Skip to content

Commit b1f5f34

Browse files
psiinonpsiinon
committed
2.17 Headline changes and Alert details
Signed-off-by: Simon Bennetts <psiinon@gmail.com>
1 parent 582ca08 commit b1f5f34

File tree

2 files changed

+144
-11
lines changed

2 files changed

+144
-11
lines changed

‎addOns/help/src/main/javahelp/contents/releases/2.17.0.html‎

Lines changed: 28 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,25 +11,37 @@ <H1>Release 2.17.0</H1>
1111

1212
This is a bug fix and enhancement release.
1313

14-
TBC
15-
1614
<H3>Alert De-duplication</H3>
17-
Changes have been made in order to reduce the number of alerts which ZAP may raise that are duplicaes or highly similar, more closely being aligned with the Sites Tree representation.
15+
Changes have been made in order to reduce the number of alerts which ZAP may raise that are duplicates or highly similar, more closely being aligned with the Sites Tree representation.
1816
See the <a href="https://www.zaproxy.org/blog/2025-09-30-alert-de-duplication/">Alert De-duplication blog</a> for further details.
1917

2018
<H3>Systemic Alerts</H3>
21-
TBC
19+
Alerts that are typically site-wide will now be flagged as being "Systemic" in both the ZAP Desktop UI and in reports.
20+
<p>
21+
This can also significantly reduce the number of "duplicate" alerts reported.
22+
23+
<H3>Insights</H3>
24+
A new "Insights" tab shows key information which is not related to vulnerabilities, or potentially even related to the application in question.
25+
<p>
26+
Insights tell you more about your applications, about the effectiveness of a scan, and can even stop a scan early if significant problems are identified.
27+
<p>
28+
Insights are also included in all of the official ZAP reports.
29+
30+
<H3>Improved Disk and Memory Space Error Handling</H3>
31+
ZAP will now detect disk and memory space issues and attempt to handle them more gracefully.
32+
<p>
33+
Any problems encountered will be reported via the Insights.
34+
35+
<H3>Automation Disk Space Reduction</H3>
36+
Active Scan Temporary HTTP Messages are no longer persisted by default when ZAP is run headless.
37+
This can significantly reduce the amount of disk space needed.
38+
<p>
39+
The option is also available in the Desktop but is turned off be default, so that the user can inspect them.
2240

2341
<H3>Structured Reports ISO 8601 Standard Date</H3>
2442
The structured reports (JSON and XML) now have an ISO 8601 standard date field/attribute (“created”);
2543
the existing “generatedString” field will be removed in the future.
2644

27-
<H3>Active Scan Temporary HTTP Messages</H3>
28-
If this option is selected the active scanner will persist all HTTP messages sent while active scanning, which allows to further inspect them (e.g. custom passive scanners, manually).
29-
They are temporary and removed once the session is closed, for cases where the HTTP messages are not necessary it is advised to disable this option for performance reasons (I/O, disk space).
30-
<p>
31-
By default the HTTP messages are persisted unless in command line mode, where sessions are usually discarded once ZAP finishes.
32-
3345
<H3>Dependency Updates</H3>
3446

3547
As usual the release includes dependency updates.
@@ -45,6 +57,12 @@ <H2>Add-Ons</H2>
4557
<H3>Updated Add-Ons</H3>
4658
All of the add-ons included by default have been updated since the last full release.
4759

60+
<H3>New Add-Ons</H3>
61+
62+
<ul>
63+
<li>Insights - as detailed above</li>
64+
</ul>
65+
4866
<H2>Enhancements</H2>
4967
<ul>
5068
<li>TBC</li>

