View route details
Route coverage helps you understand how vulnerabilities map to your application's attack surface.
If you remove routes from the Route coverage list (steps 8 and 9) and they still exist when the server restarts or you exercise the application, Contrast includes them in the list again. To permanently exclude routes, select the Exclude icon (
) at the end of the route's row.
Select Applications in the header.
Select the name of an application.
The Overview tab shows the number of routes exercised compared to the number of total routes in your application.
In the Overview tab, select the number of routes exercised or select the Route coverage tab.
In the Route coverage tab, the Route coverage summary shows this information:
Exercised routes: This section shows these details:
The percentage of discovered routes that you exercised.
The number of exercised routes.
Session metadata: This section shows these details, based on the applied session metadata filters:
Note
If you haven't applied session metadata filters, no values display. To see values for session metadata, select Apply filter or Edit filter (to change the current filters) and specify the filters you want to use.
Percentage of routes exercised that match the applied filters.
The number of exercised routes that match the applied filters.
The selected session.
The repository for the application
Build number
Branch name
Committer
In the Route Coverage tab, if you don't apply session metadata filters, the route coverage chart displays.
Note
If you previously selected metadata filters, this chart does not display. To see the chart, select Clear the filters.
The chart displays details about routes based on their status:
Discovered by Contrast (but never exercised with the agent)
Exercised with the Contrast agent
Exercised and found to contain vulnerabilities
In the Route coverage list, view additional details about each route.
Route: A route that Contrast identified or is tracking.
Server: The servers where the application is running.
By default, the Server column shows up to three servers. To view a complete list of servers (if more than three are in use), select Show all.
Note
When you delete a server, Contrast removes it from the list instead of displaying it as greyed out.
Vulnerabilities: The number of vulnerabilities associated with the route.
Last activity: The activity time span for the route.
Status: The route status.
Select an option to view details for each route that Contrast has identified in the application:
To view the URL for the route, select a route name.
To view vulnerability details for a specific route, select a section of the severity bar Vulnerability column. Each section indicates one or more severity levels: Critical, High, Medium, Low, and Notes.
To view routes based on an activity time span, select the Filter icon (
) next to the Last Activity column.Changing the time span also changes the time span for the route coverage chart.
To clear the filter selection, select Clear next to the column heading.
To view routes with a specific status only, select the Filter icon (
) next to the Status column. The status options are:All: Shows all routes that are not excluded.
Exercised: Shows only routes that are exercised.
Not Exercised: Shows routes that Contrast discovered but are not exercised.
Vulnerable: Shows only routes that have a vulnerability associated with them.
Excluded: Shows only routes that you excluded from the application scoring calculations.
To remove a single route from the list:
Hover over the end of the row and click the Remove icon (
).To confirm the removal of the route, select Delete.
To remove multiple routes from the list:
Select the check mark next to one or more routes or to select all routes, select the check mark next to Route.
In the batch action menu at the bottom of the page, select the Remove icon (
).To confirm the removal of the route, select Delete.
To view and share route details outside of Contrast:
Select the check mark next to one or more routes or to select all routes, select the check mark next to Route.
In the batch action menu at the bottom of the page, select the Export icon(
).This action exports the details to a CSV file. The file downloads to your default download location.
The CSV file includes:
A list of the application's routes.
Details about the server on which they were found.
Details of when the routes were last exercised.
A list of vulnerabilities, the severity and status of each.