Security center

The Security page (under Settings in the sidebar) gathers findings from security scanners into one list per project. It de-duplicates them, tracks which are open or fixed, gives the project a score, and lets you triage each finding.

OpsNexus doesn't run scanners itself. Findings come from three sources:

• Scan reports uploaded on the page.
• Scan reports sent by CI pipelines through the API.
• A SonarQube server that OpsNexus syncs every hour.

Security is a project module: findings belong to the current project, and the same issue in two projects is tracked separately.

#Permissions

Inside a project, Project admin has full access, Developer and Viewer have read only.

#Supported scanners

The format is detected from the file content. Findings are grouped into four types: Vulnerabilities, Misconfigurations, Secrets and Code issues. Severities are critical, high, medium, low and info. Scanner-specific severities and CVSS scores are mapped onto these.

#Overview tab

The Overview tab shows:

• Security score: a grade from A to F and a score out of 100, based on open findings weighted by severity. It appears after the first scan report arrives.
• Tiles for Open findings, Critical, High, Medium, Low and Resolved.
• New vs resolved · last 30 days: a daily chart of findings opened and fixed.
• Open findings by source: open findings by type and by scanner.

#How the score is calculated

The score starts at 100. Each open finding subtracts points by severity:

The result is rounded and never goes below 0. Grades: A at 90 or more, B at 75, C at 60, D at 40, and F below 40. Accepted and false-positive findings don't count, because they are no longer open.

#Findings tab

The Findings tab lists findings, most severe first, 50 per page. Filter by Status, Severity, Type, Scanner and Target, or search by CVE, package or target. Each filter shows how many findings match. By default only open findings are shown. Select Reset filters to go back to the default.

Columns: Severity, Finding (rule ID and title), Package / file, Fix (fixed version), Target, Seen and Status.

Select a finding's rule ID to open it. The dialog shows the target, scanner, package, fixed version, file and line, first-seen time, description and reference links.

#Triage a finding

With Read & modify on Security findings:

1. Open the finding.
2. Optionally write a Triage note.
3. Select Accept risk or False positive. To undo, select Re-open.

The dialog shows who triaged it last. Each triage is recorded in the audit log as security.finding.triage.

#Open, resolved and re-opened

Each finding has a stable fingerprint made from the scanner, rule, target and package or file. When a newer scan from the same scanner covers the same target:

• A finding that is missing from the new scan is marked resolved.
• A resolved finding that appears again is re-opened.

New critical or high findings send a security.vulnerability notification through your notification rules. See Notifications.

#Scans & sources tab

#Upload a scan report

1. Open Scans & sources.
2. In Upload a scan report, enter the Target: an image such as registry/app:1.4.2, or a repository name.
3. Optionally enter a Branch (optional).
4. Select Choose a report file and pick a .json or .sarif file.
5. Select Upload report.

The page checks that the file is valid JSON before uploading.

#Send reports from CI

Pipelines can post reports to POST /api/security/scans with an API key. Send the project with the X-Project-Id header.

trivy image --format json --output trivy.json registry/app:1.4.2

jq -n --slurpfile r trivy.json \
  '{tool: "auto", target: "registry/app:1.4.2", branch: "main", report: $r[0]}' \
| curl -sf -X POST "$OPSNEXUS_URL/api/security/scans" \
    -H "X-API-Key: $OPSNEXUS_API_KEY" \
    -H "X-Project-Id: $OPSNEXUS_PROJECT_ID" \
    -H "Content-Type: application/json" \
    --data @-

The key's owner needs Read & modify on Security findings in that project.

#Connect SonarQube

With Full access on Security findings:

1. Select Connect SonarQube.
2. Enter a Name and the SonarQube URL, for example https://sonar.example.com.
3. Enter a User token. Create it in SonarQube under My Account → Security → Generate token. The token's user needs Browse permission on the projects. You can also pick a saved credential.
4. Enter the Project keys (comma-separated).
5. Select Connect and sync.

OpsNexus pulls open vulnerabilities and bugs and the quality-gate status of each project key every hour. Select Sync now to pull at once. The card shows the last sync time, any error and each project's quality gate.

#Scan history

Scan history lists every uploaded report, CI scan and SonarQube sync: the scanner and source, target, branch, counts by severity, how many findings were new and resolved, and who sent it.

#Related pages

• Audit logs
• Builds & approvals
• Dashboards & reports