...
...
...
...
...
...
- High is associated to Copyleft, Copyrighted and Propietary
- None is associated to PublicDomain, Permissive and WeakCopyleft
- Unknown is associated to licenses that without a License Type.
...
...
...
...
...
Required Permissions
...
...
...
Scope of Changes
Custom changes to the level of License Risk of a License can be applied to several scopes
...
Changes to the level of Risk of a License
...
...
...
...
...
Change applies to current components as well as new components discovered in future analyses.
...
...
Change applies to current components as well as new components discovered in future analyses.
Components belonging to other app using this license remain unchanged
...
Component
...
3
...
Change to the license applies to the selected component, regardless the app using the component
...
App-Comp
...
4
...
Change to the license applies to the selected component in the selected app.
Selected components using this license belonging to other app remain unchanged.
...
...
For example, we could have configured:
- License L is High for application A (application scope: 2)
- License L is Medium for component C (component scope: 3)
What will be the level for component C in application A ? Precedence 3>2, L will be Medium for C in A.
...
...
...
...
Changes to Licenses Risks can be done at several pages:
| Scope | Kiuwan Insights Page |
|---|---|
| Global and/or Application |
|
| Component and/or App-Comp |
|
Licenses Policies page
You can access Licenses Policies page from License tab
Licenses Policies allows you to make changes based on Licenses and/or Components
By License
...
mute CVE vulnerabilities
You can mute at different locations:
- Components tab (selecting a component row, and clicking on the Mute Vulnerabilities component's menu option)
- Security tab (selecting a CVE row, and clicking on the Mute Vulnerabilities menu option of any of the components affected by that CVE)
- Selecting Mute Vulnerabilities option at Components / Security tab's hamburger menu.
- Insights management section in the admin space
Global Mutes Administration
Kiuwan Insights allows you to globally administrate the mutes defined within your Kiuwan account.
You can access the Global Mute Admin by selecting the Mute Vulnerabilities option at the Components / Security tab's hamburger menu.
Mute Vulnerabilities allows you to manage mutes based on Vulnerabilities and/or Components
By Vulnerability
When "By Vulnerability" tab is selected, the full list of
...
Vulnerabilities discovered through all the applications of your Kiuwan account is displayed.
Click a CVE to open the list of components affected by that vulnerability.
Click Modify in the component row to open the Mute Vulnerabilities dialog.
Then, you can decide to mute the vulnerability for the selected component either all applications, for a set of apps or only one application.
After muting, the scope of the mute is at the Mute Vulnerabilities tab.
By Component
When By Component
Clicking on Modify button of a License will open Modify License Policy dialog.
Global scope
- By selecting Custom Global Risk dropdown list at the License level, you will change it to Global scope.
Application scope
- Additionally, by selecting the Custom Risk dropdown list of an application, you will change it to Application scope.
See Scope of Changes for explanation of scopes.
By Component
...
...
components affected by any CVE through all the applications of your Kiuwan account is displayed
Click a Component to open the list of CVEs found for that component.
Clicking Modify for a CVE will open Mute Vulnerabilities dialog.
Then, you can decide to mute the vulnerability for the selected component either for all applications, for a set of apps, or only for one application.
After muting, you will see the scope of the mute in the Mute Vulnerabilities tab.
Muting at the Component tab
Also, you can mute in the Components tab by clicking
Clicking on Modify button of a License will open Modify License Policy dialog.
Component scope
- By selecting Custom Global Risk dropdown list at the Component level, you will change it to Component scope.
Application scope
- Additionally, by selecting the Custom Risk dropdown list of an application, you will change it to App-Comp scope.
See Scope of Changes for explanation of scopes.
Licenses page
You can modify the License Risk of any license/component from License tab.
By License
...
...
Clicking on Modify Policy will open Modify License Policy dialog
Then, you can decide either to change the level at a Global or Application scope
See Scope of Changes for explanation of scopes.
By Component
If you want to modify the License Risk level of a specific Component, open the License row and select Modify License option of the selected component.
Clicking on Modify Policy will open Modify License Policy dialog for the selected component
Then, you can decide either to change the level at a Component (Global value) or App-Comp (Application value) scope
See Scope of Changes for explanation of scopes.
In the Mute Vulnerabilities dialog, select the CVE to Global Mute or Application Mute.
After clicking Save the muted vulnerability grays out when expanding the component.
Muting at the Security tab
The mute option is found also in the Security tab. Click a Vulnerability to display more details and the list of components affected by the vulnerability. At the bottom, in the Component section, click each dropdown button to mute vulnerabilities for each one of them.
There is a special case (as you can see below). It happens when there are two mutes for that CVE-component: it's muted by a Global mute and also by an Application mute. Then, there are two mutes, i.e. the component is muted for two reasons.
Whatever the mute reason, just select the Mute Vulnerabilities from the dropdown menu at the right of a specific Component.
Then, the Mute Vulnerabilities dialog opens.
The Mute Vulnerabilities dialog lets you select the CVE to mute and decide Global Mute or Application Mute.
Muting in Insights Management
Open the drop-down menu on the upper-right corner and select Insights Management
The Mute Vulnerabilities page displays:
Please follow the instructions mentioned in the steps before to mute vulnerabilities.
...