Skip to main content

Managing intel

Intel are the issues Red Kite detects on your attack surface. This guide shows how to triage them and track them until they are fixed.

Triaging intel​

Go to Visualization > Intel to see the intel records. Use the intel filters to focus your work, for instance:

is:open severity:critical severity:high

For each record:

  1. Open it to read the description, the recommendations and the affected resource.
  2. Confirm whether the issue is real and update the status accordingly.
  3. If needed, override the severity. An overridden severity is kept, even if the intel definition's severity changes later.
  4. Use the timeline to leave comments for your team. Status and severity changes are also recorded in the timeline, with their author.

Following up​

Use the statuses to keep track of each issue. A typical lifecycle looks like this:

Open → Validated → Ready to retest → Resolved
  • Move an issue to Validated once you confirmed it, and assign it to its owner, for instance with a comment.
  • Once the owner applied a fix, move it to Ready to retest. You can launch a job on the resource to check the fix right away, instead of waiting for the next scan.
  • Move it to Resolved once the fix is confirmed.
  • Close the issues that do not need a fix as False positive or Risk accepted, with a comment explaining why.

If a resolved issue is detected again, Red Kite reopens it as Regression. See Statuses.

tip

Since the default intel ignores blocked resources, blocking the resources that are not yours removes them from your intel. Sorting out your resources first makes the intel much more relevant.