Continuum / Client / get_code_finding

get_code_finding¶

Continuum.Client.get_code_finding(**kwargs)¶

Retrieves the current state and details of a finding.

Request Syntax

response = client.get_code_finding(
    environmentId='string',
    findingId='string'
)

Parameters:

environmentId (string) –
[REQUIRED]

The environment that owns the finding.
findingId (string) –
[REQUIRED]

The unique identifier of the finding to retrieve.

Return type:

dict

Returns:

Response Syntax

{
    'type': 'CONTINUUM_CODE_VULN'|'CUSTOMER_CODE_VULN',
    'title': 'string',
    'severity': 'UNKNOWN'|'INFORMATIONAL'|'LOW'|'MEDIUM'|'HIGH'|'CRITICAL'|'FATAL'|'OTHER',
    'summary': 'string',
    'detailedDescription': 'string',
    'category': 'string',
    'subCategory': 'string',
    'cweIds': [
        'string',
    ],
    'owaspCategory': 'string',
    'mitigation': 'string',
    'filePath': 'string',
    'lineNumber': 123,
    'cveId': 'string',
    'cvssBaseScore': 123.0,
    'affectedPackages': [
        {
            'name': 'string',
            'version': 'string',
            'fixedInVersion': 'string',
            'packageManager': 'string'
        },
    ],
    'vulnerableCode': 'string',
    'relevantInputs': [
        'string',
    ],
    'stepsToReproduce': [
        'string',
    ],
    'validation': {
        'verdict': 'TRUE_POSITIVE'|'FALSE_POSITIVE'|'BENIGN_TRUE_POSITIVE'|'NEEDS_REVIEW',
        'blockingReason': 'UNREACHABLE'|'PROTECTED'|'MISCLASSIFIED'|'EXCLUDED'|'NOT_FEASIBLE'|'RISK_MITIGATED'|'NONE',
        'confidence': 123.0,
        'rationale': 'string',
        'severityAdjustment': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'INFORMATIONAL'|'UNCHANGED',
        'mitigatingControls': [
            'string',
        ],
        'preconditions': [
            'string',
        ],
        'evidence': [
            {
                'file': 'string',
                'line': 123,
                'snippet': 'string'
            },
        ]
    },
    'endLine': 123,
    'mitreTechniques': [
        'string',
    ],
    'remediationReferences': [
        'string',
    ],
    'ocsfClass': 'VULNERABILITY_FINDING'|'APPLICATION_SECURITY_POSTURE_FINDING',
    'ocsfSchemaVersion': 'string',
    'productName': 'string',
    'productVendorName': 'string',
    'productVersion': 'string',
    'sourceStatus': 'string',
    'sourceStatusId': 123,
    'firstSeenAt': datetime(2015, 1, 1),
    'findingTypes': [
        'string',
    ],
    'vulnerabilities': [
        {
            'title': 'string',
            'description': 'string',
            'cweId': 'string',
            'cweCaption': 'string',
            'additionalCweIds': [
                'string',
            ],
            'cveId': 'string',
            'cvssBaseScore': 123.0,
            'fixCoverage': 'string',
            'fixCoverageId': 123,
            'locations': [
                {
                    'filePath': 'string',
                    'startLine': 123,
                    'endLine': 123
                },
            ],
            'remediation': 'string',
            'remediationReferences': [
                'string',
            ],
            'code': 'string',
            'details': 'string',
            'affectedPackages': [
                {
                    'name': 'string',
                    'version': 'string',
                    'fixedInVersion': 'string',
                    'packageManager': 'string'
                },
            ]
        },
    ],
    'resources': [
        {
            'uid': 'string',
            'name': 'string',
            'type': 'string',
            'region': 'string'
        },
    ],
    'posture': {
        'application': 'string',
        'applicationUid': 'string',
        'applicationVersion': 'string',
        'control': 'string',
        'description': 'string',
        'standards': [
            'string',
        ],
        'requirements': [
            'string',
        ],
        'checks': [
            {
                'uid': 'string',
                'name': 'string',
                'description': 'string'
            },
        ],
        'status': 'string',
        'statusId': 123,
        'remediation': 'string',
        'remediationReferences': [
            'string',
        ]
    },
    'findingId': 'string',
    'findingArn': 'string',
    'environmentId': 'string',
    'source': 'string',
    'sourceFindingId': 'string',
    'reportedAt': datetime(2015, 1, 1),
    'status': 'SUBMITTED'|'VALIDATING'|'CONFIRMED'|'DISCARDED',
    'statusUpdatedAt': datetime(2015, 1, 1),
    'createdAt': datetime(2015, 1, 1),
    'scanRunId': 'string',
    'statusMessage': 'string',
    'discardReason': 'SCANNER_VALIDATED_FALSE_POSITIVE'|'SCANNER_NEEDS_REVIEW'|'FALSE_POSITIVE_VALIDATED_AGAINST_CONTEXT'|'DUPLICATE_OF_OPEN_ISSUE'|'DUPLICATE_OF_CLOSED_ISSUE'|'COMPENSATING_CONTROL_PRESENT'|'OUT_OF_SCOPE'|'INSUFFICIENT_EVIDENCE'|'PROCESSING_FAILED'|'SOURCE_REPO_NOT_FOUND',
    'discardReasoning': 'string',
    'duplicateOfIssueId': 'string',
    'createdIssueId': 'string',
    'completedAt': datetime(2015, 1, 1)
}

