# Product Documentation PlexTrac helps cybersecurity teams improve and centralize workflow management processes across the entire lifecycle. The platform streamlines all aspects of the process, from staging offensive engagements and conducting assessments to analyzing data and reporting, prioritizing critical issues, collaborating between teams, and communicating with stakeholders.

{% hint style="info" %} Visit the [Using This Site](/plextrac-documentation/master/using-this-site) page for orientation and tips about using the site navigation, exporting pages to PDF, using search, and leaving page feedback. {% endhint %} ## PlexTrac Modules When logging in to PlexTrac, users are greeted by the **Dashboard** page. Seven modules exist besides the Dashboard: **Clients**, **Assessments**, **Reports**, **Priorities, Content Library**, **Analytics**, and **Runbooks**. Click a box to learn about a module.

		topics covered
Dashboard	viewing assigned findings, reports, assessments, and priorities	User Assignments, Findings Older Than 30 days, User Reports, User Assessments	/files/deqnX1HLCDTEWy8L3qUz	/pages/3E0sebUyADQcNKYfXUx4
Clients	adding clients, adding assets, using short codes, exporting reports	Adding Clients, Adding Assets, Using Short Codes, Exporting Reports	/files/MXHH6pPBolFls8gvhzh5	/pages/-Lk6zcW1CzXz9-C_4XH1
Schedule	set up and view engagements and manage resources for reports		/files/5aLxQGnaJOTlZGqqfTz0	/pages/5uhjdeNqOs54NjSg7xfx

		topics covered
Assessments	managing assessments, creating questions, managing answer types		/files/eNAkDnqSZLRuV8SrMhSG	/pages/-Lk7-CX6pmH30MUlXCzk
Reports	creating reports, importing findings, exporting reports, affected assets	Creating Reports, Creating Findings, Importing Findings, Importing Reports	/files/G38Rf9LoC0hxV76S6MXq	/pages/-Lk7-KyezQaRUGwC26RF
Priorities	create priorities, link findings, link assets, manage scores and status		/files/iEEXPGsbfWcvpsM9pp2G	/pages/W4sI7gUhpwwS7uCLEPbM
Content Library	set up and manage NarrativesDB, WriteupsDB, and RunbooksDB	Types of Repositories, NarrativesDB, WriteupsDB, RunbooksDB	/files/20E7qKn3RVNOM7Dqsa8U	/pages/9xb5lElQyCbtKjwYgXCm
Analytics	findings metrics, filters, assets metrics, runbooks metrics, trends & SLAs	Findings , Assets, Runbooks, Trends & SLAs	/files/Il5Phf5qoVBZ3DCoMhOR	/pages/-Lk70bz68FmhgDuz9EMA
Runbooks	engagements, test plans, procedures, importing and exporting runbooks		/files/xn1SlyoX5uqxrLsPvKUF	/pages/MhtwLeeNjRSeDZOxsXXB

## Tenant Management PlexTrac provides many options for configuring a tenant. Below are links to documentation for administration tasks, configuring user-specific settings, configuring authentication (OATH and SAML), integrating with APIs and parsers, installing and maintaining PlexTrac locally, and much more. Click a box to learn about a topic.


Tenant Administration	/files/aMKqS3ki0n7WoaeP7xAl	/pages/es8f22GIGlpMEX8lfloa
User Profile Settings	/files/WMy27A0dOIGShiaYfQ47	/pages/MzKs6jH4YLaCVoWLA4XL
Authentication Methods	/files/s6Wfzy3GrExNuRz7TnP9	/pages/-M3rMLhvhUwgA2J4ETkf
Integrations and Imports	/files/5MYfie0atyx0sgkh1HdN	/pages/6iBwpvPTpulj6vdei2fO
Supported Applications	/files/waECU5pGFuMJy2xGF9j6	/pages/M359bqvAcc1eDww4004O
API Documentation	/files/hNCUAyJlRK3Kz2VAWe1Z	/pages/2wuny8pVRdWqIckhK2Xk

# Dashboard The **Dashboard** is a centralized hub where users can view relevant information in a single location. It is accessed by clicking **Dashboard** in the application's main menu.

## Overview The Dashboard provides information regarding reports, assets, and findings based on a user's role, permission settings, and access to published reports.

Information can be filtered by selecting the client from the pulldown menu.

Clicking data points within the graphs and charts will open a side drawer with further information about the findings and assets referenced in the data. ## My Work Page This page displays assignments as users receive them and a list of recently accessed reports.

The My Work page is accessed by clicking the icon found at the top right of the page.

### Recent Reports Once a report is viewed, a box will appear at the top of the page. This box displays the report's title, status, client, and the number of findings and assets. Clicking the box opens the report. ### Assignments Assignments are grouped by type. * **My findings** * **My reports** * **My assessments** * **My priorities** Assignments result from associations made from multiple areas of PlexTrac, such as being identified as a report operator, an assignee of a finding, or a reviewer of an assessment. Click a tab for more information about each topic assignment, including the assigned role for the report or assessment. ## Customizing Table View The columns displayed in the table view of each assignment tab can be added or removed by clicking the column icon on the right of the page.

Once clicked, a modal appears that lists all fields that exist for that box.

To remove a column, click **X** within the bar.

{% hint style="info" %} Fields that are required and cannot be eliminated do not have an **X** available. {% endhint %} When fields are removed, an "Add Column" pulldown menu is added at the bottom left of the modal to store the field. Any removed fields can be added later by clicking **Add Column** and selecting the field to add.

This modal represents the sequence of fields provided in the table, meaning the bar on top will be the column that appears on the far left of the relevant box. The order of columns can be adjusted within this modal by clicking the six dots on the left of the bar for a field and dragging the bar to the desired sequence place.

Each topic has its list of fields and must be customized separately. ## Notifications Messages received within PlexTrac are stored on the **Notifications** page.

This page is accessed by clicking the bell icon at the top of any PlexTrac page next to the user name and then clicking **View All**.

When new notifications exist, the bell will have a red outline.

Clicking the bell will provide a list of unread notifications. Clicking a notification directly will send the user to the page that prompted it, and the notification will be set to the "Read" status. # Clients In the **Clients** module, users can group and categorize data as needed. This helps manage confidentiality, integrity, and availability effectively while enhancing collaboration and catering to individual client needs. Users access the module by clicking **Clients** in the application's main menu.

## Overview PlexTrac defines a client as a logical grouping utilized to segregate data. The term holds various meanings within different organizations, depending on the context in which it is used. For teams external to the consulting organization, the term "client" typically refers to the individuals or entities that utilize their services. These clients may include businesses, government agencies, or other organizations that engage the consulting team to assess their cybersecurity posture, conduct vulnerability assessments, or provide related services. For these external teams, the client represents the entity they work for and to whom they deliver their expertise. For teams operating within the boundaries of an organization or company, a client could refer to a specific project, a business unit, a regional office, or a program within the organization. Defining a client in this manner facilitates segregating data, findings, reports, and assets, ensuring that information is appropriately isolated within the relevant groupings. By organizing data according to different clients, teams can manage and maintain confidentiality, integrity, and information availability. This approach allows for more collaboration and reporting within specific client-based units, prevents data overlap and ensures that each client's unique requirements and concerns are adequately addressed. The **Clients** module home page displays all clients in a tenancy.

The table view is highly customizable, allowing users to select which columns are displayed to suit their specific needs. For a deeper dive into individual client details, clicking "View" under the "Actions" column navigates directly to the "Details" tab of the Client Summary page. Similarly, clicking "Reports" provides a quick link to all reports related to a specific client. This directs users to the "Reports" tab of the Client Summary page. To review the assets linked to a client, select "View Assets," which takes users to the "Assets" tab. Finally, the interface also allows the deletion of a client. ### Configuring Table View The table view on the **Clients** home page can be customized by clicking the column view icon to the right of the search bar. Once clicked, a modal appears that lists all fields.

To remove a column, click **X** within the bar. {% hint style="info" %} Fields that are required and cannot be eliminated do not have an **X** available. {% endhint %} When fields are removed, an "Add Column" pulldown menu is added at the bottom left of the modal to store the field. Any removed fields can be added later by clicking **Add Column** and selecting the field to add.

This modal also represents the sequence of fields provided in the table, meaning the bar at the top is the column that appears on the far left of the relevant box. The order of columns can be adjusted within this modal by clicking the six dots on the left of the bar for a field and dragging the bar to the desired sequence place.

