Triaging a report

This page covers the lifecycle of a single report: logging one, advancing it through its workflow, talking to the reporter, and disclosing it. For how reports arrive and what the register shows, see Coordinated vulnerability disclosure. For connecting a report to your GRC records, see Linking & remediation.

Log an internally discovered vulnerability

Use this when your own team finds a weakness rather than receiving it through the portal. An internal report enters the queue exactly like an external one but is not subject to the disclosure deadline.

1. In the register, click + Report to open the Report a vulnerability dialog. It notes that the report is logged internally and is not subject to the external disclosure deadline.
2. Enter a clear Title that names the issue.
3. Write a Description of the weakness.
4. Set the Severity. It defaults to Medium; the choices are Critical, High, Medium, and Low.
5. Fill in the Affected component and Affected versions if you know them.
6. Click Report vulnerability to save, or Cancel to close without saving.

The dialog closes, the new report appears at the top of the list badged with its severity, Received, and Internal, and its detail pane opens automatically.

The status lifecycle

Every report moves strictly forward through five statuses:

The path is one step at a time, forward only: you cannot skip a stage (Received straight to Fix shipped) and you cannot go back (Fix shipped to Triaged). Each transition stamps a timestamp for that stage on the report.

Work a report through the Workflow tab

With a report open, click the Workflow tab. It shows a status timeline (Received → Triaged → Fix in progress → Fix shipped → Disclosed), a Next step panel, and an Internal note field for private, team-only notes.

1. Only the current and completed stages are timestamped; the rest are pending. The Next step panel names the single move available — e.g. "Move to Triaged" with a Mark as Triaged button.
2. Optionally type into the Internal note field ("Private notes visible only to your team…") to record your reasoning, then click Save note to persist it.
3. Click the Mark as <next> button to advance. The timeline immediately stamps the new stage, the status badges update live in both the list row and the detail header, and the Next step panel advances to the following stage.

When you reach the Mark as Fix shipped step you must supply a fix version — the release that contains the fix — before the transition is accepted. That version is what an advisory references when you disclose.

Message the reporter

Each report carries a two-way thread on the Thread tab. The reporter's original submission is the first inbound message; your replies are outbound. Researchers read and post their side through the public portal; you post yours from this tab.

Use the thread to acknowledge receipt, ask for reproduction details, and coordinate timing. Posting a message requires the comment permission; everyone who can view the report can read the thread.

Disclosure: advisories and the 90-day clock

Disclosure is the final stage, and it is reached in one of two ways.

Publishing an advisory (the manual path)

A report can have at most one advisory — the public write-up. To prepare and publish one:

1. Open the Advisory tab and fill in the advisory: Title, Summary, Details, and optionally Mitigation, Credits, and a CVE ID. Save it as a draft.
2. Advance the report to Fix shipped (advisories can only be published from this status, and only when a draft exists).
3. Publish the advisory. The report transitions to Disclosed.

The disclosure deadline (the automatic path)

When an external report is created, its disclosure deadline is set to the time received plus 90 days. A background process watches the clock:

• It emails a warning to your Company Admin and Incident Manager users when the deadline is within roughly 24 hours and no advisory exists yet, and a final warning within roughly 4 hours.
• When the deadline passes and the report is still not disclosed, it auto-discloses the report (status → Disclosed). If a draft advisory exists, that advisory is published automatically at the same moment; otherwise the report is disclosed without one.

Deleting a report

The Delete action in the detail header permanently removes a report. You must supply a reason, which is written to the audit trail before the record is deleted.