Response Structure

(dict) –

Contains the current state and details of the requested finding. Which type-specific members are populated depends on type.
- type (string) –
  
  What kind of finding this is. Determines which of the type-specific members below are populated.
- title (string) –
  
  The producer’s title for the finding.
- severity (string) –
  
  The finding’s severity.
- summary (string) –
  
  A one-paragraph description.
- detailedDescription (string) –
  
  The full analysis.
- category (string) –
  
  The producer’s vulnerability category. Not a stable filter key across finding types – see FindingCategory.
- subCategory (string) –
  
  A more specific classification within category.
- cweIds (list) –
  
  CWE identifiers classifying the finding.
  - (string) –
    
    A CWE identifier, e.g. “CWE-532”.
- owaspCategory (string) –
  
  The OWASP Top 10 category, when the producer supplies one.
- mitigation (string) –
  
  How to fix the finding.
- filePath (string) –
  
  The file the finding is about.
- lineNumber (integer) –
  
  The 1-indexed line the finding is about. Bounds are enforced server-side rather than by a constraint trait: a numeric constraint generates a distinct newtype per enclosing structure, so the same concept would not share a type across the create input and the read output.
- cveId (string) –
  
  The CVE this finding reports, for software-composition findings. Both code types can carry one: a customer document supplies it under vulnerabilities[].cve, and Continuum’s scanner reports CVEs for dependency-manifest findings.
- cvssBaseScore (float) –
  
  The CVSS base score accompanying cveId, when the producer supplies one, from 0.0 to 10.0. Not computed by Continuum. The range is enforced server-side, not by a @range trait – the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007).
- affectedPackages (list) –
  
  Packages implicated by the finding.
  - (dict) –
    
    A software package implicated by a finding.
    - name (string) –
      
      The package name.
    - version (string) –
      
      The affected version.
    - fixedInVersion (string) –
      
      The earliest version that resolves the issue, when one is known.
    - packageManager (string) –
      
      The ecosystem supplying the package.
- vulnerableCode (string) –
  
  The vulnerable code fragment.
- relevantInputs (list) –
  
  User-controlled inputs that reach the vulnerability.
  - (string) –
    
    One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
- stepsToReproduce (list) –
  
  Steps to reproduce or exploit the finding.
  - (string) –
    
    One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
- validation (dict) –
  
  The validator’s assessment. Absent when no validation ran.
  - verdict (string) –
    
    The validator’s conclusion.
  - blockingReason (string) –
    
    Why the validator reached that verdict.
  - confidence (float) –
    
    The validator’s confidence, from 0.0 to 1.0 inclusive. Advisory: it does not drive Continuum’s own routing decisions. The range is enforced server-side, not by a @range trait – the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007).
  - rationale (string) –
    
