Welcome to Northstar
Northstar offers a fresh way to look at your security data, bringing everything together into simple concepts. Instead of separate views for different security tools, Northstar uses shared models to give you a unified view. This unified view enables you to focus on the vulnerabilities and attacks that are the most important and represent the greatest risk to your organization.
Let's take a look at the core building blocks that you'll find: observations, issues, and incidents. Additionally, learn more about Contrast Graph and Contrast Score.
Observations
Think of Northstar observations as individual security snapshots. They are the most basic pieces of information Northstar collects.
The main types of observations are:
Vulnerability detections from the Contrast AST technology.
Attack events from the Contrast ADR technology.
Suspicious or malicious activity targeting your application.
Issues
Issues represent a specific security problem that a developer can likely fix in one place. They bring together related observations from both the Contrast IAST and Contrast ADR technologies. Think of an issue as a container for all the evidence related to a single underlying security flaw.
Northstar groups observations into issues based on these shared characteristics:
Organization: Issues are specific to a single organization for security and privacy reasons.
Application: Even if a problem appears in multiple applications, Northstar creates a separate issue for each application. A developer needs to address the issue in each application.
Rule: The specific security rule that triggered the vulnerability detection (from Contrast AST technology) or the attack event (from Contrast ADR technology) must be the same for observations to be grouped into a single Issue.
Route: The location within the application where Northstar found the vulnerability or the attack occurred must be the same (as determined by the Contrast agent) to link observations.
Northstar can create issues or attack events even if it hasn't found a related vulnerability. This behavior helps highlight active threats. Northstar creates issues for all blocked attack events.
View issues in the Contrast Insights dashboard on the Issues page, and in Explorer.
Incidents
Incidents represent significant security situations that require attention from a Security Operations Center (SOC) team. Just as issues are collections of observations, Northstar creates incidents from observations when it detects an attack, and will automatically correlate and adjust the Contrast score of the associated issues so that you are focused on the highest risk items. Incidents are created when receiving “exploited” observations.
View incidents in the Contrast Insights dashboard, on the Incidents page and in Explorer.