Click **Save** when finished. # Clients Components PlexTrac offers easy access to detailed client information. By clicking on a client's row from the **Clients** module home page, the user is directed to a summary page, which includes tabs for **Reports**, **Findings**, **Assets**, **Procedures**, **Details**, **Statistics,** and **Priorities**. These tabs offer insights into the client's reports, findings, asset inventory, client-specific details, and finding metrics. PlexTrac ensures a cohesive and organized approach to client management by centralizing all client data in one place. ## Reports Tab This tab lists all the reports associated with a client. It can also be reached by clicking **Reports** under the "Actions" column from the **Client** home page. {% hint style="info" %} Visit the [Reports section](/plextrac-documentation/product-documentation/reports) of this site for documentation on creating, editing, importing, and exporting reports. {% endhint %} This tab displays the report title, status, classification, creation date, and finding count. It allows direct access to the Report Readout page and associated findings. Click one of the rows for more information about a specific report.

Click **Actions** to see the list of options for reports.

### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. Once clicked, a modal appears that lists all fields. To remove a column, click **X** within the bar.

This modal represents the sequence of fields provided in the table, meaning the bar on top will be the column on the table's far left. The order of columns can be adjusted within this modal by clicking the six dots on the left of the bar for a field and dragging the bar to the desired sequence place.

Click **Save** when finished. ## Findings Tab This tab lists all the findings associated with a client via a report. {% hint style="info" %} Visit the [Findings section](/plextrac-documentation/product-documentation/reports/findings) of this site for documentation on creating, editing, and importing findings. {% endhint %}

Clicking a finding row opens a side drawer and the findings detail view. From this view, a finding status can be edited by clicking the status value, and affected assets can be viewed and edited directly. {% hint style="info" %} If a client has multiple reports with the same finding, the highest severity value among all occurrences will be displayed at the client level. However, at the report level, the finding will only have the severity value assigned for that specific report. {% endhint %} ### Bulk Actions Bulk action options appear after one or more findings are selected by clicking the checkbox to the far left of the Finding Title field or by clicking the box next to the column header. Click **Actions** to see the list of options available.

### Configuring Views The table view can be customized by clicking the column view icon to the right of the search bar. ## Assets Tab This tab lists all the assets associated with a client and the ability to view the asset, edit the asset properties, add any notes, or delete the asset.

{% hint style="info" %} [Visit adding assets to a client](/plextrac-documentation/product-documentation/clients/adding-assets-to-a-client) for more information on adding an asset to a report. {% endhint %} ### Bulk Actions Bulk action options appear after selecting one or more assets by clicking the checkbox to the far left of the Assets field or by clicking the box next to the column header. Click **Actions** to see the options available, such as linking to a priority or adding tags. ### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. ## Procedures Tab This tab streamlines the creation and management of procedures within reports, offering a view of all procedures and tactics associated with a client.

### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. ## Details Tab This tab provides an overview of the client for all *published* reports. Its primary purpose is to provide a snapshot of the client's security posture and progress in addressing the identified issues. It is a centralized dashboard where users can quickly assess the client's status at a glance, enabling efficient monitoring and decision-making.

Clicking on **Edit Client Information** offers options for managing the client's logo, name, point of contact, description, tags, and the ability to add custom fields. It is also where [authorized users](/plextrac-documentation/product-documentation/clients/managing-clients), roles, and classification levels are managed. ## Statistics Tab This tab offers a snapshot of a client's findings based on severity and status for all *published* reports. By organizing findings by severity and status, users can quickly identify the number of open or unresolved findings that require attention and follow-up actions.

## Priorities Tab This tab summarizes all client priorities. The list displayed depends on whether the [tenancy enables client-specific or tenant-level priorities](/plextrac-documentation/product-documentation-1/account-management/account-admin/tenant-settings/general-settings#priorities). It can be determined whether a priority applies to all clients or a specific one based on the "Client" column value. If a priority applies to all clients, an "All clients" value is displayed. If it is client-specific, the client's name will appear instead.

The priority can be accessed directly by clicking on its title or row. ### Bulk Actions Bulk action options appear after one or more priorities are selected by clicking the checkbox to the far left of the Priority field or by clicking the box next to the column header. Once available, click on **Actions** to see the list of options. ### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. # Creating a Client The "Create New Client" modal allows users to input essential information, such as the client's name, logo, point of contact, client notes, tags, and custom fields. Users can create a comprehensive profile for each client, enabling efficient data collection, organization, and management within PlexTrac. Step 1: From the **Clients** module home page, click **New client**.

Step 2: A modal appears with the following fields:

1. **Client Logo**: To represent the client visually, drag an image or click the designated box to navigate to a picture on the computer. 2. **Client Name (required)**: Enter the client or project name that will identify this data collection throughout PlexTrac. 3. **Point of Contact**: Enter the resource's name to contact about the data collection. 4. **Point of Contact Email**: Enter the resource's email address. If the email of a current PlexTrac user is entered, this person is added as a client user with the analyst role. If the person creating the client adds themselves as the point of contact, their default tenancy role (i.e., admin) is assigned. All roles [can be adjusted](/plextrac-documentation/product-documentation/clients/manage-client-users#changing-user-roles). 5. **Client Description/Details**: Enter any pertinent information to help provide users context. 6. **Tags**: Enter any tags associated with the client (new or existing). Any special characters will be removed, and any spaces will be replaced with an underscore (\_). 7. **Add Custom Field**: Enter additional fields and values needed to enhance the client's management. Step 3: Click **Submit**.

The new client now appears on the Clients module home page. # Managing Clients Once clients have been added, PlexTrac offers a range of features that facilitate editing and managing information, including contact details, custom fields, logos, and additional notes and details. Users can ensure client information remains accurate and relevant with just a few clicks. ## Editing Client Information Step 1: From the **Clients** module home page, click **View** under the "Actions" menu for the impacted client.

Step 2: Click **Edit Client Information**.

Step 4: The "Edit Client Information" modal appears and can be modified as desired. Click **Submit** when finished.

## Deleting a Client Step 1: From the **Clients** module home page, click the three dots under the "Actions" column corresponding to the client and click **Delete Client**.

Step 2: A modal will appear, confirming the action. Type in the client name and click **Delete**.

# Managing Client Users PlexTrac offers role-based access controls (RBAC) at the client level. RBAC allows teams to efficiently manage user privileges and permissions based on specific client requirements, enabling effective collaboration and task accomplishment. Within PlexTrac, three default levels of access exist that can be assigned to users based on their responsibilities: 1. **Administrator**: An Administrator has the highest access level within PlexTrac. They possess extensive privileges and can perform various tasks, including creating reports, adding findings, tracking status, managing users, configuring settings, and accessing all areas of the platform related to the client. 2. **Standard User**: A Standard User plays a crucial role in managing and documenting client activities. They can create reports, add findings, and track the status of ongoing projects. This level of access allows Standard Users to contribute actively, collaborate with other team members, and provide valuable insights throughout the process. 3. **Analyst**: An Analyst is a user with a more limited role. Their primary responsibility is to track and update the status of identified vulnerabilities. While they may not have the authority to create reports or add findings, their role is essential in ensuring the accurate documentation and timely resolution of identified issues. Analysts can provide real-time updates on the progress of vulnerability mitigation efforts, making it easier for the broader team to stay informed and take necessary actions. These default access levels ensure each team member has the appropriate privileges and responsibilities aligned with their role and contribution to the client's initiatives. By assigning specific access levels, teams can streamline workflows, maintain data integrity, and improve overall efficiency in managing and securing client environments. {% hint style="info" %} The [RBAC page](/plextrac-documentation/product-documentation-1/account-management/account-admin/security-and-user-management/security/rbac) provides more information on default roles, permissions throughout the platform, and user licensing. {% endhint %} ## Licensing An icon will appear at the end of the role title when adding a user to a licensed role, regardless of the number of licenses available.

Any messaging regarding user licenses will appear as a banner on the "Authorize Client Users" modal.

{% hint style="info" %} Visit the [RBAC page](https://docs.plextrac.com/plextrac-documentation/product-documentation-1/account-management/account-admin/security-and-user-management/rbac#licensed-permissions) for information on the various messaging related to licensed users and their relationship to permissions. {% endhint %} ## Adding Users to a Client Step 1: From the **Clients** module home page, click **View** under the "Actions" menu for the impacted client.

Step 2: Scroll to the "User access" section and click **Add/Authorize User**.

Step 3: Select the user to add from the "User" field pulldown menu.

Only *existing* users in the tenancy who are *not* authorized for the client appear in the pulldown menu. After adding a user, the "Role" and "Classification" fields will be automatically filled in but can be changed. Step 4: Click **Add User** to add additional users (if applicable). Click **Save** when finished.

## Deleting a User Step 1: From the **Clients** module home page, click **View** under the "Actions" menu for the impacted client.

