You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: docs/semgrep-code/findings.md
+15-38
Original file line number
Diff line number
Diff line change
@@ -45,16 +45,16 @@ To view your findings in the Pre-production backlog:
45
45
The page structure of the Production backlog and Pre-production tabs are identical. These pages consist of:
46
46
47
47
- The **top bar**, where you can set the page's grouping view and [time period](#time-period-and-triage).
48
-
- The **filter panel**, which you can use to group and filter for specific findings
48
+
- The **filter panel**, which you can use to group and filter for specific findings.
49
49
- Information about findings identified by Semgrep Code. Each finding in the list includes:
50
-
- The name and description of the rule used to generate the finding
51
-
- The name of the project
52
-
- A link to the commit where the finding was first identified
53
-
- A link to the lines of code where the finding was most recently seen
50
+
- The name and description of the rule used to generate the finding.
51
+
- The name of the project.
52
+
- A link to the commit where the finding was first identified.
53
+
- A link to the lines of code where the finding was most recently seen.
54
54
55
55
### Group findings
56
56
57
-
By default, Semgrep groups all of the findings by the rule Semgrep used to match the code. This view is called the **Group by rule** view.
57
+
By default, Semgrep groups all of the findings by the rule Semgrep used to match the code. This view is called the **Group by Rule** view.
58
58
59
59
Semgrep sorts findings by severity. For a given severity, Semgrep further sorts findings as follows:
60
60
@@ -87,17 +87,15 @@ Use filters to narrow down your results. The following criteria are available fo
87
87
88
88
| Filter | Description |
89
89
| --------------------- | ------------ |
90
-
|**Projects**| Filter by repositories connected to Semgrep AppSec Platform. |
91
-
|**Branches**| Filter by findings in different Git branches. |
92
-
|**Teams**| Filter for findings in projects to which the specified teams are associated with. Available only to organizations with RBAC enabled. |
90
+
|**Projects and branches**| Filter by repositories connected to Semgrep AppSec Platform and by findings in different Git branches. |
93
91
|**Tags**| Filter for findings based on the tags associated with the project. |
94
92
|**Status**| Filter the triage state of a finding. Refer to [Triage statuses](/semgrep-code/triage-remediation#triage-statuses) to understand triage states. You can filter findings with a status of **Ignored** further by reason: **False positive**, **Acceptable risk**, **No time to fix**, or **No triage reason**. |
95
93
|**Severity**| Filter by the severity of a finding. Severity is computed based on the values assigned for [Likelihood](/contributing/contributing-to-semgrep-rules-repository/#likelihood) and [Impact](/contributing/contributing-to-semgrep-rules-repository/#impact) by the rule's author. Possible values: <ul><li>Low</li><li>Medium</li><li>High</li></ul> |
96
94
|**Confidence**| Filter by the likelihood of the rule to detect true positives. The higher the confidence, the more true positives the rule may detect. |
97
-
|**Pro findings**| Filter for findings identified using Semgrep Pro rules. Also includes findings originating from cross-file or cross-function analysis. |
95
+
|**Pro findings only**| Filter for findings identified using Semgrep Pro rules. Also includes findings originating from cross-file or cross-function analysis. |
98
96
|**Category**| Filter by the type of security issue or vulnerability the rule detects, such as `security`, `correctness`, and `maintainability`. You can select more than one category at a time. See [Finding categories](#finding-categories) for information on how Semgrep categorizes your findings. |
99
-
|**Component**| Filter by [Semgrep Assistant component tags](/semgrep-assistant/overview#component-tags). Semgrep Assistant uses AI to categorize the file where the finding was identified based on its function, such as payments, user authentication, and infrastructure. |
100
-
|**Recommendation**| Filter by recommendation offered by Semgrep Assistant's auto-triage feature. Possible values: <ul><li>Fix</li><li>Ignore</li></ul>|
97
+
|**Assistant risk category**| Filter for findings based on Assistant's assessment of risk level of files based on the type of code identified. High-risk files contain sensitive information, such as authorization and authentication details, while low-risk files may be things like test files. You can further filter by file type, such as **payments** or **tests**. |
98
+
|**Assistant autotriage**| Filter by whether [Assistant autotriage](/semgrep-assistant/overview#auto-triage) has determined the finding to be a **True positive** or **False positive**. |
101
99
|**Action**| Filter by monitoring, commenting, or blocking rules in your Policies. |
102
100
|**Rule**| Filter by rules included in your Policies page. You can select more than one rule or ruleset for filtering. |
103
101
|**Ruleset**| Filter by the ruleset name where rules that match the code belong. More than one rule or ruleset can be selected for filtering. |
@@ -114,38 +112,17 @@ A finding can be categorized in two ways:
114
112
115
113
Semgrep rules provide a metadata schema to identify these common categories. Semgrep findings include a `message` field that describes the security issue or bug found in matching code. Additionally, findings can provide a `fix` field that fixes the issue by creating a suggestion within your source code management (SCM) tool, such as GitHub, GitLab, and Bitbucket.
