Skip to content

Commit 5b35e7f

Browse files
authored
edit Findings page (#1935)
1 parent 291f6b3 commit 5b35e7f

File tree

5 files changed

+19
-42
lines changed

5 files changed

+19
-42
lines changed

docs/semgrep-code/findings.md

+15-38
Original file line numberDiff line numberDiff line change
@@ -45,16 +45,16 @@ To view your findings in the Pre-production backlog:
4545
The page structure of the Production backlog and Pre-production tabs are identical. These pages consist of:
4646

4747
- The **top bar**, where you can set the page's grouping view and [time period](#time-period-and-triage).
48-
- The **filter panel**, which you can use to group and filter for specific findings
48+
- The **filter panel**, which you can use to group and filter for specific findings.
4949
- Information about findings identified by Semgrep Code. Each finding in the list includes:
50-
- The name and description of the rule used to generate the finding
51-
- The name of the project
52-
- A link to the commit where the finding was first identified
53-
- A link to the lines of code where the finding was most recently seen
50+
- The name and description of the rule used to generate the finding.
51+
- The name of the project.
52+
- A link to the commit where the finding was first identified.
53+
- A link to the lines of code where the finding was most recently seen.
5454

5555
### Group findings
5656

57-
By default, Semgrep groups all of the findings by the rule Semgrep used to match the code. This view is called the **Group by rule** view.
57+
By default, Semgrep groups all of the findings by the rule Semgrep used to match the code. This view is called the **Group by Rule** view.
5858

5959
Semgrep sorts findings by severity. For a given severity, Semgrep further sorts findings as follows:
6060

@@ -87,17 +87,15 @@ Use filters to narrow down your results. The following criteria are available fo
8787

8888
| Filter | Description |
8989
| --------------------- | ------------ |
90-
| **Projects** | Filter by repositories connected to Semgrep AppSec Platform. |
91-
| **Branches** | Filter by findings in different Git branches. |
92-
| **Teams** | Filter for findings in projects to which the specified teams are associated with. Available only to organizations with RBAC enabled. |
90+
| **Projects and branches** | Filter by repositories connected to Semgrep AppSec Platform and by findings in different Git branches. |
9391
| **Tags** | Filter for findings based on the tags associated with the project. |
9492
| **Status** | Filter the triage state of a finding. Refer to [Triage statuses](/semgrep-code/triage-remediation#triage-statuses) to understand triage states. You can filter findings with a status of **Ignored** further by reason: **False positive**, **Acceptable risk**, **No time to fix**, or **No triage reason**. |
9593
| **Severity** | Filter by the severity of a finding. Severity is computed based on the values assigned for [Likelihood](/contributing/contributing-to-semgrep-rules-repository/#likelihood) and [Impact](/contributing/contributing-to-semgrep-rules-repository/#impact) by the rule's author. Possible values: <ul><li>Low</li><li>Medium</li><li>High</li></ul> |
9694
| **Confidence** | Filter by the likelihood of the rule to detect true positives. The higher the confidence, the more true positives the rule may detect. |
97-
| **Pro findings** | Filter for findings identified using Semgrep Pro rules. Also includes findings originating from cross-file or cross-function analysis. |
95+
| **Pro findings only** | Filter for findings identified using Semgrep Pro rules. Also includes findings originating from cross-file or cross-function analysis. |
9896
| **Category** | Filter by the type of security issue or vulnerability the rule detects, such as `security`, `correctness`, and `maintainability`. You can select more than one category at a time. See [Finding categories](#finding-categories) for information on how Semgrep categorizes your findings. |
99-
| **Component** | Filter by [Semgrep Assistant component tags](/semgrep-assistant/overview#component-tags). Semgrep Assistant uses AI to categorize the file where the finding was identified based on its function, such as payments, user authentication, and infrastructure. |
100-
| **Recommendation** | Filter by recommendation offered by Semgrep Assistant's auto-triage feature. Possible values: <ul><li>Fix</li><li>Ignore</li></ul> |
97+
| **Assistant risk category** | Filter for findings based on Assistant's assessment of risk level of files based on the type of code identified. High-risk files contain sensitive information, such as authorization and authentication details, while low-risk files may be things like test files. You can further filter by file type, such as **payments** or **tests**. |
98+
| **Assistant autotriage** | Filter by whether [Assistant autotriage](/semgrep-assistant/overview#auto-triage) has determined the finding to be a **True positive** or **False positive**. |
10199
| **Action** | Filter by monitoring, commenting, or blocking rules in your Policies. |
102100
| **Rule** | Filter by rules included in your Policies page. You can select more than one rule or ruleset for filtering. |
103101
| **Ruleset** | Filter by the ruleset name where rules that match the code belong. More than one rule or ruleset can be selected for filtering. |
@@ -114,38 +112,17 @@ A finding can be categorized in two ways:
114112

