Investigate and remediate code weakness issues - Administrator Guide - Cortex Cloud Posture Management - Cortex CLOUD

General details

The top section of the side panel displays the following fields:

Urgency details

The Urgency Details section provides the contextual risk signals that determine the urgency classification of the code weakness issue. Urgency extends beyond static severity by incorporating runtime and business context.

Code weakness details

The Code Weakness Details section provides classification and context for the detected weakness:

Code evidence

The Code Evidence section displays the source code context of the code weakness:

Code-to-Cloud graph

The Code-to-Cloud graph visualizes the traceability path from the source code file containing the code weakness in the repository to the deployed cloud resource. The Code-to-Cloud graph enables you to understand the blast radius of the code weakness by identifying which production assets inherit the vulnerable code

Understand SLA compliance

Each code weakness issue is tracked against an SLA target based on the issue severity. The SLA status is displayed in the issue side panel under General Details.

The SLA calculation uses the issue creation timestamp and the configured severity-to-target-days mapping. Resolved issues stop the SLA clock at the resolution timestamp

Effective prioritization of code weakness issues requires evaluating multiple contextual signals beyond static severity. Cortex Cloud provides two complementary prioritization mechanisms:

Urgency-based prioritization

Urgency incorporates runtime and business context to surface the code weaknesses that pose the greatest operational risk. Prioritize code weakness issues using the following urgency hierarchy:

Severity-based prioritization

Severity reflects the inherent risk of the code weakness based on the detection rule and CWE classification. Use severity as the baseline filter:

The Code Weaknesses page supports the following actions:

Change resolution status

Update the resolution status to track remediation progress.

Status values: New: The issue has not been triaged; In Progress: Remediation is underway; Resolved: The code weakness has been fixed and verified.

Assign an issue

Assign a code weakness issue to a specific user for remediation.

Change severity

Modify the severity level of a code weakness issue.

Note: This action can only be performed from the main issues table and is not available in the issue side panel.

Apply fix guidance

For code weakness issues, the side panel provides fix guidance specific to the weakness type and programming language. Fix guidance is accessed from the Actions tab in the issue side card.

Example: fix guidance for a SQL Injection weakness (CWE-89)

Replace dynamic string concatenation in SQL queries with parameterized queries or prepared statements.

Before (vulnerable):

query = "SELECT * FROM users WHERE username = '" + user_input + "'"
cursor.execute(query)
  

After (secure):

query = "SELECT * FROM users WHERE username = %s"
cursor.execute(query, (user_input,))
  

Example: fix guidance for a Cross-Site Scripting weakness (CWE-79)

Apply output encoding to all user-controlled data rendered in HTML context.

Before (vulnerable):

document.getElementById("output").innerHTML = userInput;
  

After (secure):

document.getElementById("output").textContent = userInput;
  

Example: fix guidance for a Path Traversal weakness (CWE-22)

Validate and sanitize file path inputs to prevent directory traversal.

Before (vulnerable):

String filePath = request.getParameter("file");
File file = new File("/uploads/" + filePath);
  

After (secure):

String filePath = request.getParameter("file");
Path resolvedPath = Paths.get("/uploads").resolve(filePath).normalize();
if (!resolvedPath.startsWith("/uploads")) {
    throw new SecurityException("Path traversal attempt detected");
}
File file = resolvedPath.toFile();