Open

Finding Status Processing

The following list indicates how finding statuses from Fortify are marked within ThreadFix when ingesting a scan:

• Not an issue or Suppressed - False Positive

• Exploitable or Need more information - Open

• Hidden - not ingested into ThreadFix

API Usage

Get Artifacts for Project:

Using the lastScanDate for the completed artifacts, ThreadFix compares this date to the current Fortify SSC scan date imported into ThreadFix. This also becomes the Scan Date of the ThreadFix scan.

Get Project Version

ThreadFix uses the currentState.metricEvaluationDate to check if there are updates to the current state of the project, and a new artifact has not been loaded. This becomes the Updated Date of the ThreadFix scan.

FPR Download

If we determined based on the calls above that a new artifact was run or there are new updates to import we make the following call:

Unassigned Findings

As of 3.1.1, new findings uploaded to the Auditor Status folder are automatically set with an Unassigned severity until users manually set them to a desired severity type. Note the Unassigned finding below.

Open

This can be reassigned manually by selecting View More to see its Vulnerability Details and manually changing the severity through the Action drop-down button.

By utilizing the Customize Scanner Severities page, users can globally have Exceptions to automatically set future Unassigned findings to their desired severity.

Table of Contents