115113
Semgrep rules provide a metadata schema to identify these common categories. Semgrep findings include a `message` field that describes the security issue or bug found in matching code. Additionally, findings can provide a `fix` field that fixes the issue by creating a suggestion within your source code management (SCM) tool, such as GitHub, GitLab, and Bitbucket.
116114
2. **Finding categorization based on the validity of the match**:
117-
<dl>
118-
<dt>True positive</dt>
119-
<dd>Rules are written to match a certain code pattern. A true positive is a genuine match. The rule is capturing the code as intended.</dd>
120-
<dt>False positive</dt>
121-
<dd>
122-
A false positive is a mismatch between the intended purpose of the rule and the code it matched. A finding is generated but does not meet the rule's intended need. Rules with a high false positivity rate are said to be <strong>noisy</strong>.
123-
</dd>
124-
<dt>False negative</dt>
125-
<dd>
126-
A false negative is a finding that should have been found by a rule, but was not. This can happen for two reasons:
127-
<ul>
128-
<li>A flaw in the rule's logic. See <a href="/docs/reporting-false-negatives">Reporting false negatives</a>.</li>
129-
<li>A bug within Semgrep itself. See the list of <a href="https://github.com/semgrep/semgrep/issues">Semgrep issues</a> to file a bug report.</li>
130-
</ul>
131-
</dd>
132-
</dl>
115+
- **True positive**: Rules are written to match a certain code pattern. A true positive is a genuine match. The rule is capturing the code as intended.
116+
- **False positive**: A false positive is a mismatch between the intended purpose of the rule and the code it matched. A finding is generated but does not meet the rule's intended need. Rules with a high false positivity rate are said to be **noisy**.
117+
- **False negative**: A false negative is a finding that should have been found by a rule, but was not. This can happen for two reasons:
118+
1. A flaw in the rule's logic. See <a href="/docs/reporting-false-negatives">Reporting false negatives</a>.
119+
2. A bug within Semgrep itself. See the list of <a href="https://github.com/semgrep/semgrep/issues">Semgrep issues</a> to file a bug report.
133120

134121
:::tip
135122
You can identify findings categorized under **Security** by their badge.
136123
![Screenshot of security badge](/img/findings-security-badge.png#md-width)
137124
:::
138125

139-
### Display findings reported in a specific time frame
140-
141-
By default, the **Code** page displays your results from all time. To display findings reported during a specific time frame, click the <i class="fa-solid fa-calendar-days"></i> **All time** button and select the preferred period. The following options are available:
142-
143-
- All time
144-
- Last 1 year
145-
- Last 1 month
146-
- Last 7 days
147-
- Last 1 day
148-
149126
### View findings details about a specific finding
150127

151128
To view in-depth information about a specific finding:

src/components/concept/_time-period-filters.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,12 @@ The following filters are available:
1111
- Last triaged
1212
- Last fixed
1313
- Time period:
14-
- Last 1 day
14+
- Last day
1515
- Last 7 days
16-
- Last 1 month
16+
- Last 30 days
1717
- Last 3 months
1818
- Last 6 months
19-
- Last 1 year
19+
- Last year
2020
- All time
2121

2222
![Time period and status filters](/img/findings-filters.png#sm-width)

src/components/procedure/_export-findings-csv.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
You can export findings to a **CSV** file. Semgrep can export up to **10,000 most recent findings**. For findings greater than 10,000, you must use the [<i class="fas fa-external-link fa-xs"></i> API](https://semgrep.dev/api/v1/docs/).
1+
You can export findings to a **CSV** file. Semgrep can export up to **10,000 most recent findings**. To export more than 10,000 findings, you must use the [<i class="fas fa-external-link fa-xs"></i> API](https://semgrep.dev/api/v1/docs/).
22

33
Semgrep exports all findings to the CSV file regardless of the filters you apply on the page.
44

static/img/download-csv.png

100755100644
10.7 KB
Loading

static/img/findings-filters.png

5.02 KB
Loading

0 commit comments

Comments
 (0)