Application Vulnerability Correlation Settings

  The Administrator role is required to perform the actions described below.

 

Click the Administration image49.png. The administration page appears.

Select the AVC item on the left menu to update the Application Vulnerabilities Correlation (AVC) settings. The AVC page contains three tabs: Common, Correlation and Active learning.

 

 

The Common tab contains the following settings:

  • AVC domain name — domain name of the external web service that provides AVC analysis based on its model created using artificial intelligence (AI).
  • Enable auto-review — enables automatic analysis of detected security vulnerabilities after each import of issues from AST tool to Maverix. This allows you to automatically assign the false positive or true positive status to imported issues. Switch on the selector to get the results of AVC analysis and true/false positive assessment for SAST security issues.
  • Observable statuses — From the drop-down menu, select the statuses of security issues to perform the AVC analysis.

 

The Correlation :

  • Apply correlation rules by default is intended for enabling correlation rules by default. If this setting is disabled, no correlation will be used.
  • Correlation rule by default defines the default correlation rule. In this example the chosen correlation rule is based on the coincidence of the following parameters of the detected security issues: CWE Id, file name and code line number containing the issue.
  • CWE Id, file name in path, line number in path is intended for enabling of the default correlation rule.

The Active learning tab contains the following settings:

 

  • Enable active learning feature is intended to enable periodic retraining of the prediction model in order to improve its accuracy.
  • The DP threshold parameter defines the lower bound of the quality of the prediction model.. If its value goes below the defined value, the process of additional retraining is started.

Administrator defines the AVC settings for the entire Maverix system. If these settings need to be tuned for a particular application, the application Manager can correct the application AVC settings on the AVC tab of the application Settings page.