Assets

Use the Assets page to overview, filter, and sort your assets. And, if applicable, see helpful information about IaC data in each asset.

If your asset has any IaC issues, you can find the IaC tag on that asset, and as top files with IaC issues (highest number of IaC issues).

To see the asset page:

  1. Click the name of an asset to expand it and see its findings.

  2. Click See all IaC issues or See exposed secrets to open the asset page that provides details about a single asset.

From the Dashboard, you can expand an asset to view issues. Click on an issue to see remediation instructions. Spectral classifies issues as code issues or infrastructure ("infra") issues. For secrets issues, SpectralOps tests the validity of keys. A live key or token is labeled as valid.

The Assets page includes these tabs:

  • Secrets - Shows the exposed secrets that Code Security found.

  • IaC - Shows the infrastructure-as-code issues that Code Security found in the asset grouped by file. Each IaC issue shows the IaC resource related to it.

  • CI/CD Hardening - Shows issues in the repository settings, for example, when the main or master branch has no policy for a merge.

  • Sprawl - Shows secrets that appear in multiple locations in an asset or across assets.

The severity of an issue appears to the left of the name of the issue. These are the severity levels:

Severity Level

Meaning

Suggested Action

Critical

An asset is compromised.

Resolve the issue immediately.

High

An asset is at high risk to become compromised.

Resolve the issue immediately.

Medium

A potential security risk exists for the asset.

Resolve the issue within a reasonable time period.

Low

There is no immediate risk, but the asset does not comply with best practices.

Take action when possible to implement best practices.

Informational

There is no immediate risk.

Use the information to improve your security posture.

  1. To the right of the issue, click this button: .

    A list of users opens.

  2. Search or scroll through the list to find the relevant user.

  3. Click the name of the user.

Click the check mark button to the right of the issue. If Spectral finds the issue again, it marks it as a regression. To unresolve an issue, click this button: .

  1. From the top toolbar, open the relevant tab (for example: Secrets).

  2. Optional - From the left toolbar, apply filters .

  3. In the top right, click this button:.:

  4. Select a format for the report:

    • Export CSV

    • Export PDF

    Your web browser downloads the report.

  1. Create the Jira integration. See Code Security Integrations

  2. In the Code Security Dashboard, navigate to the issue.

  3. Select the checkbox to the left of the issue.

  4. From the toolbar above the table, expand Actions > click Create Jira issue.

    The Create Jira Issue window opens.

  5. Fill the required fields.

  6. Click Create.

After setting up your integration, select the issue and click the "Assign" button,

Select the Jira project in which you would like to open an issue, add a Summary of the problem and edit the description.

Once you create a Jira issue, a “Jira” label will be assigned to the spectral Issue so you can track the progress in Jira.