Step 2: Scroll down to the "User Access" section and click **Revoke** under the "Actions" column in the user's row to remove access permissions.

Step 3: A dialog box will appear confirming the action. Click **Revoke**. ## Changing User Roles Step 1: From the **Clients** module home page, click **View** under the "Actions" menu for the impacted client.

Step 2: Under the "User Access" section, select the new role from the pulldown menu in the "Role" column for the user.

The change is immediate. A dialog box will appear at the bottom left of the screen confirming the change. ## Changing User Classification Level Step 1: From the **Clients** module home page, click **View** under the "Actions" menu for the impacted client.

Step 2: Scroll down to the "User Access" section and click the pulldown menu under the "Classification Level" column of the user impacted.

Step 3: Select the new classification level. The change is immediate. A dialog box confirming the change will appear at the bottom left of the screen. # Adding Assets to a Client Assets within PlexTrac are stored outside of reports at the client level within the platform. An asset can exist as a standalone file in the Clients module or associated with a finding, referred to as an affected asset. Organizations can efficiently manage and track their cybersecurity resources by organizing and storing assets in PlexTrac. This centralized approach ensures that important files and information are readily accessible when necessary, facilitating collaboration, efficient vulnerability management, and streamlined remediation efforts. ## Creating an Asset Step 1: From the **Clients** module home page, click the client's row or **View** under the "Actions" column.

Step 2: Click the **Assets** tab. Step 3: Click the **Add assets** pulldown menu and select **Create asset**.

Step 4: The "New Asset" modal appears. Enter the desired information into the appropriate fields. {% hint style="info" %} Asset Name is the only required field. {% endhint %}

Step 5: Click **Save** at the bottom of the modal.

The asset now appears in the **Assets** tab. ## Adding Assets via Bulk Paste Step 1: From the **Clients** module home page, click the client's row or **View** under the "Actions" column.

Step 2: Click the **Assets** tab. Step 3: Click **Add assets**, then select **Bulk paste assets** from the pulldown menu.

Step 4: Paste asset information into the provided box as a return- or comma-separated list. PlexTrac will parse the assets and add them to the finding. URLs with paths (i.e., [www.plextrac.com/test/](http://www.plextrac.com/test/)) will be separated into parent and child assets.

{% hint style="info" %} Check "Preserve pasted assets" to treat the pasted content as a monolithic asset. The parser will **not** attempt to break down the asset into its constituent parts (child assets) or identify potentially vulnerable parameters.\ \ ![](/files/bQCrhoAkPzcXpWjQELDu) {% endhint %} Step 5: Click **Next**. Step 6: PlexTrac will search for assets in the bulk paste that match existing assets and identify them separately from new assets on the **Review** tab. This provides the option to deselect any assets before import.

Step 7: Click **Next**. Step 8: Add any tags (optional). Click **Add X assets**.

A message confirming the import and assets are viewable from the **Assets** tab will appear. ## Importing Assets to Clients PlexTrac supports asset imports using an NMAP file or a CSV template: * **NMAP files**: Network Mapper is a [free, open-source ](https://nmap.org/)network discovery and security auditing utility. More information on NMAP can be found on PlexTrac's [Integrations](/plextrac-documentation/product-documentation-1/integrations-and-file-imports) section of this site. * **CSV**: PlexTrac provides a template for uploading assets to a client. Click the file below to download the template: {% file src="/files/fyFq6f012j9gylfefx39" %} updated 4-20-2023 {% endfile %} ### CSV Asset Template Rules The template is prepopulated with all permitted fields and sample values. {% hint style="danger" %} Do not add additional columns or some data may not be imported. {% endhint %} | Column Header | Description | Sample Value | Comments | | ----------------- | ---------------------------------------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | name | Asset Name | temp-asset-1 | | | ip addresses | IP address of the asset | 10.0.0.10 | | | criticality | Importance level of the asset | High | | | data owner | Person responsible for the data | Jane Pentester | | | physical location | Geographic location of the asset | Boise | | | system owner | Person responsible for the system | John | | | ports | Open/closed ports and associated services | 22/open/tcp//ssh//OpenSSH 4.3 (protocol 2.0)/ | Each port can have up to eight values, separated by a slash. See the Ports section below after the table for more information. | | tags | Categorization tags | Karbo | | | description | Brief description of the asset | csv-desc1 | | | parent | Hierarchical relationship | Child 1 | | | type | Asset type | Workstation |

The value for this field must be one of the following: Workstation, Server, Network Device, Application, or General. If another value is used, it will be ignored, and the Asset Type value will display in PlexTrac as "Not Set."

This field is not case-sensitive.

The value for this field must be blank, Passor Fail. If another value is used, it will be ignored, and the Asset Type value will display in PlexTrac as "Not Set."

This field is not case-sensitive.

Multiple values for the ports cell are separated by commas, such as: `22/open/tcp//ssh//OpenSSH 4.3 (protocol 2.0)/, 25/open/tcp//smtp///, 53/closed/tcp//domain///, 70/open/tcp//gopher///, 80/open/tcp//http//Apache http 2.2.3 ((CentOS))/, 113/open/tcp//auth///, 31337/open/tcp//Elite///` Each port can have up to eight values, separated by a slash. This means there must be seven slash characters (/) for each port ingested, even if no data exists within the slashes. If the correct number of slashes is not used, an import error will appear, and the file will not be accepted. Examples of valid data values for the ports field: * 80/////// * 80/open////// * 80/open/tcp///// * 80/closed/tcp/auth//// * 80/open/tcp/auth/ssh/// * 80/open/tcp/auth/ssh/test 6// * 80/open/tcp/auth/ssh/test 6/Apache http 2.2.3 (CentOS)/ The first value captures the port number. The second value captures the port status (any ports with a status of `Closed` will not be imported). The third value captures the protocol. The fifth value captures the service, and the seventh value captures the version. {% hint style="info" %} If the port has a defined closed status, the cell is left blank entirely (the field is optional), or just one value is entered (such as `15.22.161.22`), then it is not necessary to include all seven slashes. {% endhint %} ### Importing Assets Step 1: From the **Clients** module home page, click the report row or **View** under the "Actions" column.

Step 2: Click the **Assets** tab. Step 3: Click **Add assets**, then select **Bulk paste assets** from the pulldown menu.

Step 4: Drag a file into the modal or click the box to navigate to the file on the computer.

Step 5: Click **Import**.

A message will appear confirming import. The new assets are displayed on the **Assets** tab. To view imported values, click **View** of the imported asset.

To view imported port information, click **Notes/Descriptions**. # Managing Assets Existing assets in PlexTrac are managed from the **Clients** module. Assets may be found either from the **Assets** tab of a client, the **Assets** tab of a report, or via the **Findings>Affected Assets** tab when creating or modifying a finding. ## Modifying an Asset for a Client Step 1: Within a client, click the **Assets** tab. Step 2: Click **Edit** under the "Actions" column of the asset to modify.

Step 3: Update desired fields on the "Edit Asset" page.

Step 4: Click **Asset Detail**.

Step 5: A list of asset metadata and the **Associated findings** tab are presented. Click **Notes/Description**.

{% hint style="info" %} The **Associated findings** tab table view can be customized by clicking the column icon to the right of the search bar. ![](/files/XwoBzmkDy0C4ntziXC7c) {% endhint %} Step 5: Existing ports, notes, and descriptions are presented. Add information by clicking **Add Note**.

Step 6: Click the **Child assets** tab to view any child assets that may exist. The **Child assets** tab table view can be customized by clicking the column icon to the right of the search bar.

## Bulk Actions Bulk action options appear after selecting one or more assets by clicking the checkbox or the box next to the column header.

Click **Actions** to see the options available, such as linking to a priority or adding a tag. # Using Short Codes for Clients Short codes are small snippets that perform search-and-replace operations throughout the platform. They are designed to streamline report creation and promote data reuse, saving time and ensuring consistency across reports. Short codes can be utilized within report narratives and finding's rich-text fields to automate specific tasks and provide standardized content. Short codes can simplify report creation by eliminating the need to modify repetitive or common content sections manually. Users can define code snippets once and reuse them across multiple reports, saving time and ensuring consistency by applying the same language, formatting, or information throughout different reports. {% hint style="warning" %} Administrators handle [creating and managing short codes](/plextrac-documentation/product-documentation-1/account-management/account-admin/tenant-settings/short-codes). Short codes must have been previously set up by an admin. {% endhint %} Short codes can be applied at the client level to all reports related to that client. However, they can also be inserted at the [report level](/plextrac-documentation/product-documentation/reports/short-codes) if they are relevant only to a specific report. ## Adding Short Codes Step 1: From the **Clients** module home page, click **View** under the "Actions" menu for the impacted client to reach the **Details** tab.