116
114
2.**Finding categorization based on the validity of the match**:
117
-
<dl>
118
-
<dt>True positive</dt>
119
-
<dd>Rules are written to match a certain code pattern. A true positive is a genuine match. The rule is capturing the code as intended.</dd>
120
-
<dt>False positive</dt>
121
-
<dd>
122
-
A false positive is a mismatch between the intended purpose of the rule and the code it matched. A finding is generated but does not meet the rule's intended need. Rules with a high false positivity rate are said to be <strong>noisy</strong>.
123
-
</dd>
124
-
<dt>False negative</dt>
125
-
<dd>
126
-
A false negative is a finding that should have been found by a rule, but was not. This can happen for two reasons:
127
-
<ul>
128
-
<li>A flaw in the rule's logic. See <a href="/docs/reporting-false-negatives">Reporting false negatives</a>.</li>
129
-
<li>A bug within Semgrep itself. See the list of <a href="https://github.com/semgrep/semgrep/issues">Semgrep issues</a> to file a bug report.</li>
130
-
</ul>
131
-
</dd>
132
-
</dl>
115
+
-**True positive**: Rules are written to match a certain code pattern. A true positive is a genuine match. The rule is capturing the code as intended.
116
+
-**False positive**: A false positive is a mismatch between the intended purpose of the rule and the code it matched. A finding is generated but does not meet the rule's intended need. Rules with a high false positivity rate are said to be **noisy**.
117
+
-**False negative**: A false negative is a finding that should have been found by a rule, but was not. This can happen for two reasons:
118
+
1. A flaw in the rule's logic. See <ahref="/docs/reporting-false-negatives">Reporting false negatives</a>.
119
+
2. A bug within Semgrep itself. See the list of <ahref="https://github.com/semgrep/semgrep/issues">Semgrep issues</a> to file a bug report.
133
120
134
121
:::tip
135
122
You can identify findings categorized under **Security** by their badge.
136
123

137
124
:::
138
125
139
-
### Display findings reported in a specific time frame
140
-
141
-
By default, the **Code** page displays your results from all time. To display findings reported during a specific time frame, click the <iclass="fa-solid fa-calendar-days"></i> **All time** button and select the preferred period. The following options are available:
142
-
143
-
- All time
144
-
- Last 1 year
145
-
- Last 1 month
146
-
- Last 7 days
147
-
- Last 1 day
148
-
149
126
### View findings details about a specific finding
150
127
151
128
To view in-depth information about a specific finding:
Copy file name to clipboardexpand all lines: src/components/procedure/_export-findings-csv.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -1,4 +1,4 @@
1
-
You can export findings to a **CSV** file. Semgrep can export up to **10,000 most recent findings**. For findings greater than 10,000, you must use the [<iclass="fas fa-external-link fa-xs"></i> API](https://semgrep.dev/api/v1/docs/).
1
+
You can export findings to a **CSV** file. Semgrep can export up to **10,000 most recent findings**. To export more than 10,000 findings, you must use the [<iclass="fas fa-external-link fa-xs"></i> API](https://semgrep.dev/api/v1/docs/).
2
2
3
3
Semgrep exports all findings to the CSV file regardless of the filters you apply on the page.
0 commit comments