are also available showing if the number of results in the current scan has decreased or increased, when compared to the previous full scan, and how much the variation is. Density and density trends are also displayed.
Top 5 Oldest Vulnerabilities by Severity
Top 5 Oldest Vulnerabilities by Severity
The aging is calculated restricted to the project you are analyzing, meaning that the first detection date for the vulnerability in this project is taken in consideration. The aging refers to the scan date where the vulnerability appeared and not to the project creation date.
Example:
Project A has vulnerability 1 that appeared in June 2021.
Project B has been created in July 2010 and share same code as Project A.
The first scan for Project B ran on August 2021 and a Scan Report was generated in September 2021. In the Report, the vulnerability 1 aging is 1 month (calculated based in the first scan).
Vulnerability 1 is resolved and disappears between September and December, then it re-appears in January (for same source code). If the report is generated in January, the aging is between September and January (4 months). In case it re-appears for different source code, the aging is calculated according to difference between the current and first detection dates.
Vulnerability Type Group
Scan Results Overview
By Severity
 |
By Severity KPI
This pie chart shows the scan results grouped by the Severity. For each severity it is displayed the total number of findings, its percentage and the trend. The trend tell us if the number of results in the current scan has decreased or increased, when compared to the full previous scan, and how much the variation is.
Also the density and density trends are available in this card.
Vulnerability Type
 |
By Vulnerability Type and Severity
The table shows us the information by each vulnerability type and for each there is a breakdown by severity.
The second column refers to the vulnerability type severity. In case the severity of a results is changed from the default severity to another one, the total results will be displayed under the specific severity column.
The blue capsule shows how many new vulnerabilities appeared and how many were resolved between the previous full scan and the current one. The overall Trend is the difference between the New Vulnerabilities and the Resolved ones (New – Resolved).
Also the number of files where each vulnerability type was detected is displayed in the column Files.
All the vulnerability Types displayed in the table are according to the defined filters, meaning that excluded vulnerability types won't be displayed even if they have findings.
Top 10 Vulnerabilities
This card displays the 10 vulnerabilities having the higher total of findings in the scan.
 |
Top 10 Vulnerabilities
For each Vulnerability, the total of results by severity is displayed.
Taking SQL_Injection as example, there are 5 High results and 0 Medium.
Top 10 Vulnerable Files
This card displays the 10 files containing the higher total of findings.
 |
Top 10 Vulnerable Files
For each File, the total of results by severity is displayed.
Taking \bookstore\Login.cs as example, the file has 3 High results and 1 Medium.
Scan Results
The scan results are presented grouped by Vulnerability Type.
 |
Scan Results grouped by Vulnerability Type
For each Vulnerability Type it is presented the total results and the total flows, along with a Description and the Categories to which the vulnerabilities is related to.
For each Flow, all the results are displayed together and, for each result, several information available, such as Severity, Status, First and Last Detection dates, Source and Destination. By clicking in the Hyperlink, you are re-directed to the Results Viewer in CxPortal to see the specific result.
The results available in this section are according to the Results Limit defined as a filters.
Resolved Vulnerabilities
This section only appears in case Resolved Results is included in the report (defined in the Filters).
 |
Resolved Vulnerabilities
The total vulnerabilities resolved between the previous full scan and the current one (the one in the report) are displayed grouped by Vulnerability Type. For each resolved results, it is displayed the first and the resolved dates, along with the total days it took to be resolved.
Result State Group
Scan Results Overview
By State
 |
By State
This pie chart shows the scan results grouped by the Results State. For each state it is displayed the total number of findings and its percentage.
Also the density and density trends are available in this card.
State
 |
By State and Severity
The table shows us the information by each Result State and for each of these, there is a breakdown by severity.
The blue capsule shows how many new vulnerabilities appeared and how many were resolved between the previous full scan and the current one. The overall Trend is the difference between the New Vulnerabilities and the Resolved ones (New – Resolved).
Also the number of files where each state has results is displayed in the column Files.
Scan Results
The scan results are presented grouped by Result State.
 |
Scan Results grouped by Result State
For each group (Urgent, in the image above) it is presented the total results and the percentage for the specific Result State and the remaining total as well (which corresponds to all the other Result States). Also the New vs Recurrent results are displayed for the specific Result State.
For each results there is a lot of information available, such as Severity, Status, First and Last Detection dates, Source and Destination. By clicking in the hyperlink, you are re-directed to the Results Viewer in CxPortal to see the specific result.
The results available in this section are according to the Results Limit defined as a filters.
Example:
Scan has 1500 results and Results Limits is set to 150.
In this section it will appears Total Results: 1500, however only 150 results will be printed.
Resolved Vulnerabilities
This section only appears in case Resolved Results is included in the report (defined in the Filters).
 |
Resolved Vulnerabilities
The total vulnerabilities resolved between the previous full scan and the current one (the one in the report) are displayed.
For each vulnerability there is a link that re-directs you to the specific result in the Results Viewer in Checkmarx Portal.