    The validator’s reasoning.
  - severityAdjustment (string) –
    
    The validator’s severity conclusion.
  - mitigatingControls (list) –
    
    Controls the validator found that reduce exploitability.
    - (string) –
      
      One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
  - preconditions (list) –
    
    Conditions exploitation depends on, which bound the severity.
    - (string) –
      
      One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
  - evidence (list) –
    
    Code citations supporting the verdict.
    - (dict) –
      
      A code citation supporting a validation verdict.
      - file (string) –
        
        The file the evidence was found in.
      - line (integer) –
        
        The 1-indexed line, when known.
      - snippet (string) –
        
        The cited excerpt.
- endLine (integer) –
  
  The last line of the affected range, from the document’s affected_code[].end_line.
- mitreTechniques (list) –
  
  MITRE ATT&CK technique identifiers, from the document’s finding_info.attacks[].technique.uid.
  - (string) –
    
    One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
- remediationReferences (list) –
  
  Remediation references, from the document’s vulnerabilities[].remediation.references.
  - (string) –
    
    One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
- ocsfClass (string) –
  
  The OCSF class the document declared. Determines whether posture is populated.
- ocsfSchemaVersion (string) –
  
  The OCSF schema version the producer wrote against (metadata.version).
- productName (string) –
  
  The producing product and vendor (metadata.product).
- productVendorName (string) –
  
  A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
- productVersion (string) –
  
  A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
- sourceStatus (string) –
  
  The producer’s own status for the finding, and the enum value behind it. Distinct from status, which is Continuum’s lifecycle state – a producer may call a finding “New” while Continuum has it SUBMITTED.
- sourceStatusId (integer) –
  
  The producer’s numeric enum value for sourceStatus.
- firstSeenAt (datetime) –
  
  When the producer first observed the finding (finding_info.first_seen_time). The producer’s own clock, not Continuum’s.
- findingTypes (list) –
  
  The producer’s own classification of the finding (finding_info.types).
  - (string) –
    
    One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
- vulnerabilities (list) –
  
  Every vulnerability the document reported. A document may report several; the flat cveId/ cvssBaseScore/ filePath/ lineNumber members above carry the first one’s identity so a caller that only needs “what and where” does not have to walk this list.
  - (dict) –
    
    One vulnerability reported by a finding. A customer document may report several; each carries its own identity, locations and remediation.
    - title (string) –
      
      The title of a finding, from the producer’s own title – OCSF finding_info.title, or the scanner’s finding title. Length matches the OCSF title constraint.
    - description (string) –
      
      Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document’s own 256 KB limit, since several of these can appear on one finding.
    - cweId (string) –
      
      Primary CWE for this vulnerability, e.g. “CWE-89”.
    - cweCaption (string) –
      
      The producer’s human-readable caption for cweId.
    - additionalCweIds (list) –
      
      Further CWEs the producer attributed to this same vulnerability.
      - (string) –
        
        A CWE identifier, e.g. “CWE-532”.
    - cveId (string) –
      
      A CVE identifier, e.g. “CVE-2020-8203”.
    - cvssBaseScore (float) –
      
      The CVSS base score for cveId, when the producer supplies one, from 0.0 to 10.0.
    - fixCoverage (string) –
      
      The producer’s description of how completely a fix is available.
    - fixCoverageId (integer) –
      
      The producer’s enum value behind fixCoverage.
    - locations (list) –
      
      Every location this vulnerability was reported at.
      - (dict) –
        
        A code location a finding points at.
        
        filePath (string) –
        
        Repository-relative path.
        
        startLine (integer) –
        
        1-indexed first line of the affected range.
        
        endLine (integer) –
        
        1-indexed last line, when the producer reported a range.
    - remediation (string) –
      
      Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document’s own 256 KB limit, since several of these can appear on one finding.
    - remediationReferences (list) –
      
      A free-form list of strings carried verbatim from a producer.
      - (string) –
        
        One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
    - code (string) –
      
      The vulnerable fragment, when the producer supplied one.
    - details (string) –
      
      The producer’s extended analysis for this vulnerability.
    - affectedPackages (list) –
      
      Software packages implicated by a finding.
      - (dict) –
        
        A software package implicated by a finding.
        
        name (string) –
        
        The package name.
        