Step 2: Click **Edit Client Information**.

Step 3: At the bottom of the modal, click **Add Custom Field**.

Step 4: In the first box on the left, enter the label value corresponding to the appropriate short code and insert the text value that will replace the short code in the second box on the right.

The "Value" box value will replace the short code (i.e., `%%LOCATION%%`) whenever found in the report's narratives or finding's rich-text fields. {% hint style="warning" %} The "Label" box value must be in the list of tenant short codes and set to "Client Field" for **Source**. \

{% endhint %} The **Custom Field** label links the short code to the value (text data) to replace it. For example: * **Label:** Location * **Value:** Boise * **Short Code:** %%Location%% {% hint style="info" %} Short Codes used in a report always begin and end with %% and have underscores rather than spaces. {% endhint %} Step 5: Click **Submit** when finished.

Step 6: Use the short code in any report narrative or findings rich-text field for the client.

Step 7: From the **Narrative** tab of the report, click **Search & Replace** at the top right of the page.

Step 8: A modal appears. Click **Replace Short Codes** to replace all short codes in the report with their corresponding text data.

Step 9: Click **Confirm**.

After a few minutes, a confirmation message will appear.

Step 10: Validate that the change(s) occurred as desired. If unsuccessful, ask an admin to verify the short code was set up correctly in the **Admin Dashboard**. # Schedule In the **Schedule** module, users can request and view engagements while others can create, approve and allocate resources to work on reports. Users access the module by clicking **Schedule** in the application's main menu.

## Overview The Schedule module streamlines scheduling, resource management, and team visibility to enhance pentesting and report efficiency. For Managed Security Service Providers (MSSPs), the scheduler oversees ongoing projects and facilitates efficient handling of incoming requests. On the client side, the portal experience consolidates all relevant information and provides intuitive tools for requesting new engagements within PlexTrac instead of email. Users can easily document and communicate engagement details to the team, while resource managers receive a holistic view to optimize scheduling. Any report managed by an engagement will display this information on the **Details** tab of a report, with a link directly to the engagement.

# Schedule Components Users can view and access engagements from the **Schedule** home page for clients they can access. The view defaults to a calendar. Additional tabs include a list of all engagements and resource availability (depending on permissions). ## Calendar Tab This tab lists all client engagements a user can access, depending on the filtered view chosen (All, Pending, Schedule, In progress, In review, and Complete). The engagements are color-coded to identify their status quickly.

## List Tab This tab displays a list view of all client engagements a user can access, depending on the filtered view chosen (All, Pending, Schedule, In progress, In review, and Complete). Engagements can be viewed or edited from this tab by clicking the task under the "Actions" column of the engagement.

## Availability Tab This tab displays a list view of all users in the tenancy who have permission to view and edit reports. Visible engagements can be filtered by clicking a status value above (i.e., "Pending").

## User Permissions What permissions have been assigned to the user dictate the user experience (what tabs can be viewed and what tasks can be completed) in the Schedule module. In addition, users will only see engagements associated with clients they can access. This module's permissions list can be viewed and customized for enabled roles on the Role-Based Access page of the **Admin Dashboard** under "Engagement Scheduler Permissions."

# Creating an Engagement Users with permission to approve an engagement will have a "New engagement" button available in the Schedule module. Step 1: Click **New engagement** from the **Calendar** tab of the **Schedule** module.

Step 2: Enter information about the engagement. Required fields are identified with a red asterisk. Click **Continue**.

Step 3: Add any relevant files for context. Click **Continue**.

Step 4: Enter report details. Click **Continue**.

Step 5: Select the dates to begin and end work on the engagement by inserting the cursor into the "Engagement dates" box and clicking the desired dates.

Step 6: Assign resources to work on the engagement by clicking the checkbox next to the desired resource under the "Operators" column. After selecting an operator, the engagement will appear next to that resource. Any existing resources that the operator is working on will also be displayed. Click **Save**. {% hint style="info" %} Report operators will receive an email with an attached .ics file. Most calendar applications, such as Microsoft Outlook, Google Calendar, and Apple Calendar, support ICS files. {% endhint %}

The engagement now appears on the **Calendar** and **List** tabs for viewing and modification. # Requesting an Engagement Users who do not have permission to approve an engagement can still request one. Step 1: From the **Calendar** tab of the Schedule module, click **Request engagement**.

Step 2: Enter the engagement details in the provided side drawer. Click **Continue**.

Step 3: Add any relevant files for context. Click **Submit**.

A dialog box will appear explaining the next steps. Click **Ok**.

The engagement is now listed as pending on the **Calendar** and **List** tabs. # Managing Engagements Existing engagements are managed from the **List** tab of the **Schedule** module.

Multiple tasks can be performed on existing engagements depending on the user's permissions. If a user has view access but nothing else, a message will appear in the engagement-side drawer when accessed.

## Viewing an Engagement Users with the appropriate permissions can view engagements. Step 1: From the **List** tab of the Schedule module, click the row or **View** under the "Actions" column of the desired engagement.

On the **Files** tab, a side drawer will appear describing the engagement details and any provided support files. For easy access, a link directly to the report is provided.

Step 2: Click **X** at the top right of the drawer to exit. If permissions allow, the user can edit or cancel the engagement from this screen. ## Approving an Engagement Users with the appropriate permissions can approve engagements. Step 1: From the **List** tab of the Schedule module, click the row or **View** under the "Actions" column of the desired engagement.

Step 2: A side drawer describing the engagement details and any provided support files will appear. Click **Schedule & create report**.

Step 3: Review the first three tabs of the submitted engagement for accuracy and add any additional information. When finished, click **Continue** to move on to the next tab.

Step 4: On the fourth tab, **Select & assign operators** and assign resources to work on the engagement by clicking the checkbox next to the desired resource under the "Operators" column. After selecting an operator, the engagement will appear next to that resource. Any existing resources that the operator is working on will also be displayed. Click **Save**.

## Canceling an Engagement Users with the appropriate permissions can cancel engagements. {% hint style="danger" %} This action can not be undone. If canceled, the engagement will need to be created again manually. {% endhint %} Step 1: From the **List** tab of the Schedule module, click the row or **View** under the "Actions" column of the desired engagement.

Step 2: A side drawer describing the engagement details and any provided support files will appear. Click **Cancel request**.

Step 3: A modal will appear, asking for confirmation. Click **Cancel Request**.

## Editing an Engagement Users with the appropriate permissions can edit engagements. Step 1: From the **List** tab of the Schedule module, click the row or **View** under the "Actions" column of the desired engagement.

Step 2: A side drawer describing the engagement details and any provided support files will appear. Click **Edit**.

Step 3: Edit the engagement as desired by changing content until the end and clicking **Save**. {% hint style="info" %} See the [Creating an Engagement](/plextrac-documentation/product-documentation/schedule/creating-an-engagement) page for more details on the various parts of an engagement. {% endhint %} ## Downloading Support Files Step 1: From the **List** tab of the Schedule module, click the row or **View** under the "Actions" column of the desired engagement.

Step 2: A side drawer describing the engagement details and any provided support files will appear. Click the **Files** tab.

Step 3: Click the download icon of the file to access it.

# Engagement Status The engagement status reflects the lifecycle stage and comprises six values labeled with color coding throughout the module.

## Status Mappings Below are the different status states for a report and engagement, the relationship mapping, and any additional notes. Some of the engagement status values are tied to the status of the associated report.

Report Status	Resulting Engagement Status	Notes
(not applicable)	Pending	This status indicates the engagement has been requested but not approved.
Draft	Scheduled	This status indicates that the engagement has been approved and is slated to begin later.
Draft	In Progress	This status reveals that an approved engagement start date has been reached. The status will move automatically to `In Progress` on the start date based on queries that run every hour.
Ready for Review	In Review	This status reveals that the report associated with the engagement is in one of the three view stages.
In Review	In Review	This status reveals that the report associated with the engagement is in one of the three view stages.
Approved	In Review	This status reveals that the report associated with the engagement is in one of the three view stages.
Published	Complete	This status reveals that the report associated with the engagement has been published.
(not applicable)	Canceled	This status indicates the engagement was terminated.

# Assessments The **Assessments** module offers security consultancies and pentesters a streamlined approach to developing and managing framework-based governance risk and compliance assessments and scoping questionnaires. This functionality promotes consistency across assessments and reduces the time and effort required for their creation and management. An additional benefit of managing assessment questionnaires in PlexTrac is the ability to utilize PlexTrac's **Reports** and **Analytics** modules to track and report on the status of the assessment findings. Users access by clicking **Assessments** in the application's main menu.

