ProjectDiscovery: Vulnerability Scanning

[topher-lo]

User story:

• Event-driven: I get new scan result coming in from webhook. Now triage vulnerabilities and escalate (if needed)
• Scheduled triaging:
  • Every 24 hours, collect all vulnerabilities in the past 24 hours
  • Collect all tickets across multiple projects in a ticket tracker (e.g. linear)
  • Given Nuclei vulnerability ID, search if it matches with any ticket
  • If matches ignore, otherwise open new ticket

Implementation details

• API: Get all scan results with time and severity filters
• Must make sure scan_id in vulnerability object from PD matches with a scan_id metadata field in the external ticketing system
• For the MVP, focus on results AKA vulnerabilities endpoints.

Testing strategy

• The API needs stable: conforms to OpenAPI spec and with standard versioning
• Will just mock the response themselves (no need for live testing)

Additional notes

• Any use case for controlling scans from the soar? https://docs.projectdiscovery.io/api-reference/scans/create-scan