3.1October 2021 | Note |
|---|
Migration from 2.8.5.1 to 3.1 is currently not supported. Users interested in migrating to 3.1 should upgrade to 2.8.4 first then continue with the 2.X to 3.X Migration process. |
Key Updates Fundamental and holistic rebuild of the ThreadFix architecture and deployment environment (please see the new environment requirements). To install a helm chart offline see the manual helm download. Full rewrite of our scan ingestion and processing logic to provide over 60x reduction in raw scan data processing speed Introduction of Remote Provider UI display cards and associated API Remote provider import and scan ingestion statuses display on the Scan Queue page Updates to the Scan Import Queue’s UI tooltips Update to add a new Queue Management permissions level
New/Updated API New GET ThreadFix application assets by import request ID API New GET Remote Provider Import Requests API New Pending Scan Status API New Scan Queue Management report view API Update to Remote Provider Import Request API
General Improvements Improvements to user login session management Leveraged new architecture to implement self-recovery for scan ingestion Improvements to Manual Vulnerability Actions Security improvements Bug fixes
Feature ChangesNote the following changes to features with the introduction of ThreadFix 3.1: Deprecated and Removed Support has been ended for the SSVL Converter Bi-directional capability for Checkmarx and AppSpider has been removed Service Delivery/Service Request feature set is no longer supported Removed the Import All Vulnerabilities remote provider option Saved scan files on the file system will not be migrated to 3.1 (NOTE: this only impacts the raw scan files. All vulnerability data is fully retained and migrated) SonarQube Plugin removed from the Tools section. Remote Provider integration still behaves as before. Support for the following integrations has been removed:
Limitations, Scheduled for Enhancement Post 3.1 Limit of 3000 vulnerabilities when exporting Vulnerability Search data to a .csv file. Remediation filters do not update automatically in 3.1, they will update with a defect status call sync. This feature is planned to be reintroduced. (NOTE: this may impact created policies based on these filters)
Absent, Scheduled for Re-introduction Post 3.1 The Disable Vulnerability Merging option when creating a new application has been removed, this feature is planned to be reintroduced Scan File Retention feature has been removed, this feature is planned to be reintroduced The Vulnerability Close Settings option, allowing users to close vulnerabilities only when all scanners report them closed, has been removed, but is planned to be reintroduced The Scan Agent tool API endpoints have not been migrated, this feature is planned to be reintroduced The ability to cancel queued scans has been removed, this feature is planned to be reintroduced in the future Time to Remediate Date policy override has been disabled, this feature will be reinstated Dashboard and Analytics page report caching time configuration has been disabled with plans to be re-enabled The Global FPR Filter Set API REST calls have been removed, with plans to be reintroduced Support for the following integrations has been removed, with plans for reintroduction: Acunetix File Importer Brakeman Coverity Dependency Check Sonatype
3.0.8March 2021 | Note |
|---|
Do Not Upgrade Without Reading This First!The following only applies to users upgrading from an older version of v3 to 3.0.8. When upgrading from v2 to v3, you must first be on latest, 2.8.3. Upgrade instructions can be found here. Adjusted vulnerability Open/Close Time to be Scan Date instead of Updated Date. To preserve historic reporting, no existing data will be retroactively changed. If you would like to have your historic data migrated to match the new date ingestion logic, please open a support ticket to request a migration script. Logic changes have been made to enforce vulnerability status uniqueness. Any vulnerabilities with multiple statuses will have their statuses updated in the migration to 2.8.2 from an earlier version of 2.X or updating from version 3.0.6. For additional information please review the Vulnerability Status Migration Logic.
|
Security Updates Key Updates Issue fix for Qualys scan imports Docker Logging improvement Fix for Netsparker upload issue Bug fix for SonarQube Improved import ingestion and configuration options for InsightVM Support added for JAVA_OPTIONS modifications Issue resolution for QualysWAS findings scan profiles and findings merging error Comprehensive Time zone management updates in ThreadFix Fortify on Demand no longer imports Fixed or Suppressed findings Introduced support for Acunetix 360 Remote Provider and Acunetix Premium exports Improvement to the Jenkins plugin Added CVSS Score and Vulnerability IDs as dynamic Defect Tracker profile values Checkmarx Remote Provider microservice mapping performance improvement Vulnerability statuses are now mutually exclusive WhiteHat mobile data support Checkmarx enhanced finding tracking Portfolio page now reflects ThreadFix Pen Tests as Assessments WebInspect findings details expanded Portfolio Application View pagination Most Vulnerable Applications report grouping Significant performance improvements to the Team delete function Time to Remediate Policies now allow for per-vulnerability exceptions Veracode Remote Provider import includes SCA data NowSecure Remote Provider integration
General Improvements Improvements to UI-Page navigation Adjustment for improving scan data imports Improvement to Veracode Remote Provider scan updates API performance improvements Vulnerability Trending report improvements Portfolio UI improvements for large-scale deployments UI performance enhancements Bug fix for graphs displayed on PDF exports Filter on mobile vulnerability data Improved error messaging WhiteHat integration respects the Out of Scope status LDAP login supports additional user attributes Netsparker Enterprise enhancements Time to Remediate notification improvements File attachment usability improvements Updated 3rd party dependencies and other security improvements Other enhancements and bug fixes General performance improvements
Installation and Upgrade Guides:3.0.7October 2020 General Improvements Expanded SAML support to cover additional use cases. As of 3.0.7 SAML is fully configurable in the UI from the Settings page. Resolved issues in Checkmarx and SonarQube integrations Performance improvements Other enhancements and bug fixes
3.0.7 also contains the following AppSec updates. Key Updates Vulnerability statuses are now mutually exclusive WhiteHat mobile data support Checkmarx enhanced finding tracking Portfolio page now reflects ThreadFix Pen Tests as Assessments WebInspect findings details expanded Portfolio Application View pagination Most Vulnerable Applications report grouping Significant performance improvements to the Team delete function Time to Remediate Policies now allow for per-vulnerability exceptions Veracode Remote Provider import includes SCA data NowSecure Remote Provider integration
General Improvements Filter on mobile vulnerability data Improved error messaging WhiteHat integration respects the Out of Scope status LDAP login supports additional user attributes Netsparker Enterprise enhancements Time to Remediate notification improvements File attachment usability improvements Updated 3rd party dependencies and other security improvements Added OAuth support for Jira Defect Tracker integration Improved parsing of scan data from AppScan Enterprise and Fortify SSC
| 