## Overview Assessments are crucial for identifying, evaluating, and prioritizing security weaknesses in systems, networks, or applications. They aim to uncover vulnerabilities that malicious actors could exploit. Organizations can strengthen their security defenses and reduce the likelihood of successful attacks and data breaches by systematically reviewing and analyzing areas prone to risks, such as software bugs, misconfigurations, and other security weaknesses. Various paradigms concentrate on evaluating security in vulnerability assessments. Network vulnerability assessments focus on scrutinizing network infrastructure, devices, and protocols to identify potential weak points that attackers could exploit. Web application vulnerability assessments specialize in detecting and remedying security flaws specific to web-based applications. Host-based vulnerability assessments concentrate on individual systems or hosts, including servers and workstations, to identify potential vulnerabilities and implement necessary safeguards. Some of the most commonly used assessment frameworks in PlexTrac include CMMC (Cybersecurity Maturity Model Certification), NIST (National Institute of Standards and Technology), CIS (Center for Internet Security), ISO (International Organization for Standardization), FFIEC (Federal Financial Institutions Examination Council), and NYDFS (New York Department of Financial Services). Assessment questionnaires are valuable for gathering relevant information and evaluating security practices. They serve many purposes, such as identifying vendor risk management, conducting internal and external audits, or obtaining SOC2 certification. By utilizing well-crafted questionnaires, organizations can systematically gather data regarding their security practices, policies, and procedures, which are then used to assess their effectiveness and compliance with established standards. These questionnaires facilitate a structured approach to evaluating security measures, streamlining the process and ensuring consistent evaluation across different projects and organizations. The **Assessments** module has two tabs: * **In Progress/Completed**: This option shows all assessments the user can view, including completed and in-progress assessments. Client and status can filter assessments. * **Manage Questionnaires**: This displays the list of questionnaires available for assessment purposes in the tenancy. It also allows users to create and manage questionnaires and import questions from a JSON file.

# Assessment Components PlexTrac's assessment module offers a user-friendly interface that enables effective assessment management, progress tracking, data collection, and collaboration. It ultimately facilitates the submission and presentation of comprehensive assessment findings.

1. **Questionnaire progress bar**: Visually displays the progress made on the assessment and provides a percentage representation. Users can track their progress as they complete questions, with the bar gradually filling up as the questionnaire is completed.\ ![](/files/NAeKIoHAbp7y1F9nWfgd) 2. **Question navigator box:** This box allows searching for the title of any question within the assessment. The key icon explains the circle expressions appearing for a question.\ ![](/files/ROHZLCvHbrbxrI4XRVPR) 3. **Filter by status box:** Further filters the results list by question status. \ ![](/files/zW4U5b4Q52SbYnq6IBWB) 4. **Results count:** This displays the number of questions in the assessment and dynamically updates based on filter and search queries.

5. **Questions column:** Lists all questions that exist in an assessment. The view will change dynamically based on filter and search queries. Select a question from this list to view or complete. \ ![](/files/WX47GYoSEEDtcU0f92FO) 6. **Questions column navigation**: Provides access to questions that appear on different pages, when applicable.\ ![](/files/hGgtJRV1nRMVxMV6kSiD) 7. **Question details box**: Presents the question selected for viewing and completion. \ ![](/files/tiPm3W2LOcCD5jxyotdl) 8. **Reviewers button:** Used to assign assessment reviewers (this option disappears for completed assessments). 9. **Submit assessment button:** Used to submit the assessment and move it to "Completed" status. # Managing Questionnaires The **Questionnaire templates** tab is a directory of assessment questionnaires available for a tenant. This tab provides a centralized location where users can perform various actions, such as creating new questionnaires, modifying existing ones, importing questionnaires from external sources, or deleting no longer-needed questionnaires. The primary objectives of assessment questions are twofold. First, they aim to bolster the effectiveness and thoroughness of the assessment process by providing additional context and relevant information. By including well-crafted questions, the assessment becomes more comprehensive and capable of capturing a broader range of data. Second, the information collected through these assessment questions is crucial in generating meaningful findings when the assessment is completed and submitted as a report. These findings, derived from the accumulated data, serve as valuable insights and recommendations. Furthermore, the Questionnaire templates tab also provides the functionality to initiate client assessments. This feature streamlines the assessment workflow by seamlessly integrating the questionnaire creation and initiation steps within the same interface. ## Creating a Questionnaire Step 1: Click **New Questionnaire** from the **Questionnaire templates** tab of the **Assessments** module.

Step 2: Enter a unique title and select the reference framework from the pulldown menu. The reference framework value tags assessments and questions for future categorization and management.

Step 3: Click **Create Questionnaire**.

Step 4: Edit this section as needed.

* **Questionnaire Title** (required): This value entered in Step 3 can be edited here. This value will appear in the expanded section of the questionnaire (reference number one in the question example below). * **Reference Framework:** This value was selected in Step 3 and cannot be edited. The reference framework value tags assessments and questions for future categorization and management. * **Require Completion of All Questions:** If all questions must be answered before completing the assessment, check the box. Step 5: Click **Save Basic Info**.

### Create a New Question Section

* **Title** (required): Question title and value that will appear in the expanded section of the questionnaire *(see number 1 in the example below)*. * **Description** (required): Description of the question that will appear as additional context for the user when answering the question *(see number 2 in the example below)*. * **Answer Types** (required): Header value for multiple-choice questions *(see number 3 in the example below)*. \ \ Additional multiple-choice questions can be added by clicking **Add Answer Type**, which is helpful for assessments that score off multiple categories, such as Process and Practice maturity in CMMC.\ \ Check the box under "Require?" to make answering the question mandatory when completing the assessment.\ \ The list of values available for each multiple-choice question can be previewed by hovering over the informational icon to the right of the **"**Answer Types" label (but only [admins can edit answer type labels and answer type values](/plextrac-documentation/product-documentation-1/account-management/account-admin/tenant-settings/general-settings#answer-types)). * **Add Input Field**: An additional label can be provided and made mandatory if necessary *(see number 4 in the example below)*. The label will be presented to the user with a box for data entry. Enter as many Input Fields as required. * **Add Custom Field**: Provides additional RTF fields with a label, if needed. Repeat as often as needed.

#### Custom Button Fields

* **Default Severity:** Pulldown menu list of values to define the default severity of the question. If a question is based on a Framework Control, it may have a predefined severity. This will be the severity of the report finding that this question will become upon submission. * **Default Score:** Optional method for providing a default score. * **Default Score Calculation:** If required, enter as a plain text string. * **Tags:** Additional information to improve search and reporting. * **Recommendations:** Recommendations relevant to the question, such as a remediation technique or policy suggestion. * **References:** References to questions to assist with implementing or verifying the assertion, such as website links. #### Writeups DB Button Information from a writeup can be linked to a question. This metadata and content from the writeup will not appear in the assessment. Still, after the assessment is submitted and the question becomes a finding, the writeup information is included on the finding detail page.

* **Writeup:** Pulldown menu list of available writeups to link to the question. * **Tags:** Additional information to improve search and reporting. This is the same field found under the "Custom" button. {% hint style="info" %} Not every field edited for a question will be displayed during the assessment. Still, it will be passed to a finding in the report generated upon submission, as each question in the assessment will become a finding.\ \ The screenshot below illustrates this: Every field greyed out and below the yellow line will not appear in the assessment but will be passed on to the finding details page after an assessment is submitted. \ \ ![](/files/luxE0oUiGgjHSW8j6kQs) {% endhint %} Step 6: Click **Create**.

The created question now appears in the "All Questions" column on the left.

This section contains a record of all questions in an assessment and provides the sequence in which they will appear. Step 7: Create more questions to complete the assessment. This can be done in two ways: 1. Clicking **Add Question** brings up a new blank list of fields.\ ![](/files/r5jmCEoxO9vOPTSy6eKy)
2. Clicking the copy icon of the question to clone.\ ![](/files/8Wyv9ybKd3GqiwfxbEEP) Step 8: Click **Create** after completing the second question. Create as many questions as needed to complete the assessment.

After multiple questions exist, the ability to sequence each question is provided should the creation of steps be outside the desired final sequence. Questions can be moved by clicking the "All Questions" question box and dragging it to the desired arrangement on the list. The numbering will dynamically change so that they are ordered as shown on the page (i.e., the question on top is always Question #1).

## Importing a Questionnaire PlexTrac allows imported questionnaires in JSON file format. Step 1: From the **Assessments** module, click the **Questionnaire templates** tab.

Step 2: Click **Import**.

