Overview
Intro and context
Vulcan ConnectX/Report Connector enables you to upload CSV, ZIP, XLS, and XLSX files from SAST/DAST and Vulnerability assessment tools that might not be supported yet through Vulcan Connectors. Once you upload a file, you'll be able to map out the fields.
More information about the Vulcan report can be found under the Vulcan ConnectX/Report user guide.
DAST fields mapping
The following fields are used for mapping each header of the file into Vulcan fields:
DAST Field | Description |
| Primary name of the web application |
| Last time the asset was scanned |
| This field lets you ingest existing tags from the vendor's platform and map those tags into Vulcan Asset Tags and Business Groups. You can map as many CSV headers to this field as you want. Each tag requires its independent column, and each column can be mapped to tags as well as to other categories. Read here about the importance of Business Groups and Tags. |
| The relevant data you want to view in the asset itself. You can map as many CSV headers to this field as you want. |
| The parent URL of the application |
| The specific URL location of the vulnerability within the application. This is an important field for DAST results. |
| The name of the vulnerability as reported from the CSV |
| Numeric risk score as given from the CSV. This is typically the CVSS v3, but other severity fields can be mapped here instead. Using this value, Vulcan can provide the risk calculation basis for the Vulcan risk score. Note that the value range must be between 0 and 10. |
| If CVE is available, it allows the Vulcan Platform to map and point to solutions and threat intelligence. |
| If CWE is available, it allows the Vulcan Platform to map to OWASP Top 10 categories for prioritization. This is an important field for DAST results. |
| The description of the vulnerability as given in the CSV |
| The date on which the vulnerability was first found. If this value is not mapped, the default value will be set to the time Vulcan first ingested the vulnerability into the platform. |
|
|
| Unique Vulnerability identifier |
| Vulnerability identifier for an asset-vulnerability connection. |
SAST fields mapping
The following fields are used for mapping each header of the file into Vulcan fields:
SAST Field | Description |
| The primary name of the web application |
| The last time the asset was scanned |
| This field lets you ingest existing tags from the vendor's platform and map those tags into Vulcan Asset Tags and Business Groups. You can map as many CSV headers to this field as you want. Each tag requires its independent column, and each column can be mapped to tags as well as to other categories. Read here about the importance of Business Groups and Tags. |
| The relevant data you want to view in the asset itself. You can map as many CSV headers to this field as you want. |
| The scanned file under the asset |
| The line number on which the vulnerability was reported |
| The name of the vulnerability as reported from the CSV |
| Numeric risk score as given from the CSV. This is typically the CVSS v3, but other severity fields can be mapped here instead. Using this value, Vulcan can provide the risk calculation basis for the Vulcan risk score. Note that the value range must be between 0 and 10. |
| If CVE is available, it allows the Vulcan Platform to map and point to solutions and threat intelligence. |
| The description of the vulnerability as given in the CSV |
| The date on which the vulnerability was first found. If this value is not mapped, the default value will be set to the time Vulcan first ingested the vulnerability into the platform. |
|
|
Vulnerability Assessment Tools fields mapping
The following fields are used for mapping each header of the file into Vulcan fields:
Vulnerability assessment tool field | Description |
| Primary machine name of asset (typically a hostname, but can be FQDN or NetBIOS depending on the source of the asset). |
| The asset's operating system. For example, if the asset is Windows Server 2016, the cell should say "Windows Server 2016." |
| This field lets you ingest existing tags from the vendor's platform and map those tags into Vulcan Asset Tags and Business Groups. You can map as many CSV headers to this field as you want. Each tag requires its independent column, and each column can be mapped to tags as well as to other categories. Read here about the importance of Business Groups and Tags. |
| The relevant data you want to view in the asset itself. You can map as many CSV headers to this field as you want. |
| The IP address of the Asset. |
| The name of the vulnerability as reported from the CSV |
| Numeric risk score as given from the CSV. This is typically the CVSS v3, but other severity fields can be mapped here instead. Using this value, Vulcan can provide the risk calculation basis for the Vulcan risk score. Note that the value range must be between 0 and 10. |
| If CVE is available, it allows the Vulcan Platform to map and point to solutions and threat intelligence. |
| If CWE is available, it allows the Vulcan Platform to map to OWASP Top 10 categories for prioritization. This is an important field for DAST results. |
| The description of the vulnerability as given in the CSV |
| The date on which the vulnerability was first found. If this value is not mapped, the default value will be set to the time Vulcan first ingested the vulnerability into the platform. |
|
|
| Unique Vulnerability identifier |
| Vulnerability identifier for an asset-vulnerability connection. |