Kenna Security's Application Risk Module allows users to dynamically create Applications within Kenna and use appsec connectors to bring in vulnerabilities on those application.
Create a New Application
Click the "Add Application" button at the top left of the main AppSec screen.
You'll be directed to the "Add Application" page, where you can fill in:
- Application Name - give your application a name that will be easy for you to identify
- Team Name - optional metadata for the team responsible for the application
- Application Owners - optional metadata on the owners of the application
- Business Units - optional metadata on the business unit responsible for the application
- Hostname - optional metadata
- Repo URL - optional metadata
- Notes - optional field for notes you want to keep on the application
- Application Locator - required; the URLs/locator elements for the application you're defining. Include all URLs/locators that you want as part of your application.
Click "Save" to create your new application.
View Applications Scores
When you've added new applications, you'll be able to see their risk score on the main AppSec page. This score is calculated based on all the vulnerabilities found on the application locator identifiers you used as part of your application.
You can edit your application metadata or component URLs at any time.
Clicking the "Overview" button for an application opens up the Application Overview page, which outlines the basics of the app and shows scores and metrics. You can see all the metadata you defined, as well as an overview of how the application is doing. There's also a link to the Explore view, where you can see the individual vulnerabilities that contribute to the application score (more in the next section on the Explore view).
You can update the Notes field from the Overview page to update your metadata. To update other metadata, use the Edit Application function from the AppSec home page.
Clicking the "Explore" button will direct you to the Explore tab, scoped to your application's vulnerabilities and fixes. It will also give you a "full stack" view, by showing you the underlying assets that power your application.