AppSec tasks
As an Application Security (AppSec) team member, your role includes the following focus areas:
Set up the platform
Before there's anything to triage, applications need to be onboarded. You work through platform setup and assign onboarding tasks to developers, who add applications and required metadata. Contrast tracks task status (Pending, Incomplete, Complete) so you can see where onboarding stands across teams.
You also configure rules and policies (Assess rules, ADR protect rules, and application exclusions) and handle any other organization administration tasks Northstar needs to start generating reliable data.
Monitor issues and incidents
Day to day, you work from the Insights dashboard or the Issues page. On the Issues page, sort by Contrast score or severity to bring the most severe items to the top.
Contrast creates one issue per root library or per code-level vulnerability location, correlating every related observation and CVE underneath it, so you're triaging one entry per underlying flaw rather than a flood of duplicate detections. An incident is a step up from that, a collection of one or more issues and observations that demands an immediate response, and Contrast creates one automatically based on ADR rules. Each issue in the list shows its severity, Contrast score, issue ID, status, affected application, how many times it's been observed, and when it was last detected.
For a wider view, Explorer shows your organization's full application layer, applications, servers, called APIs, databases, and libraries, as a connected map. Application entities display their Contrast score directly, so you can spot the riskiest parts of your environment without opening each one. Selecting an application's issue or incident count takes you straight into the filtered list.
Review issue and incident details
Expanding an issue gives you the full picture across several tabs in Northstar:
Overview: severity, status, first and last detected dates, the rule that triggered it, mapped MITRE ATT&CK tactics, and Contrast's fix guidance, including Intelligent Remediation and runbook detail where available.
Activity: a log of everything Contrast and your team have done on the issue, plus a comments thread.
Evidence: the HTTP request info, data flow, string operations, and stack traces that led Contrast to flag it.
Observations: every individual event tied to the issue, including source IP, the rule violated, and a result value (Exploited, Suspicious, Blocked, or Probed) that tells you how confident Contrast is that it was a real attack.
CVEs: for SCA-detected issues, each CVE's ID, its CVE Shield status, the environment it was found in, and the affected library.
CVE Shield status doesn't just sit in that tab for reference, it also moves the issue's Contrast score directly. The score drops while a CVE is in a protected state, and rises again if the shielded vulnerability comes under attack.
From here, you assign incidents to a developer for remediation and notify them that a task needs attention.
Verify remediation and confirming resolution
Once a fix ships, don't just take the pull request's word for it. Monitor the Incidents and Issues pages to confirm a fixed issue isn't still being exploited.
When you're satisfied it's resolved, change the incident's status to Closed on the Incidents page. Northstar prompts you for a reason and description when you do, so there's a record of why it was closed and by whom.
Adjust ADR rules
If monitoring turns up rules that are too noisy, too quiet, or need a different response posture, you can change ADR rule and CVE shield modes between blocking and monitoring to tune how Northstar handles future incidents. This is where you feed what you learned from triage back into the system, rather than fixing the same class of issue by hand every time it recurs.