Request to output findings to text file

[digitalcoyote]

Request to output findings to text file

[digitalcoyote]

Early look at the configuration for the Log:

{
"WarnOnly": false,
"Log": {
"OutPut": "ReportedVulnerabilities.log",
"LogLevel": 2,
"RollingInterval": 0
},
"CheckTransitiveDependencies": true,
"ErrorSettings": {
"ErrorSeverityThreshold": 5,
"CVSS3Threshold": -1,
"IgnoredPackages": [
{
"Id": "NugetDefense",
"Version": "1.0.8.0"
}
],
"IgnoredCvEs": []
},
"OssIndex": {
"Enabled": true,
"BreakIfCannotRun": true
},
"NVD": {
"SelfUpdate": false,
"TimeoutInSeconds": 15,
"Enabled": true,
"BreakIfCannotRun": true
}
}

[jwilliamson1]

Closing as I saw Gitter is the prefered way to ask questions.

[digitalcoyote]

Reopening to track request.

[digitalcoyote]

I'm using Serilog to allow defining one or more log files (and eventually other sinks).

@jwilliamson1 if you have any preference on format, let me know. I intend to make the template string for Serilog configurable eventually, but if you have a preference, I'll start with that. I'm aiming to have an early version of this out this weekend and then expand it more later on.

[jwilliamson1]

Hi! Thanks for looking at this. We use this xml format that Trivy supplies. It uses a junit template. Something like that would be ideal, but any output is good.
https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/junit.tpl

[digitalcoyote]

@jwilliamson1 Would either of these work for you:

ExampleReports.zip

I tried to vaguely follow the template you linked while at the same time, getting something that should be "easily readable" and generic enough for general use. There are also separate logs in the latest build.

[digitalcoyote]

A couple methods of doing this have been added in v1.0.8. Feel free to reopen this or comment if any other formats are required. I hope to get docs updated soon.