AST Issue Management

Traceable's Issues page provides a view of detected API security issues, enabling you to monitor, analyze, and remediate them effectively. The Issues page lists these issues, providing important information such as severity, endpoint count, and OWASP category.

What will you learn in this topic?

By the end of this topic, you will be able to:

• The issue flow navigation and drill down into each issue to access its evidence, context, and logs.

• The status of issues and remediation methods.

• The Issue auto-resolution and deletion logic.

Refer to the Issues Overview to understand issues, their lifecycle, and their key components.

Navigate the issues flow

When you first land on the Issues page, Traceable shows a list of detected issues, grouped by their name. This list displays key information, including Severity, Last Seen, and the Number of API Endpoints where the issue was observed. The grouping and filtering options enable you to narrow your focus based on a specific indicator. After applying these options, you can drill down into a specific issue to view more detailed information, such as Overview, References, and Status Log.

You can view the evidence for a particular issue for deeper analysis of the data, including its URL, status code, last seen, mutations, and assertions. The Detailed View page for an issue is divided into sections that offer data, logs, and insights that help you understand its impact on your application.

1. Main issues view

Upon navigating to the Issues page, Traceable displays a comprehensive list of issues in the Open or Reopened state. This page serves as a dashboard where you can:

• View listed issues — Each issue is presented with details, such as its severity and the number of endpoints it was observed in. For more information, see Issue Listings.

• Group and filter — While Traceable groups the data on the page based on Issue Names by default, you can group the data based on other categories as well. Additionally, you can filter data based on the issue's impact or your specific requirements. For more information, see Grouping and Filtering Options.

2. Drill down into an issue

After choosing how to group and filter the issues, you can drill down into a specific issue for a more granular view. Based on the grouping, click a list item to view the issues under it, and then click the Issue Name. The detailed view page highlights the following information about the issue:

• Issue Details — The top section of the page provides details about the issue, including the Endpoint, Source, Last Seen, Severity, CVSS Score, OWASP Rank, and CWE Rank. Using these details, you can take the necessary steps to mitigate such issues and enhance your application security.

• Overview — The Overview section describes the issue, its impact, the attack methodology, and how to mitigate it. Traceable also provides you with the Issue Evidence for you to drill down on.
  If you have enabled AI Features in your account, Traceable shows AI Generated Insights along with the Evidence in the Overview section. These insights are context-sensitive, and you can use them to analyze, prioritize issues, and work towards their remediation.
  

  

  For each issue detected using AST, Traceable displays the following evidence:

  • Assertions and Mutations applied by Traceable as part of the scan. You can also customize these according to your requirements. For more information, see Mutation and Assertion Overrides.

  • The Headers, Cookies, and Body in the Request and Response of the API endpoint.

  For issues detected by AI scan policies, Traceable displays the evidence as a conversation that triggered the vulnerability. For information on setting up an AI scan, see AI Security Testing.
  

  

• References — The References tab provides curated links to trusted external sources where you can gather deeper insights into an issue's nature, impact, and remediation. This tab helps you understand key details about the issue, such as the attack mechanism and its effects, which you can use to inform remediation.

• Status Log — The Status Log tab provides a timeline of all status changes for the issue, including timestamps and updates. This helps you track the issue lifecycle and understand when and how the issue was opened, reopened, or fixed.

• Remediation — Based on the above details, you can take the necessary actions to remediate the issue. Traceable provides the following options for you to do so:

  • Integrations — Traceable supports multiple integrations for you to choose from. You can use either of these to create tickets in your corresponding projects and work towards their remediation. For more information, see Integrations.

  • Status Change — Use the drop-down to change an issue's status as needed. When changing the status, Traceable also displays a pop-up window where you can add a comment for the status change. This helps you maintain a log of historical events related to the issue. Further, this comment is visible in the Status Log tab of the issue where you changed the status. For more information on the available statuses, see Issue Status Management and Remediation.

• Create Virtual Patch — Virtual patching enables you to apply a temporary Web Application Firewall (WAF) rule to an API endpoint where API Security Testing (APIST) has detected a vulnerability, without waiting for a code-level fix. Traceable scopes an existing WAF threat rule to the affected endpoint, so it can monitor or block the exact attack pattern the scan identified while your team resolves the underlying issue.

  Why virtual patching matters

  Fixing a code-level vulnerability can take days or weeks, and the endpoint stays exposed until it does. It is useful in the following ways:

  • It allows you to apply protection directly from the Issues page.

  • It enables Traceablet to scope an existing WAF rule to only the affected endpoint.

  • It allows you to choose Monitor mode or Blocking mode.

  How virtual patching works

  Virtual patching lets you mitigate an eligible vulnerability at the affected API endpoint without waiting for a permanent code-level fix. When an issue detected by API Security Testing meets the eligibility requirements, Traceable lets you create a virtual patch directly from the issue.

  The virtual patch workflow consists of the following steps:

  

  1. Detection — API Security Testing detects a vulnerability and creates an issue for the affected API endpoint.

  2. Eligibility evaluation — Traceable evaluates whether the issue is eligible for virtual patching. It also checks your environment's protection state, including whether a WAF is deployed and whether a matching WAF rule is already enabled.

