Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

risks.json is incomplete (compared to risks.xlsx) #96

Open
srcnuzn opened this issue Sep 3, 2024 · 1 comment
Open

risks.json is incomplete (compared to risks.xlsx) #96

srcnuzn opened this issue Sep 3, 2024 · 1 comment

Comments

@srcnuzn
Copy link

srcnuzn commented Sep 3, 2024

When I generate the report, I see more information in the risks.xlsx than in the risks.json file.
For example, the Excel sheet has a column CWE, but risks in the JSON file do not contain this (useful) information.
Is this intentional?

Example:

    {
        "category": "missing-build-infrastructure",
        "risk_status": "unchecked",
        "severity": "medium",
        "exploitation_likelihood": "unlikely",
        "exploitation_impact": "medium",
        "title": "\u003cb\u003eMissing Build Infrastructure\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eMy Server\u003c/b\u003e as an example)",
        "synthetic_id": "missing-build-infrastructure@my-server",
        "most_relevant_data_asset": "",
        "most_relevant_technical_asset": "my-server",
        "most_relevant_trust_boundary": "",
        "most_relevant_shared_runtime": "",
        "most_relevant_communication_link": "",
        "data_breach_probability": "improbable",
        "data_breach_technical_assets": []
    },

image

@ezavgorodniy
Copy link
Collaborator

dunno the intention here but from code perspective that's 2 different branches of code to get the data which needs to be written into Excel or Json

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants