> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/issues.md). # Issues The Issues page lists the issues found in the selected scan, sorted by severity. {% hint style="info" %} This documentation does not include an issue catalogue. The full content of each issue (description, impact, identification, mitigation, detection and references) is available in the product, on the issue's [Issue Details](#issue-details) page. {% endhint %}

Two selectors sit above the table. **Remediation** picks a remediation scan whose re-verified results you want to see. It is shown only after at least one [remediation scan](#remediation-scan) has been run for the selected scan. **Compare** picks another scan to compare the current one against. While comparing, issues found only in the current scan carry a `New` badge and issues found only in the compared scan carry a `Fixed` badge. The issues table provides the following functionalities. **Sort**: Issues can be sorted by `Status`, `Name`, `Ease of Mitigation`, `Severity`, `Exploitation Certainty`, `Exploitation Privilege`, and `Affected Objects` columns. **Search**: Issues can be searched and filtered by `Name` column using the `Search input` on the upper-right side. **Export**: Issues can be exported as CSV using the `Export button` on the upper-right side. **Limit and Pagination**: Issue table limit can be defined with input on the bottom-right side. Result pages can be navigated through a widget at the bottom.

The actions below are in the **⋯** menu on the right side of each row. **Download PDF Report**: Issues can be exported as PDF separately using `Download PDF Report`. **Download Package (ZIP)**: Downloads an archive with the finding report and the evidence for every affected entity. The action requires the `DownloadReportPackage` permission and the offline report package to be enabled in [Report Settings](/forestall/settings/report.md). **Create Jira Ticket**: Issues can be imported to Jira as separate tickets using `Create Jira Ticket`. The item stays disabled until a cloud or on-prem Jira instance is integrated. See [`Configuration Center > Jira`](/forestall/configuration-center/jira.md) to set up the integration. **Change Status:** The actions taken regarding the vulnerabilities found are changed in this section. Actions that can be taken: `No Action`, `In Progress`, `Done` and `Accepted Risk`. Column is turned off by default. Status filter shows vulnerabilities with no action and in progress selected by default. Vulnerabilities selected as `Done` or `Accepted Risk` will be hidden on issues table unless filter manually enabled.

### Remediation Scan A Remediation Scan checks issues again after you have fixed them. It reuses the access information and scan policy of the original scan and verifies only the issues or affected entities in the **Remediation Queue**. #### Adding Issues to the Remediation Queue To verify an issue again, open the **⋯** menu for the issue and select **Add to Remediation Queue**. This adds all affected entities of the issue. An issue that is already in the queue carries an `In queue` badge in the list, and its menu item reads **Already in Remediation Queue**. To re-verify only some affected entities, select their rows in the issue's [Affected Objects](#affected-objects) tables and use **Bulk Actions > Add to Remediation Queue (N)**, or **Add All to Remediation Queue (N)** for every row of the table. Multiple issues can be added to the same queue. The queue holds findings from one scan only. Adding findings from another scan fails with `The remediation queue already contains findings from another scan. Clear it first.` The **Remediation Queue** button at the bottom of the page shows the number of queued issues and opens the queue, which lists the issues and affected entity types currently selected for verification. Items can be removed individually with **Remove**, or the entire queue can be cleared with **Clear** before starting the scan.

#### **Adding Multiple Issues** To verify several issues in one remediation scan, select their rows in the Issues list and choose **Add to Remediation Queue (N)** from **Bulk Actions**. **Bulk Actions** also offers **Change Status (N)** and **Create Jira Ticket (N)** for the selected issues. These require the corresponding permissions, and Jira tickets require a Jira configuration.

#### Starting a Remediation Scan After adding the required issues or affected entities, open the **Remediation Queue** and click **Start Remediation Scan**. In the **Start Remediation Scan** window, enter a name and a description for the scan.

The following options are available: | Option | Description | | -------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Name** | Specifies the name of the remediation scan. | | **Description** | Optional information describing the purpose of the scan. | | **Full network scan for accurate local-admin detection** | Scans every computer so that findings depending on local administrator status can be verified. This option is displayed only when some selected findings depend on it. When it is left off, the scan is faster but those findings come back as `Unverified` instead of a verdict. | The access information and scan policy are inherited from the original scan and do not need to be configured again. Click **Start Scan** to begin the verification. The remediation scan then appears in the **Remediation** selector above the issue list.

Start Remediation Scan window with the full network scan option — **Start Scan**

#### Reviewing Remediation Scan Results Remediation scans are listed in the **Remediation** selector on the original scan's Issues page. Select a remediation scan to open its results in a panel on the right side of the page. The same selector switches between the remediation runs of the original scan. A run that is still in progress shows its status, and its results appear when it finishes. Once a remediation scan is selected, the selector row shows a badge for each status that has results (for example `1.475 unresolved` and `17 unverified`), a **Show results** / **Hide results** button that reopens or closes the panel, and a **⋯** (Scan actions) menu.

Remediation results panel with all four status cards and the finding list — **Remediation results panel**

The panel header shows the remediation scan's name and start time, the same **⋯** menu, and a close button (**Esc** also closes it). The panel can be resized from its left edge. Results are reported for each verified affected entity as: * **Resolved**: the condition detected in the original scan is no longer present. * **Unresolved**: the condition is still present. * **Unverified**: the scan could not collect what the check needs, so no verdict was given. For example, findings that depend on local administrator status are reported as Unverified when **Full network scan for accurate local-admin detection** was left off. Four counters at the top of the panel, **All**, **Resolved**, **Unresolved** and **Unverified**, show the number of results in each status and also act as the status filter. Below them, **Search affected or trustee…** filters the results by entity name, and **Expand all** / **Collapse all** opens or closes every issue at once. Each issue is listed with its name, FS number and a count badge per status. Expanding an issue shows each affected entity with its type, its status, the trustee and relation when the finding involves one, and the date it was verified. The **⋯** menu offers: * **Go to scan**: opens the Issues page of the selected remediation scan. * **Clone**: opens the **Clone Remediation Scan** window with the same selection, name and description, to run the verification again. * **Delete**: removes the selected remediation scan after confirmation. **Go to scan** opens the Issues page of the remediation scan. There, a **Remediation Scan** card above the issue list has the same counters and filters, a results table with the `Affected`, `Dangerous Ace` (for findings on access control entries), `Trustee`, `Status` and `Verified` columns, and a **Go to main scan** button that returns to the original scan.

Remediation Scan card on the Issues page of a remediation scan — Remediation Scan card

You manage remediation scans from the **Remediation** selector on the original scan's Issues page, not from the Scans list. In the Scans list, the original scan carries a remediation badge with the number of its remediation scans. ### Columns

**FSID:** Unique identifier of the issue within the system. **Platform:** The provider of the issue (Active Directory, Azure, AWS, GCP or GitHub), shown as a logo. The column filter lists the same logos. **Status:** Shows the current status of the issue (e.g. open, resolved). **Name:** The name and short description of the detected issue. **Tags:** Additional labels used to categorize or group issues. **Ease of Mitigation:** Indicates how easily the issue can be mitigated. **MITRE ATT\&CK® Tactics:** Shows the MITRE ATT\&CK tactics associated with the issue. **Severity:** Indicates the risk level of the issue (e.g. Critical, High). **Exploitation Certainty:** Shows how likely the issue can be exploited. **Exploitation Privilege:** Indicates the privilege level required to exploit the issue. **Affected Objects:** Shows the number of objects impacted by the issue. **Comment:** Displays comments added to the issue. **Jira Ticket:** Shows the Jira ticket associated with the issue, if available. ### Column-Based Filtering You can filter the issue list by column values, such as severity, MITRE ATT\&CK® tactics or affected objects. *** ### Affected Objects Filter The **Affected Objects** filter shows only the issues that affect a given **number of objects** or range. Use it to find the issues with the widest impact. ## Issue Details The Issue Details page shows all information and metrics for an issue.

The first pane contains `Issue Name` , `Tags`, `Global Custom Tags`, `Custom Tags`, and `Exposure Point`. **Tags:** Custom tags are added with the **+** button next to the tags, which opens the **Add a new Tag** window. With the `Global Tag` switch on, the tag is a global custom tag and shows up on the same issue in future scans. With it off, the tag only appears on the issue in the selected scan.

Add a new Tag window with the Global Tag switch — Add Issue Tag

The `Information` pane contains 6 tabs: `Details`, `Identification`, `Mitigation`, `Detection`, `Timeline` and `Compliance`. A summary pane on the right shows the issue's metrics. The comment button next to the `Information` title shows the number of comments on the issue and opens the **Comments** panel. A comment can be applied to all scans (`Apply for all scans`) or kept private (`Just for me`). The `Download` button on the upper-right side of this pane offers two options. `Finding (PDF)` exports the issue as a PDF report. `Finding Package (ZIP)` exports an archive with the report and its affected-entity evidence. The package option requires the `DownloadReportPackage` permission. Details tab contains `Description`, `Impact` and `References`. **Exposure Point**: vulnerabilities are assessed based on their risk level. A higher Exposure Point indicates a more critical security flaw, while a lower Exposure Point represents a less risky vulnerability. **Description**: Description contains detailed information about the root cause of the issue and how to exploit it. Also, explanations about related technologies, services, protocols, and inventory types reside here. **Impact**: Impact explains, how attackers can exploit this issue and what is the effect of this process on Active Directory. **References**: References contain multiple articles and blog posts for further reading about this issue. ### Identification Identification tab contains a detailed step-by-step walkthrough about how to identify and verify this issue manually. This walkthrough contains screenshots, manuals, and Powershell or Batch scripts to automatize the identification process. With this roadmap, analysts can manually identify and verify the issue for eliminating false positives.