  3. Patch availability — If the issue meets the eligibility requirements, Traceable displays the Create Virtual Patch action on the issue.

  4. Create the virtual patch — From the issue, select Create Virtual Patch and review the WAF rule and endpoint details before applying the patch.

  5. Track the patch — Traceable links the virtual patch to the source issue and WAF rule. You can use this linkage to track how frequently the rule is evaluated, detects matching traffic, and blocks requests.

  Steps to create a virtual patch

  To create a virtual patch for an eligible issue, complete the following steps:

  

  1. Navigate to Testing → Issues.

  2. Select the issue for which you want to create a virtual patch.

  3. Click Create Virtual Patch.

  4. Select the Threat Type and Threat Rules.

  5. Select the Action you wish to take. For example, Monitor or Block.

  6. Select Create.

  7. Verify that the patch is active and scoped to the intended endpoint. For more information, see Custom Signatures.

  The following demo walks you through the steps to create a virtual patch in the issues page under Testing:

Issue status management and remediation

Traceable enables you to create integration tickets and change the status according to your requirements for issue remediation.

Supported Statuses

You can manually change the state of the detected issue to any of the following:

Issue remediation

You can update the status or create integration tickets using either of the following methods:

• Individual Update — Update the status or create tickets for each issue individually.

• Bulk Update — Update the status or create tickets for multiple issues at once.

The following tabs outline the steps for the methods above:

Individual Update

Bulk Update

To remediate an issue, complete the following steps:

1. If the Issues page is grouped by a category, click the arrow corresponding to the category.

2. Click the issue name you wish to remediate.

3. In the Issue Detailed View page’s top right corner, click the Integration icon(s) or Status drop-down according to your requirements.

   Note

   If you have not configured an integration, you can do so directly by clicking the relevant Integration icon. For the configuration steps, see the corresponding document under Integrations.

4. Do one of the following:

   • If you clicked the Integration icon(s), specify the ticket details according to your requirements.

   • If you clicked the Status drop-down, change the status, and add the comment in the pop-up window according to your requirements. This helps you maintain a log of historical events related to the issue. Further, the comment is visible in the Status Log tab of the Issue’s Detailed View.
     

     

You can remediate multiple issues at once by performing a bulk update. This includes changing the issue status in Traceable or creating Jira tickets for multiple issues simultaneously.

Step 1: Select Issues

1. Navigate to the Issues page.

2. Use filters or grouping as needed to narrow down the list.

3. Select the checkboxes next to the issues that you wish to update.

Step 2: Perform Bulk Action

At the bottom of the page, click one of the following options:

• Update Status - to update the status of the selected issues within Traceable.

• Jira icon - to create Jira tickets for the selected issues.

Note

• Bulk ticket creation is currently supported only for the Jira integration.

• You must have an existing Jira integration configured to create tickets. If not already configured, clicking the Jira icon will prompt you to complete the integration setup. For configuration steps, see Jira Integration.

---

Updating Issue Status in Bulk

When you click Update Status, a pop-up window appears where you can:

• Select the new status for the selected issues.

• Optionally add a comment describing the change.

The status change is reflected in the Status Log tab of each issue. Additionally, if the issues are linked to Jira tickets, the status update is synchronized with Jira through Traceable’s bidirectional sync feature.

---

Creating Jira Tickets in Bulk

When you click the Jira icon, a ticket creation dialog is displayed. This dialog allows you to specify the project and issue type for the Jira tickets. You can choose between two modes:

• Single Ticket
  Creates one Jira ticket that includes information for all the selected issues. The summary and description fields are populated with a combined view of the selected issues.

• Separate Tickets
  Creates an individual Jira ticket for each selected issue. Each ticket contains information specific to one issue. You can preview and customize each ticket before submitting.

---

Handling Issues Already Linked to Jira

If one or more of the selected issues are already linked to Jira tickets, you are presented with two options:

• Ignore linked issues – Jira tickets will be created only for issues that are not currently linked.

• Unlink and create new – Existing Jira links will be removed, and new tickets will be created for all selected issues, including those previously linked.

---

Additional Consideration

When creating Jira tickets in bulk, you can also update the issue status using the Update Status option from the same selection view. This bulk update action is fully compatible with the bidirectional sync functionality between Traceable and Jira, ensuring that updates made in Traceable are reflected in Jira and vice versa.

Issue auto-resolution

While you can resolve an issue by changing its status to Fixed, Traceable also auto-resolves it. The following table lists the scenarios in which Traceable auto-resolves an issue detected via scans:

• Traceable has not detected the issue in 60 days since its last occurrence.

• Traceable has not detected the issue in 15 scans since its last observation.

Note

The updated status of the auto-resolved issues may take up to 24 hours to reflect on the Traceable platform.

Issue deletion

You can delete detected issues from the Issue Detailed View by changing their status to Fixed or Not an issue. Traceable also deletes issues if they are deleted from all Sources. For example, let us say an issue has AST and Live Traffic as the Source. Then, Traceable deletes the issue when it is deleted from both Sources.