Security Audit

Structured audit log viewer for all security scans. Filter by severity, drill into CVE detail panels, browse scan history, and export findings as reports.

Overview

Security Audit is the persistent record keeper for the Security module. While Security Hub is where you run scans, Security Audit is where you review them — across time, across files, and with rich filtering to surface the issues that matter most.

Every scan run from Security Hub is automatically logged here. Findings are organised into a sortable table with severity badges, CVE identifiers, affected file paths, and recommended fix actions.

Pairs with Security Hub

Run scans in Security Hub — results appear here automatically. Security Audit never runs scans directly; it is a read and filter interface only.

Quick Start

Run at least one scan in Security Hub (e.g. full-audit or security-analysis src/).
Open Security Audit from the sidebar.
Use the severity filter tabs to narrow the finding list to Critical, High, Medium, or Low.
Click any finding row to open the CVE Detail Panel on the right.
Click Export in the top toolbar to download the current filtered view as JSON or CSV.

Severity Levels

Level	CVSS range	Meaning	Recommended action
Critical	9.0 – 10.0	Immediate exploitation possible, data exfiltration or RCE risk	Fix before next deploy
High	7.0 – 8.9	Significant attack surface, likely exploitable	Fix within current sprint
Medium	4.0 – 6.9	Exploitable under specific conditions	Schedule for next sprint
Low	0.1 – 3.9	Hardening opportunity, low exploitation likelihood	Track and address quarterly

UI Walkthrough

Header row

The top bar shows the screen title, a scan count subtitle, an Export button, and a Refresh button.

Filter bar

Below the header, the filter bar contains:

Search input — full-text search across CVE IDs, file paths, and finding descriptions.
Severity filter tabs — All / Critical / High / Medium / Low. The tab shows the count of findings at that level.
Scan type dropdown — filter by scan origin: SAST, Dependency, Secrets, Headers, Permissions.
Date range picker — narrow to findings from a specific scan session.

Finding table

Each row in the findings table shows:

Severity badge — colour-coded pill.
CVE / Finding ID — clickable link that opens the CVE detail panel.
File path — the affected file and line range.
Description — one-line summary of the issue.
Scan date — when this finding was last detected.
Status — Open / In progress / Resolved.

CVE Detail Panel

Clicking a row opens a right-side detail panel with:

Full CVE description and CVSS score breakdown.
Affected package version and the version that fixes the issue.
Code snippet showing the flagged lines.
Recommended remediation steps.
Links to the upstream CVE database entry and advisory.
A Mark as resolved button to update the finding status.

Exporting Findings

The Export button in the top toolbar exports the currently filtered view. Available formats:

JSON — full structured data, suitable for ingestion into SIEM tools or custom dashboards.
CSV — spreadsheet-friendly, suitable for stakeholder reports.

Export only what you need

Apply severity and scan-type filters before exporting to get a focused report. Exporting the unfiltered list can produce very large files on projects with many scan runs.

FAQ

How long is scan history retained?

Scan history is retained for the current TotalApp session. Persistent cross-session retention with configurable retention windows is on the roadmap.

Can I mark a finding as a false positive?

Use the Mark as resolved button in the CVE Detail Panel and set the status to False positive. False-positive findings are hidden from the default view but remain in the full history.

Does Security Audit integrate with Jira or Linear?

Direct issue tracker integration is planned. For now, export as CSV and manually create tickets, or use the JSON export to drive a custom automation workflow via TotalApp's Workflow Editor.