You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
docs: remove parser line numbers from IriusRisk documentation
Per PR review feedback, removed line number references from field
mapping tables and prose sections to reduce maintenance burden
when parser code changes.
Authored by T. Walker - DefectDojo
Copy file name to clipboardExpand all lines: docs/content/supported_tools/parsers/file/iriusrisk.md
+33-33Lines changed: 33 additions & 33 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: "IriusRisk Threats Scan"
3
3
toc_hide: true
4
4
---
5
5
6
-
The [IriusRisk](https://www.iriusrisk.com/) parser for DefectDojo supports imports from CSV format. This document details the parsing of IriusRisk threat model CSV exports into DefectDojo field mappings, unmapped fields, and location of each field's parsing code for easier troubleshooting and analysis.
6
+
The [IriusRisk](https://www.iriusrisk.com/) parser for DefectDojo supports imports from CSV format. This document details the parsing of IriusRisk threat model CSV exports into DefectDojo field mappings, unmapped fields, and transformation notes for easier troubleshooting and analysis.
7
7
8
8
## Supported File Types
9
9
@@ -47,26 +47,26 @@ Sample IriusRisk scans can be found in the [sample scan data folder](https://git
47
47
<details>
48
48
<summary>Click to expand Field Mapping Table</summary>
49
49
50
-
| Source Field | DefectDojo Field |Parser Line # |Notes |
| static_finding | False | Threat model data is neither static nor dynamic analysis |
81
+
| dynamic_finding | False | Threat model data is neither static nor dynamic analysis |
82
+
| active | True (False when "Very low") | Set to False when Current Risk is "Very low" (fully mitigated) |
83
83
84
84
</details>
85
85
86
86
## Special Processing Notes
87
87
88
88
### Status Conversion
89
89
90
-
IriusRisk uses a five-level risk scale that is mapped to DefectDojo severity levels (lines 8-14):
90
+
IriusRisk uses a five-level risk scale that is mapped to DefectDojo severity levels:
91
91
92
92
-`Critical` → Critical
93
93
-`High` → High
94
94
-`Medium` → Medium
95
95
-`Low` → Low
96
96
-`Very low` → Info
97
97
98
-
Any unrecognized risk value defaults to Info (line 53). The mapping uses the "Current Risk" column, which reflects the risk level accounting for existing controls and represents the most accurate current exposure.
98
+
Any unrecognized risk value defaults to Info. The mapping uses the "Current Risk" column, which reflects the risk level accounting for existing controls and represents the most accurate current exposure.
99
99
100
100
### Title Format
101
101
102
-
Finding titles are derived from the "Threat" column (line 51). Threat descriptions longer than 150 characters are truncated to 147 characters with a "..." suffix appended. Shorter threat texts are used as-is without modification.
102
+
Finding titles are derived from the "Threat" column. Threat descriptions longer than 150 characters are truncated to 147 characters with a "..." suffix appended. Shorter threat texts are used as-is without modification.
103
103
104
104
### Description Construction
105
105
106
-
The parser constructs a structured markdown description containing all relevant CSV fields (lines 56-72):
106
+
The parser constructs a structured markdown description containing all relevant CSV fields:
107
107
108
108
1. Full threat text (untruncated, regardless of title truncation)
109
109
2. Component name
@@ -122,19 +122,19 @@ Each field is formatted as a bold markdown label followed by the value, with fie
122
122
123
123
### MITRE Reference / CWE Extraction
124
124
125
-
The parser reads the "MITRE reference" column (lines 79-87) and applies conditional mapping:
125
+
The parser reads the "MITRE reference" column and applies conditional mapping:
126
126
127
127
- If the value matches the pattern `CWE-NNN` (e.g., "CWE-284"), the integer portion is extracted and set on the finding's `cwe` field.
128
128
- If the value is present but does not match the CWE pattern (e.g., "T1059" for a MITRE ATT&CK technique), the full value is stored in the finding's `references` field.
129
129
- If the column is empty, neither field is set.
130
130
131
131
### Mitigation Construction
132
132
133
-
The mitigation field is populated directly from the "Risk Response" column (line 94), which contains the IriusRisk mitigation status in the format: "Planned mitigation: X%. Mitigated: Y%. Unmitigated: Z%." This preserves the original IriusRisk mitigation tracking percentages.
133
+
The mitigation field is populated directly from the "Risk Response" column, which contains the IriusRisk mitigation status in the format: "Planned mitigation: X%. Mitigated: Y%. Unmitigated: Z%." This preserves the original IriusRisk mitigation tracking percentages.
134
134
135
135
### Active/Inactive Logic
136
136
137
-
Findings are set to active by default (line 96). When the "Current Risk" value is "Very low", the finding is set to inactive, as this indicates the threat has been fully mitigated through implemented countermeasures.
137
+
Findings are set to active by default. When the "Current Risk" value is "Very low", the finding is set to inactive, as this indicates the threat has been fully mitigated through implemented countermeasures.
0 commit comments