‎addOns/help/src/main/javahelp/contents/start/features/alerts.html‎

Lines changed: 116 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,123 @@ <H1>Alerts</H1>
3333
All alerts are listed in the <a href="../../ui/tabs/alerts.html">Alerts tab</a>
3434
and a count of the total number of alerts by risk is shown in the <a href="../../ui/footer.html">footer</a>.
3535
</p>
36+
<p>
37+
The full set of alerts that ZAP can raise is available online at
38+
<a href="https://www.zaproxy.org/docs/alerts/">https://www.zaproxy.org/docs/alerts/</a>
39+
</p>
40+
41+
<a name="alertfields"></a><H2>Alert Fields</H2>
42+
43+
The following fields are supported.
44+
45+
<a name="alert-name"></a><H3>Name</H3>
46+
47+
The name of the alert, for example "Cross Site Scripting (Reflected)"
48+
49+
<a name="alert-url"></a><H3>URL</H3>
50+
51+
The URL related to the alert.
52+
53+
<a name="alert-nodename"></a><H3>Node Name</H3>
54+
55+
A normalised version of the URL, which is also used in the <a href="sitestree.html">Sites Tree</a>
56+
57+
<a name="alert-risk"></a><H3>Risk</H3>
58+
59+
The relative severity of the alert.
60+
<p>
61+
One of:
62+
<ul>
63+
<li>Informational
64+
<li>Low
65+
<li>Medium
66+
<li>High
67+
</ul>
68+
69+
The risk is automatically set for Alerts raised by ZAP.
70+
If you want to change the risk you can either do that manually for each alert or you can create an
71+
Alert Filter to do it automatically.
72+
73+
<a name="alert-confidence"></a><H3>Confidence</H3>
74+
75+
The relative confidence in the alert.
76+
<p>
77+
One of:
78+
<ul>
79+
<li>False Positive
80+
<li>Low
81+
<li>Medium
82+
<li>High
83+
<li>Confirmed
84+
</ul>
85+
86+
ZAP will not raise an alert with a confidence of either "False Positive" or "Confirmed".
87+
However you can set these levels either manually or via an Alert Filter.
88+
89+
<a name="alert-param"></a><H3>Parameter</H3>
90+
91+
The name of the parameter that was attacked.
92+
This will be empty for passive alerts or if the alert is not associated with a specific parameter.
93+
94+
<a name="alert-attack"></a><H3>Attack</H3>
95+
96+
The payload used to find the alert.
97+
This will be empty for passive alerts.
98+
99+
<a name="alert-evidence"></a><H3>Evidence</H3>
100+
101+
A string that appears in the request or response which was used to help identify the alert.
102+
This will be empty if there is no relevant string, for example for missing security headers.
103+
104+
<a name="alert-cweid"></a><H3>CWE ID</H3>
105+
106+
The <a href="https://cwe.mitre.org/">Common Weakness Enumeration</a> ID.
107+
108+
<a name="alert-wascid"></a><H3>WASC ID</H3>
109+
110+
The <a href="http://projects.webappsec.org/w/page/13246978/Threat%20Classification">Web Application Security Consortium</a> ID.
111+
112+
<a name="alert-source"></a><H3>Source</H3>
113+
114+
The scan rule which raised the alert, if relevant.
115+
116+
<a name="alert-alertref"></a><H3>Alert Reference</H3>
117+
118+
The ID of the rule which raised the alert, optionally followed by a dash and the alert instance.
119+
<p>
120+
All of the alerts raised by ZAP are listed on
121+
<a href="https://www.zaproxy.org/docs/alerts/">https://www.zaproxy.org/docs/alerts/</a>,
122+
and they all have a static page with a URL based on the Alert Reference.
123+
124+
<a name="alert-input"></a><H3>Input Vector</H3>
125+
126+
The <a href="../../ui/dialogs/options/ascaninput.html">Active Scan Input Vector</a> used to identify the element attacked.
127+
This will be empty for passive alerts or if the alert is not associated with a specific parameter.
128+
129+
<a name="alert-desc"></a><H3>Description</H3>
130+
131+
A detailed description of the alert. This will be the same text for all alert instances with the same reference.
132+
133+
<a name="alert-other"></a><H3>Other Info</H3>
134+
135+
Alert specific information, which is potentially different for each alert raised.
136+
137+
<a name="alert-solution"></a><H3>Solution</H3>
138+
139+
Potential solutions to the underlying problem.
140+
Note that these solutions will be generic as ZAP does not access any source code.
141+
This will be the same text for all alert instances with the same reference.
142+
143+
<a name="alert-ref"></a><H3>Reference</H3>
144+
145+
A set of links to more information about the alert online.
146+
147+
<a name="alert-tags"></a><H3>Alert Tags</H3>
148+
149+
The tags associated with the alert.
150+
The full set of tags supported are listed on <a href="https://www.zaproxy.org/alerttags/">https://www.zaproxy.org/alerttags/</a>.
36151

37-
<a name="alertoverrides"></a><H2>Alert overrides</H2>
152+
<a name="alertoverrides"></a><H2>Alert Overrides</H2>
38153

39154
Alerts raised by ZAP include both generic and specific information about the alerts raised.
40155
The specific information relates directly to the potential issue found, such as the URL and the parameter affected.

0 commit comments

Comments
 (0)