Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Risks and Vulnerability Management - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="which-applications-or-code-repos-are-vulnerable">Which applications or code repos are vulnerable?</h2> <p><em>Requires at least one application scanner integration such as Veracode or WhiteHat.</em></p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find (Application|CodeRepo) as app that has (Finding|Vulnerability) as vuln return app._type, app.displayName, vuln._type, vuln.displayName, vuln.severity, vuln.numericSeverity </pre> <h2 data-id="which-systems-instances-are-vulnerable">Which systems/instances are vulnerable?</h2> <p><em>Requires enabling AWS Inspector, GuardDuty, Tenable or similar integration.</em></p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find (Host|Workload|DataStore) as system that has (Finding|Vulnerability) as vuln return system._type, system.displayName, vuln._type, vuln.displayName, vuln.severity, vuln.numericSeverity </pre> <h2 data-id="what-open-vulnerabilities-do-i-have">What open vulnerabilities do I have?</h2> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find (Finding|Vulnerability) with open=true </pre> <p><em>This is best viewed in the <strong>Alerts</strong> app under <strong>Open Findings</strong> tab.</em></p> <h2 data-id="what-vulnerabilities-are-suppressed-resolved-marked-as-exception">What vulnerabilities are suppressed/resolved/marked as exception?</h2> <p>Similar, you can query for vulnerability findings that are resolved/suppressed<br> or marked as exception:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find (Finding|Vulnerability) with open=false or suppressed=true or exception=true </pre> <h2 data-id="do-i-have-proper-vendor-support-for-my-software-applications">Do I have proper vendor support for my software applications?</h2> <p><em>Requires integration with Okta or OneLogin or similar SSO identity provider.</em></p> <p>This returns data that is derived from a SSO application:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find Application as app that CONNECTS Account that RELATES TO Vendor as v return app.displayName as app, v.name as vendor, v.linkToSLA, v.linkToMSA </pre> <p>Or in a more generic way:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find Application that RELATES TO (Vendor|Account) </pre> <p>Returns all applications that does not have a vendor or vendor account<br> associated:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find Application that !RELATES TO (Vendor|Account) </pre> <h2 data-id="are-all-system-images-updated-in-the-past-six-months">Are all system images updated in the past six months?</h2> <p>Find images that have been updated within 6 months:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find Image with createdOn > date.now - 6 months </pre> <p>Find images that have not be updated within 6 months:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find Image with createdOn < date.now - 6 months </pre> <h2 data-id="what-are-the-approved-server-system-images">What are the approved server/system images?</h2> <p>Find private images or the ones that have been specifically approved:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find Image with public=false or approved=true </pre> <h2 data-id="who-are-my-vendors-do-i-have-a-baa-dpa-nda-msa-and-sla-support-agreement-with-them">Who are my vendors? Do I have a BAA/DPA/NDA/MSA and SLA/Support Agreement with them?</h2> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find Vendor </pre> <p><em>This is best viewed in the Asset Inventory app by selecting the Vendor class from the quick filter.</em></p> </article> </main>
.png)