Step 3: Drag the JSON file to the modal or click to browse the file on the computer. Repeat if necessary. When finished, click **Upload**. {% hint style="warning" %} Importing a questionnaire removes all linked writeups. {% endhint %}

If the wrong JSON file is used, an error message will appear. If the import is successful, the new file will appear in the list of questionnaires. ## Exporting a Questionnaire A questionnaire can be exported as a JSON file for backup or imported to another instance. Questionnaires can be exported during editing, directly from the Manage Questionnaires page, or when viewing a questionnaire. Step 1: From the **Assessments** module, click the **Questionnaire templates** tab.

Step 2: Click the three dots under the "Actions" menu of the questionnaire and then click **Export**.

Step 3: Click **Export**. The questionnaire is downloaded locally as a JSON file. ## Viewing a Questionnaire Clicking the row of the questionnaire on the **Manage Questionnaire** tab displays all question titles, descriptions, and tags on one page for easy viewing. The questions are listed in sequence.

# Starting an Assessment Users have two options for beginning an assessment. First, they can navigate to the **Questionnaire templates** tab. Second, users can start a new assessment from the **In progress/completed** tab. {% hint style="info" %} Assessments can be sent by copying the URL. If the recipients have an account in the PlexTrac instance, they can access the question and provide the necessary answers. This feature enhances collaboration and ensures that assessments progress smoothly, even with remote participants. {% endhint %} ## Option A: From the Assessments Home Page \ Step 1: Click the **Start New Assessment** tab from the **Assessments** default home page.

Step 2: Select the client the assessment applies to from the pulldown menu, then select the questionnaire. Click **Next**.

Step 3: A new page appears, presenting the assessment for modification.

## Option B: From a Questionnaire Step 1: Click the **Questionnaire templates** tab from the **Assessments** default home page.

Step 2: Click **Begin Assessment** under the "Actions" column for the desired questionnaire.

Step 3: Select the associated *c*lient/project value from the pulldown menu and click **Begin Assessment**.

Step 4: A new page appears, presenting the assessment for modification. ## Next Steps If no action is taken after an assessment is created or is not finished, the assessment will receive an "In Progress" status and be accessible from the **In progress/completed** tab.

[An assessment can be completed](/plextrac-documentation/product-documentation/assessments/take-assessment) by clicking **Edit** under the "Actions" column. # Taking an Assessment Assessments can be started immediately after creation or worked on later by opening one to complete from the **In progress/completed** tab. If no action is taken after an assessment is created or the assessment is not finished, the assessment will have an "In Progress" status. {% hint style="info" %} To save progress on an assessment, click the **Save** button within the question box as questions are answered.\ ![](/files/IQQrfjlKT4JEgjZznyJn) {% endhint %} To open and complete an "In Progress" assessment, go to the **In Progress/Completed** tab, select the desired assessment, and click **Edit**. ## Monitoring Progress The assessment module provides progress tracking for questionnaires. A visual bar indicates the questionnaire's completion status, gradually filling up as more questions are answered until it reaches 100%.

Users can provide answers, observations, notes, and attachments as questions are completed, such as policy documents, screenshots, code samples, and videos. Attachments are facilitated through a modal where files can be dragged, dropped, pasted, or browsed from the computer.

Questions can be marked as complete, and users can continue to another question by clicking the question in the left column, entering the question number in the provided box, clicking the navigation arrow to reach the previous or next question in sequence, or using search/filtering to find a specific question.

The progress bar will update as data is entered, questions are completed, and the user moves to the next question. Completed questions will have a checkmark in the circle next to the question.

Questions that are optional for the assessment will have a circle with a dotted outline next to the question's title, while questions that are required will have a circle with a solid outline. Questions touched but not marked as completed are identified with a shaded purple within the circle. Questions that have not been touched retain a white background until modified.

When an assessment has all questions completed, all questions will have a checkmark, and the questionnaire progress bar will be full and display a green checkmark.

## Answering a Question Questions are answered by selecting the question title in the Questions column, which inserts the question in the main window. The edited question is highlighted with a shaded background in the left column. A question defaults to the status of "Not Started." When a question receives input in any available field, it updates to "In Progress."

After a question has been answered, click the circle next to "Mark question complete," which will update its status to "Completed" and impact the questionnaire progress bar.

## Adding Attachments Users can gather evidence directly and securely on the platform, eliminating the need to email sensitive documents while completing assessments. Step 1: Click **Add attachment(s)**.

Step 2: Drag a file onto the modal or browse it from a local computer.

Step 3: Add any additional notes as needed. Repeat the process if more than one file is loaded. Click **Save.**

The attachment is listed on the question after the "Notes" box. Hover over the attachment filename for icons to download or delete the file.

# Reviewing an Assessment After finishing an assessment, users can easily choose reviewers from a dropdown menu. This feature simplifies the procedure of sharing findings and removes the necessity of sending confidential documents through email. The assessment is changed to a draft format with an "In Review" status when a reviewer is added. This prevents premature submission and ensures that the assessment cannot be completed or submitted until the review is complete. The number of current reviewers and remaining approvals needed for an assessment are listed on the **In progress/completed** tab.

After the reviewers finish evaluating the assessment and find it suitable, they mark it as approved. If all the reviewers approve the assessment but it is not yet submitted, the assessment will be labeled "Approved," and the overall status will be "In Progress." In the case of a single reviewer, the user can either submit the assessment or continue working on it. However, if there are other pending reviews, the assessment will be marked as "In Review" and cannot be approved until all reviews have been completed. {% hint style="info" %} If no reviewers are assigned, an [assessment can be submitted](/plextrac-documentation/product-documentation/assessments/submitting-an-assessment) anytime. {% endhint %} ## Adding Reviewers Step 1: From the **Assessments** module home page, click the row of the assessment to work on or **Edit** from the "Actions" menu.

Step 2: Click **Add Reviewers** at the top right of the page.

Step 3: Select the reviewer(s) from the entries in the pulldown menu of users. Typing text into the box will narrow the list. Repeat as needed. No limit exists on how many reviewers can be added. When finished, click **Save**.

The person assigned as a reviewer will receive an email notifying them of the task. The assessment is now in review mode.

## Managing Reviewers Step 1: From the **Assessments** module home page, click the row of the assessment to work on or **Edit** from the "Actions" menu.

Step 2: Click the **In review** button.

A modal appears listing the reviewers and their approval status.

The two values provided are "Approved" and "Pending Approval." Current reviewers can be removed by clicking the "X" next to their name, while new ones can be added by placing the cursor in the box and selecting a new reviewer. Click **Save** when finished. {% hint style="info" %} A removed reviewer will still appear on the dialog box list until **Save** is clicked. {% endhint %}

If the user has the necessary permissions, the "Approve" button will appear, provided the reviewer has not yet approved the assessment. If the reviewer has approved the assessment, an option to remove the approval will appear.

## Approving an Assessment Step 1: From the **Assessments** module home page, click the row of the assessment to work on or **Edit** from the "Actions" menu.

Step 2: Click the **In review** button.

A modal appears listing the reviewers and their approval status.

Step 3: Click **Approve**.

After a reviewer clicks **Approve**, the status changes within the modal to "Approved."

Step 4: Click **Save**.

The modal disappears. If all reviewers have approved, the status of the assessments changes on the button previously clicked in Step 3.

In addition, the status of the assessments changes on the **In progress/completed** tab.

## Revoking an Approval A user can revoke the approval of an assessment that has not been submitted (i.e., a status of "In Progress") by opening the assessment, clicking the **Approved** button at the top right of the screen, and then clicking **Remove approval** from the modal.

This will return the assessment approval status to "In Review" and display the reviewer as "Pending Approval."

# Submitting an Assessment Once an assessment is submitted in PlexTrac, the platform automatically generates a report and directs the user to the **Report** module readout view, and all questions are turned into findings. This published report contains all the findings from the assessment, making it readily accessible to stakeholders and analyst users. This feature enables quick dissemination of information to relevant parties. ## Submitting an Assessment Step 1: From the **Assessments** module home page, click the row of the assessment to work on or **Edit** from the "Actions" menu. Step 2: Click **Submit assessment**. {% hint style="danger" %} This action cannot be undone. Once submitted, a report will be generated with recorded responses. {% endhint %}

{% hint style="info" %} If a submittal is attempted with questions not completed, a warning message will appear:\ \ ![](/files/Sm17YIlEveOItuLgV3f5) {% endhint %} Step 3: If all questions have been completed, a message confirming action appears. Click **Submit assessment**.

