Bundle view

The Bundle View displays the findings in a bundle. Bundles are sets of findings created in AppScan® Source for Analysis.

To view the findings in a bundle, double-click a bundle name in the Bundles View. The bundle name appears as the title in the Bundle View. You can also import a bundle and view its contents in the Bundle View. You cannot modify or delete findings in a bundle.

The Bundle View, similar to a findings table contains the following detailed information:

Table 1. Bundle view columns
Column Description
Trace An icon in this column indicates that a trace exists for lost or known sinks.
File Name of the code file in which the security finding or scan coverage finding occurs. File paths in findings are relative to the scanned project working directory.
Classification Type of finding: Definitive or Suspect security finding - or Scan Coverage finding.
Note: In some cases, a classification of None may be used to denote a classification that is neither a security finding or a scan coverage finding.
Severity
  • High: Poses a risk to the confidentiality, integrity, or availability of data and/or the integrity or availability of processing resources. High-severity conditions should be prioritized for immediate remediation.
  • Medium: Poses a risk to data security and resource integrity, but the condition is less susceptible to attack. Medium-severity conditions should be reviewed and remedied where possible.
  • Low: Poses minimal risk to data security or resource integrity.
  • Info: The finding, itself, is not susceptible to compromise. Rather, it describes the technologies, architectural characteristics, or security mechanisms used in the code.
Vulnerability Type Vulnerability category, such as Validation.Required or Injection.SQL.
Context Snippet of code that surrounds the vulnerability.
Calling Method The function (or method) from which the vulnerable call is made.
CWE ID and topic of the community-developed dictionary of common software weaknesses (Common Weakness Enumeration (CWE) topics).
Line Line number in the code file that contains the vulnerable API.
Notes Any notes added to this finding.
Defect ID Defect ID from a defect tracking system.