Conversation
…it Finding form The Pro UI Add/Edit Finding form now exposes EPSS Score, EPSS Percentile, Known Exploited, Used in Ransomware and KEV Date Added in a Threat Intelligence panel under Optional Fields. Document the panel, how the EPSS/KEV sync treats hand-entered values (replaced on CVE-backed findings, kept on findings without a CVE), that hand-set values feed priority and risk, and that a rule reacting to a hand-set flag should use the KEV: Known Exploited condition because the FedRAMP review template keys on Exploit Maturity from the threat-intelligence feed. Also fix the "ESS" typo on the Pro Findings reference page. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[sc-15506]
Description
Documentation only. The Pro UI Add/Edit Finding form now exposes the threat-intelligence fields (EPSS Score, EPSS Percentile, Known Exploited, Used in Ransomware, KEV Date Added) in a collapsed Threat Intelligence panel under Optional Fields, so a finding created by hand without a CVE can still carry exploit evidence. These pages are updated to match:
triage_findings/findings_workflows/editing_findings.md: new Threat Intelligence bullet in the Edit Finding form field list. Explains that the EPSS/KEV sync normally owns these values, how the sync treats hand-entered values (replaced on a finding that references a CVE, KEV facets cleared when none of its CVEs are KEV-listed, kept on a finding without a CVE), that hand-set values feed priority and risk, and that a Rules Engine rule reacting to a hand-set flag should use the KEV: Known Exploited condition because the FedRAMP review template keys on Exploit Maturity from the threat-intelligence feed.triage_findings/finding_scoring/epss_kev.md: the "On the Finding" bullet notes the values can also be set by hand and links to the section above.asset_modelling/engagements_tests/PRO__findings.md: fixes the "ESS" typo and adds a sub-bullet about editability and sync overwrite.triage_findings/findings_workflows/create_findings_manually.md: one paragraph pointing at the panel.English pages only; translated siblings are regenerated from the English source per
docs/TRANSLATIONS.md.Test results
Docs-only change, no code or tests touched. Proofread; all internal links point at existing pages and anchors.
Documentation
This PR is the documentation change for a Pro UI form update shipping on the same release line (bugfix).