        version (string) –
        
        The affected version.
        
        fixedInVersion (string) –
        
        The earliest version that resolves the issue, when one is known.
        
        packageManager (string) –
        
        The ecosystem supplying the package.
- resources (list) –
  
  Resources the document named (resources[]).
  - (dict) –
    
    A cloud or application resource a finding concerns.
    - uid (string) –
      
      A resource identifier – a cloud ARN, a context-graph node id, or whatever identifier scheme the producer uses.
    - name (string) –
      
      A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
    - type (string) –
      
      A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
    - region (string) –
      
      A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
- posture (dict) –
  
  The compliance posture, for an Application Security Posture Finding. Absent for a vulnerability finding.
  - application (string) –
    
    The application the posture was assessed against.
  - applicationUid (string) –
    
    A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
  - applicationVersion (string) –
    
    A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
  - control (string) –
    
    The control assessed, and the producer’s description of it.
  - description (string) –
    
    Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document’s own 256 KB limit, since several of these can appear on one finding.
  - standards (list) –
    
    Standards and requirements the control maps to.
    - (string) –
      
      One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
  - requirements (list) –
    
    A free-form list of strings carried verbatim from a producer.
    - (string) –
      
      One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
  - checks (list) –
    
    The individual checks performed.
    - (dict) –
      
      One compliance check behind a posture finding.
      - uid (string) –
        
        A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
      - name (string) –
        
        A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.
      - description (string) –
        
        Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document’s own 256 KB limit, since several of these can appear on one finding.
  - status (string) –
    
    The producer’s compliance status, and the enum value behind it.
  - statusId (integer) –
    
    The producer’s numeric enum value for status.
  - remediation (string) –
    
    Free-form prose about a finding (summary, detailed analysis, rationale, remediation guidance). Capped well below the finding document’s own 256 KB limit, since several of these can appear on one finding.
  - remediationReferences (list) –
    
    A free-form list of strings carried verbatim from a producer.
    - (string) –
      
      One entry in a free-form list carried verbatim from a producer (relevant inputs, reproduction steps, mitigating controls, preconditions, references).
- findingId (string) –
  
  The unique identifier of the finding.
- findingArn (string) –
  
  The ARN of the finding.
- environmentId (string) –
  
  The environment that owns the finding.
- source (string) –
  
  The system that produced the finding.
- sourceFindingId (string) –
  
  The producer’s own identifier for the finding.
- reportedAt (datetime) –
  
  When the producer reported the finding – its own clock, which is not Continuum’s ingestion time. createdAt is when Continuum accepted it; these are genuinely different instants and a reader usually wants this one.
  
  For CreateCodeFinding, this is the submitted OCSF document’s own top-level time. For findings Continuum’s scanner produces, it is the finding’s own creation time.
  
  Continuum does not validate it for plausibility: a producer’s value is echoed as given, so a timestamp here asserts the unit and format, not that the instant is genuine.
- status (string) –
  
  The current lifecycle status of the finding.
- statusUpdatedAt (datetime) –
  
  The timestamp when the status last transitioned.
- createdAt (datetime) –
  
  The timestamp when the finding was ingested.
- scanRunId (string) –
  
  The scan that produced the finding, when it came from one. For a finding Continuum’s scanner produced, this is the Continuum scan run (see GetCodeScan). For a finding submitted with CreateCodeFinding, it is the OCSF document’s metadata.correlation_uid, when that value is a valid ScanRunId. Absent when the finding did not come from a scan.
- statusMessage (string) –
  
  Human-readable context about the current status.
- discardReason (string) –
  
  Why the finding was not escalated. Present only when status is DISCARDED.
- discardReasoning (string) –
  
  Customer-facing explanation accompanying discardReason.
- duplicateOfIssueId (string) –
  
  The existing issue this finding duplicates. Present only for the DUPLICATE_OF_* discard reasons.
- createdIssueId (string) –
  
  The issue Continuum created from this finding.
- completedAt (datetime) –
  
  When processing finished, whether by creating an issue or discarding. Absent while the finding is still in flight.

get_code_finding¶

Request Syntax

Response Syntax

Response Structure

Exceptions