### Mitigation Mitigation tab also contains a detailed step-by-step walkthrough about how to mitigate/remediate issues or implement a workaround with minimum effort. This walkthrough contains manuals and Powershell or Batch scripts to automatize the mitigation process. System administrators can follow these steps to remediate the issue.

### Detection Detection tab contains methods, log sources, and Event Log IDs to detect possible exploitations of this issue. With this information, analysts can speed up their process to create detection rules for SIEM or different security products.

### Timeline Timeline tab contains a Timeline chart. This chart displays the distribution of issue statuses over time, along with other scans that share the same policy as the selected scan. The tab also shows the policy used in the scan and the number of days the vulnerability has remained unresolved. Five status changes are shown in the chart: `First Detected`**,** `Risk Increased`**,** `Reappeared`**,** `Partially Remediated` and `Disabled` or `Fully Remediated`.

Vulnerability Timeline chart — Timeline Chart

Each data point in the chart represents a scan. Hovering over a data point provides detailed information about the corresponding scan. Fields such as `Scan Name`, `Date`, `Affected Entity Count,` and `Exposure Point` are displayed. In addition, a badge is displayed when the status is Disabled or Fully Remediated. Click a data point to compare its affected entities with the current scan.

Timeline chart with a data point tooltip — Data Point Hovered Timeline Chart

The chart can also be resized from the bottom to control how many scans are displayed and can be navigated across different dates.

### Compliance The Compliance tab lists the compliance frameworks and controls this issue is mapped to, and the tab label shows how many controls are affected. Each control links to its details on the [Compliance](/forestall/compliance.md) page and shows the rationale for the mapping below its name. Each framework heading has an **Open in Compliance »** link to that framework's compliance page. Only the frameworks selected on the scan policy are listed. See [Compliance Frameworks](/forestall/scans/policies.md#compliance-frameworks). When no control of the selected frameworks maps to the issue, the tab says so and links to the scan policies. ### Affected Objects This area can contain multiple tables for each entity type that is affected by this issue. Each table is a collapsible card whose title shows the entity type and the number of affected objects, for example `Affected Users(Access Control Entries: 1.916)`. Click the title to open the table. The tables list the affected entities with issue-specific columns, and offer `Sort`, `Search`, `Export`, `Limit`, and `Pagination` like other tables in the web interface. Click the `Name` to open the affected object's details page. Selected rows can be handled with **Bulk Actions**: **Define Exclusion (N)** and **Define Exclusion All (N)** create [row-based exclusions](#row-based-exclusion), and **Add to Remediation Queue (N)** and **Add All to Remediation Queue (N)** queue the rows for a [Remediation Scan](#remediation-scan). Once a [Remediation Scan](#remediation-scan) has run for the issue, the tables also contain a `Remediation` column showing whether each object was verified as `Resolved`, `Unresolved` or `Unverified`, together with the date of the last check. The column can be filtered by remediation status. Tables of access control entry findings have a `Stale Reason` column that explains why an entry may no longer be exploitable: * `Affected is inactive` / `Affected is disabled`: the affected object is inactive or disabled. * `Trustee is inactive` / `Trustee is disabled`: the trustee holding the permission is inactive or disabled. * `Affected is unpublished`: the affected object, such as a certificate template, is not published. When the Splunk integration is configured, permission usage is also checked. `No recent activity` means the audit logs show no recent use of the permission. `SACL is disabled` means the object's SACL does not audit that access, so its use cannot be observed. The cell reads `Actively in use` with a date for a permission that recent activity confirms is still being used. If a stale reason also applies, it is followed by `, actively in use - `.

### Row Based Exclusion Row-based exclusions add an exclusion to a scan policy directly from a result row, one row at a time or in bulk. Each exclusion is defined by its exclusion type and the relevant criteria. You can change these exclusions later in the policy settings. In bulk, use **Bulk Actions > Define Exclusion (N)** for the selected rows or **Define Exclusion All (N)** for every row of the table.

Affected AWSIAMRoles table with three rows selected and the Bulk Actions dropdown open

#### Row Based Exclusion Description and Files Each row-based exclusion can include an optional description and supporting files such as PDF and image documents. Existing descriptions and supporting files will be overwritten when the same exclusion is added again.

### **Summary Pane** Summary pane on the right-upper side contains `Severity`, `Ease of Mitigation`, `Ease of Detection`, `Ease of Deception`,`Exploitation Privilege`, `Exploitation Certainty`, `Forestall Impact Name`, `APT Groups Using`, and `MITRE ATT&CK Tactics`.

**APT Groups Using**: APT groups that exploit this issue to compromise Active Directory. **MITRE ATT\&CK Tactics**: MITRE ATT\&CK Tactics related to this issue. Details about `Severity`, `Ease of Mitigation`, `Ease of Detection`, `Ease of Deception`,`Exploitation Privilege`, `Exploitation Certainty` and `Forestall Impact Name` metrics can be found on the [Glossary](/forestall/introduction/glossary/glossary.md).