A report readout from the **Reports** tab of the **Clients** module will be presented, providing assessment details. The answered questions are now findings. Each finding includes the question, description, assigned score, checkbox status, and any accompanying notes and relevant documentation incorporated into the assessment. If required, users can edit the report before exporting it. This feature ensures that the final report accurately reflects any updates or changes made during the assessment process. Users can review and modify the report as necessary, guaranteeing its accuracy and completeness before sharing it with stakeholders. The assessment is still listed within the **Assessment** module, now with a "Completed" status. ## Assessment Findings Status Once an assessment is submitted, all questions, including custom fields, are transformed into findings. PlexTrac then assigns a status to each finding, using business rules corresponding to the answer type and values of the question. {% hint style="info" %} More information on answer types and values can be found on the [Creating Questions page](/plextrac-documentation/product-documentation/assessments/questionnaires#creating-questions) and under [General Settings](/plextrac-documentation/product-documentation-1/account-management/account-admin/tenant-settings/general-settings#answer-types) of the **Admin Dashboard**. {% endhint %} ### Findings Status Logic Below are the guidelines used to determine the value given to a finding status. These rules are followed in sequence until the status is resolved and a value is determined. To ensure the accuracy of the rules listed in the table, the answer type value must match the value in the table, where applicable. For example, an answer type value of `Not Compliant` will result in a match and a findings status assigned, while a value of `Non Compliant` will not. The same logic is applied to custom fields. If, for example, a custom field answer type is "Yes (Pass) / No (Fail)" and the value is "Yes," the finding status assigned is `Closed`. If the custom field answer type scenario and value are not found below, the finding status assigned is `In Process`. {% hint style="info" %} If multiple answer types exist for a question, only the first answer type assigns a status to a finding. {% endhint %}

Sequence	Logic	Answer type value	Assigned finding status
1	Answer type value is Yes AND Answer type is "Yes (Pass) / No (Fail)"	Yes	Closed
	Answer type value is Yes AND Answer type is NOT "Yes (Pass) / No (Fail)"	Yes	Open
2	Answer type value is No AND Answer type is "Yes (Pass) / No (Fail)"	No	Open
	Answer type value is No AND Answer type is NOT "Yes (Pass) / No (Fail)"	No	Closed
3	Answer type is "CMMC Processes" or "CMMC Practices"	Any value	Open
4	Answer type value was left blank or not answered		Open
5	Answer type value is checked against a list of values that are mapped (if the answer type is Multiple Choice and more than one box was checked, the value of the topmost option is used)	No (Pass)	Closed
		Not Started	Open
		Strongly Disagree	Open
		Initial	Open
		Yes (Fail)	Open
		Operational	Closed
		Strongly Agree	Closed
		Optimizing	Closed
		Compliant	Closed
		Not Compliant	Open
		Required	Open
		Extremely Effective	Closed
		Not Effective	Open
		In Place	Closed
		Not In Place	Open
		N/A	Closed
		In Place w/CCW	Closed
		Not Tested	Open
6	Finding still does not have an assigned status		In Process

# Reports The **Reports** module makes generating security reports for penetration tests more efficient and effective. It enhances the value and quality of the reports by presenting the test findings clearly and concisely with relevant context and actionable recommendations. This helps ensure that all vulnerabilities, weaknesses, and potential risks are documented, allowing clients and stakeholders to understand their systems or applications' security posture. Users access the module by clicking **Reports** in the application's main menu.

## Overview The Reports module home page displays all reports that a user has permission to view. It provides a list of reports with fields the user selects (instructions on how to customize below), plus an Actions menu that allows quick access to the report readout page, report findings, and the option to delete the report. Reports can also be [imported](/plextrac-documentation/product-documentation/reports/import-plextrac-report) or [created](/plextrac-documentation/product-documentation/reports/create-report) from this page.

## Bulk Actions Menu To access the bulk actions menu, click on any box to the left of a report's name or the box next to the column header to select all reports.

After clicking on a box, an Actions button will appear with options to update one or more reports with various tasks from the pulldown menu. ## Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar.

Once clicked, a modal appears that lists all fields. To remove a column, click **X** within the bar.

Click **Save** when finished. # Report Components Individual reports can be accessed from either the Clients or Reports module. Once a report is selected, users can manage and update it using several tabs: **Readout**, **Details**, **Narrative**, **Findings**, **Assets**, **Procedures,** **Artifacts**, and **Attack Path**. ## Readout Tab The **Readout** tab provides access to the Report Narrative, Report Readout column, Findings Overview summary box, and Findings Status box. The Report Readout column has a convenient scrolling feature, making it simple for users to move through the list of findings.

Report narratives can be edited by clicking **Edit/Comment** or on the **Narrative** tab.

To view a finding narrative, click the corresponding box in the "Report Readout" column. To edit the finding content, click **Edit/Comment**.

Click **Report Narrative** to return to the default report readout view.

## Details Tab The **Details** tab offers an interface to view and modify the information entered when the report was created. For more detailed guidance on each field and its significance, refer to the [Creating a Report](/plextrac-documentation/product-documentation/reports/create-report) page.

## Narrative Tab The **Narrative** tab provides an interface for viewing and modifying existing rich-text fields (RTFs), adding new custom sections, or importing from NarrativesDB. The existing narrative sections can be expanded or collapsed using the arrow at the right of the box. {% hint style="info" %} Visit the [Collaborative Editing](/plextrac-documentation/product-documentation/reports/findings/collaborative-editing) page for more information about track changes and commenting functionality within the RTFs. {% endhint %}

## Findings Tab The **Findings** tab lists all findings associated with a report. It allows users to view a finding and manage and configure it further.

Clicking a finding row launches the findings details side drawer, which provides a snapshot view of the finding and all associated content, assets, and tags.

### Bulk Actions Bulk action options appear after one or more findings are selected by clicking the checkbox to the far left of the finding row or by clicking the box next to the column header. Click **Actions** to see a list of options, such as adding a tag or linking to a priority. ### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar.

Once clicked, a modal appears that lists all fields. To remove a column, click **X** within the bar. {% hint style="info" %} Fields that are required do not have an **X** available. {% endhint %} When fields are removed, an "Add Column" pulldown menu is added at the bottom left of the modal to store the field. Any removed fields can be added later by clicking **Add Column** and selecting the field to add.

This modal represents the sequence of fields provided in the table, meaning the bar on top will be the column on the table's far left. The order of the columns can be adjusted in this modal by clicking the six dots on the left side of a field's bar and dragging it to the preferred sequence position. Click **Save** when finished. ## Assets Tab The **Assets** tab displays all assets in the report that are linked via a finding. Assets are not added to a report directly; they only exist within a report when they are part of a finding that has been added to the report. Visit [Adding Assets](/plextrac-documentation/product-documentation/clients/adding-assets-to-a-client) for more information.

### Bulk Actions Bulk action options appear after selecting one or more assets by clicking the checkbox to the far left of the asset row or by clicking the box next to the column header. Click **Actions** to see the options available, such as adding a tag to an asset or linking to a priority. ### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. ## Procedures Tab This tab streamlines the creation and management of procedures within reports, offering greater flexibility and efficiency. Users can view and create procedures on the fly directly from a report and add existing procedures from any repository, including their runbooks database. A side drawer feature also enables quick procedure review, enhancing workflow efficiency.

The **Tactics coverage** tab allows users to review tactics coverage, providing a more holistic view of security posture.

### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. ## Artifacts Tab The **Artifacts** tab provides a dedicated space to load and associate additional information with a report. This functionality allows for the inclusion of various artifacts, such as registry keys, files, time stamps, and event logs, which can provide context and support the findings and conclusions presented in the report.

## Attack Path Tab The **Attack Path** tab visually represents the tactics, techniques, and procedures (TTPs) employed in a simulated attack, as discussed in the report. This tab offers a flexible and interactive interface that allows users to manipulate and sequence the attack path as desired. This visual representation helps stakeholders understand the attack methodology and visualize how an attacker could exploit system vulnerabilities.

More information about a finding can be accessed by clicking the eye icon within a box to pull up the Finding Details page as a side drawer.

## Report Logs The report log documents when a report was last imported and what new findings were added. Step 1: From the **Reports** module home page, click the row of the report to view or **Readout**.

Step 2: From the **Findings** tab, click **Report Logs**.

Step 3: A dialog box asks to select the import date and time. Select the desired time recorded in Universal Time (UTC).

Step 4: A list of findings added is displayed.

# Creating a Report Users can generate a report by accessing the **Clients** module or creating one within the **Reports** module. The process and experience are identical, except if a report is created from within the Clients module, there is no need to select a client. Assuming the user is currently in the Reports module, they can follow the instructions below. Step 1: From the **Reports** home page, click **Create Report**.

Step 2: Select the client from the pulldown menu. All clients for a tenancy will be available for selection.

