Vulnerabilities Workbench

Review and triage findings across your organization

Overview

The Vulnerabilities page provides an organization-wide view of open security findings. Use it to review findings across projects, investigate details, export results, and apply triage decisions without opening each scan separately.

The Vulnerabilities Workbench is available to organizations where it has been enabled by Corgea. Contact your Corgea representative to request access. Users also need permission to view at least one finding type.

Findings are separated into these tabs:

• Secrets
• SAST
• Logic & Auth
• SCA Packages
• Containers
• IaC

Each tab is available only when you have permission to view that finding type. The badge on a tab shows its unfiltered open-finding count. Counts of 1,000 or more are shortened (for example, 1.8K).

Find and review findings

Select a tab, then expand its groups and projects to reach individual findings. Grouping is tailored to each finding type—for example, SCA findings begin with packages, container findings with images, and IaC findings with rules. Counts of 1,000 or more are shortened (for example, 24.6K). Point at a shortened count to see the exact number.

Use Previous, Next, and page numbers, when they appear, to move through grouped results. Each list shows the current row range and a total when Corgea has one.

Use the status controls to switch between Open, Fixed, False Positive, and the other statuses available for that finding type. Click the filter icon to show severity, project, team, and tag filters. A count on the icon shows how many of those filters are set while the row is hidden. Hiding the row leaves them active. Selecting multiple tags shows findings from projects that have any selected tag. Tag matching is case-sensitive and must match the stored project tag exactly. SCA Packages adds a reachability filter on the main toolbar.

Use the Team filter on any tab to show findings from projects owned by the selected team that you have permission to view. Combined with a project filter, it shows only projects that match both filters. The team filter also applies when expanding groups, exporting filtered results, and selecting all findings matching the current filters.

Select a finding to open the same details panel used on scan pages. From the panel, you can review evidence, assign the finding, and change its status with Current Status. Use Open Full View when it is shown to open the full finding page. The address bar keeps the selected finding, so opening that link again restores the panel when the finding is still in the current results. A comment is required when changing a disposition, and it has to explain the decision rather than repeat it—see Triage Justifications. When you mark a supported finding as accepted risk, you can also choose when that expires.

SAST findings carried forward from a previous scan during an incremental scan retain their triage status, justification, assignee, due date, and accepted-risk expiry date. Carrying a finding forward does not reset or remove its due date or expiry date.

SCA and container findings show package details and history in that panel, plus reachability when it is available.

If your company requires triage approval for False positive or Accepted risk, changing to that disposition creates a request and leaves the finding unchanged. A different authorized reviewer can approve or reject it from the approvals queue or the finding details. Requesters can withdraw their own pending requests.

Export findings

Click Export to download a CSV containing the findings that match the active tab, status, search, and filters. The export includes the latest occurrence of each finding and is limited to 25,000 rows.

To export only particular findings, select them and click Export selection in the action bar.

Triage findings in bulk

Select individual findings or an expanded group. You can also choose Select all findings matching the current filters after making an initial selection.

The bulk action bar lets you:

• Assign findings to a team member
• Mark findings as false positives
• Export the selection

Reopen a finding, or mark it as accepted risk, from Current Status on that finding. The bulk bar does not include those actions.

Bulk status changes require a comment, and the same justification requirement applies: a comment that only repeats the decision is sent back and no status is changed. The action bar summarizes the number of selected findings, projects, and teams, and reports any findings that were skipped. A bulk selection can contain up to 1,000 findings.

Assignment and disposition controls appear only when you have permission to change that finding type. Export remains available with view permission.