Step 3: The modal then expands. Enter the desired data in the fields (required fields are marked with a red asterisk).

1. **Report Name:** Appears throughout PlexTrac as the report title. It is a required field. 2. **Report Classification**: Defines the [security tier](/plextrac-documentation/product-documentation-1/account-management/account-admin/security-and-user-management/security/classification-tiers) classification for the report, which can then be used to restrict access. 3. **Status:** Provides the status of the report. By default, the report will be in `Draft` mode. The user can select other options, such as `Ready for Review`, `In Review`, `Approved`, or `Published` from the pulldown menu. 4. **Report Template:** [Report templates](/plextrac-documentation/product-documentation-1/account-management/account-admin/customizations/templates/report-templates) are predefined layouts that define the structure and format of a report. They can include narrative sections, custom fields, and other elements. Select the desired template from the pulldown menu to associate a report to a template. 5. **Findings Layout:** [Findings layouts](#using-a-findings-layout) are predefined templates that provide a consistent structure for collecting data when creating a finding. Select the desired template from the pulldown menu to associate a layout with a report. 6. **Operators:** This field identifies users who work on the report. Any user with their name in it will see the report listed on their **Dashboard** under the "Your reports" tab. Enter users by placing the cursor in the field box, selecting a value, or typing a name. This field can be blank or contain multiple users. Once added, an operator can be removed by clicking the "X" to the right of the name.

7. **Start Date:** Identifies the start date of the report. Place the cursor in the field box to select a date from the calendar. 8. **End Date:** Identifies the end date of the report. Place the cursor in the field box to select a date from the calendar. 9. **Reviewers:** This field identifies users who review the report. Any user with their name in it will see the report listed on their dashboard under the "Your reports" tab. Enter users by placing the cursor in the field box, selecting a value, or typing a name. This field can be blank or contain multiple users. Once added, a reviewer can be removed by clicking the "x" at the end of their name. 10. **Tags:** Provides help when searching for the report elsewhere in the application. Click on the field to add tags and type in your desired value. You can also scroll through the list or type in characters to narrow down your options and make a selection. This field can be blank or contain multiple tags. Once added, a tag can be removed by clicking the "x" at the end of the value. 11. **Include Raw Evidence in Export:** This option ensures that all raw evidence in the report is included when exported. It is turned off by default but can be toggled on by clicking. 12. **Custom Fields:** Add any desired custom fields by clicking **Add** **Custom Field** or selecting existing custom fields from a template to import via the pulldown menu. Step 3: Click **Submit**.

Upon submission, the system creates the report's initial framework, which is ready for further content addition and collaboration. Other tabs can now be accessed to make necessary changes, such as adding findings or assets. Step 4: Click the **Narrative** tab and add a report narrative. An existing narrative can be reused by clicking **Add from NarrativesDB,** or a new one can be added by clicking **Custom Section**.

{% hint style="info" %} Visit the [Adding from NarrativesDB](/plextrac-documentation/product-documentation/reports/adding-from-narrativesdb) page for more information. {% endhint %} Step 5: Use the other tabs to build the report as needed. For more information on working with[ findings ](/plextrac-documentation/product-documentation/reports/findings)and [assets](/plextrac-documentation/product-documentation/clients/managing-assets), visit the different sections of this site or view the [report components page](/plextrac-documentation/product-documentation/reports/report-components). # Adding from NarrativesDB Step 1: From the **Reports** module, select a report and click the **Narrative** tab. Step 2: Click **Add from NarrativesDB**.

Step 3: Search or use the provided pulldown filters to find the desired section(s) to add. {% hint style="info" %} Only repositories and sections a user can view will appear in search results. {% endhint %}

Step 4: Click the box next to the section(s) to add, and the narrative will appear on the right under the "TO BE ADDED TO NARRATIVE" column.

To add all available sections (or start with all sections selected and then uncheck those not desired), click the box next to "Sections" in the table header below the search bar.

Step 5: Click the **Add X Section** button at the bottom of the page. The new section(s) will now be available for editing in the **Narrative** tab. Step 6: Click the three dots to display the option to add tags or delete the section. {% hint style="info" %} Sections deleted from the Narratives tab will not delete the section from **NarrativesDB**. {% endhint %}

# Editing a Report ## Editing from the Readout Tab Step 1: From the Reports module home page, click **Readout** under the "Actions" column of the report to edit.

Step 2: From the Readout tab, click **Edit/Comment**. {% hint style="info" %} If no report narrative was added when the report was created and no findings with narratives were added, editing from this tab will not be possible as the button will not exist. The user must first go to the **Narrative** tab and enter content or add findings. {% endhint %}

Step 3: Modify the content as needed. All changes are autosaved.

{% hint style="info" %} This page does not allow editing of headings, and some other functionality is limited. As such, editing from the **Narratives** tab is recommended. {% endhint %} ## Editing from the Narrative Tab Step 1: From the Reports module home page, click **Readout** under the "Actions" column of the report to edit.

Step 2: Click the **Narrative** tab.

Step 3: Edit the text and titles as desired. Additional functionality exists, such as adding from NarratviesDB, creating a custom section, or leaving comments. {% hint style="info" %} For more details on tracking changes and adding comments in the rich-text field, visit the [Collaborative Editing](/plextrac-documentation/product-documentation/reports/findings/collaborative-editing) page. {% endhint %}

# Using Short Codes in Reports \ Short codes can significantly improve the efficiency of data representation. They can be created to represent specific data fields at the [client](/plextrac-documentation/product-documentation/clients/using-short-codes-from-the-client-level-in-plextrac) and report levels. With pre-defined codes, users can quickly insert data without manually entering lengthy information, saving time and effort during the report creation process. Moreover, standardized placeholders help maintain consistency in data presentation across different reports, ensuring a uniform format and structure that creates a professional and organized image. Short codes provide flexibility and adaptability. They enable users to customize formats and update information without changing the underlying data. This ensures that reports are presented according to individual preferences and industry standards, minimizing the risk of errors and enhancing accuracy. {% hint style="info" %} [Short Codes](/plextrac-documentation/product-documentation-1/account-management/account-admin/tenant-settings/short-codes) are managed by admins in the **Admin Dashboard**. {% endhint %} ## Adding Custom Short Codes Step 1: From the Reports module home page, click **Readout** under the "Actions" column of the report to edit. Step 2: Click the **Details** tab.

Step 2: Click the **Add new** button at the bottom of the page under "Custom fields."

Step 3: In the first box on the left, add a label value to correspond with the short code, and in the second box on the right, insert the text value that will replace the short code. This value will replace the short code used in the report's narratives or a finding's text fields.

Repeat the process to add another short code. {% hint style="warning" %} The short code value must exist and be set by an admin as a "Report Custom Field" for Source. If it does not, contact the admin to add it under "Tenant Settings>Short Codes."\ ![](/files/WVeVoDA6QjacUxnUyh4t) {% endhint %} The **Custom Field** label links the short code to the value (text data) that is to replace it. For example: * **Label:** Contact Email * **Value (text data):** * **Short Code:** %%Contact\_Email%% {% hint style="info" %} Short Codes in the Admin Dashboard always begin and end with %% and have underscores rather than spaces. {% endhint %} Step 4: Use the short code in any report narrative. Changes will be autosaved.

Step 5: To activate the short codes, click **Search & Replace** at the top right of the page within the **Reports** module.

Step 6: The **Search & Replace** modal appears. Click **Replace Short Codes** to replace all short codes in the report with their corresponding text data.

Step 7: Click **Confirm**.

A confirmation message will appear.

Step 8: Validate that the change occurred as desired, assuming the short code exists in the tenant settings.

If the fields did not process as expected, kindly request the administrator to confirm their setup in the **Admin Dashboard** and ensure that the appropriate short code was utilized. Then, proceed to repeat steps 6-8. # Findings A finding is a weakness in systems, processes, policies, or procedures that could be exploited. It arises from penetration testing, vulnerability assessments, and compliance audits. These findings reveal potential points of compromise, categorized by severity, and often come with recommended remediation actions. Organizations can use findings to allocate resources and improve security efficiently. Findings are the most common object in PlexTrac and can be added to a report in multiple ways: * [created from scratch within a report](https://docs.plextrac.com/plextrac-documentation/product-documentation/reports/add-custom-finding/creating-a-finding) * [migrated from WriteupsDB](https://docs.plextrac.com/plextrac-documentation/product-documentation/reports/add-custom-finding/adding-findings-from-writeupsdb) * imported via [files generated from third-party tools](/plextrac-documentation/product-documentation-1/integrations-and-file-imports#third-party-tools), such as Nessus or Pentera * imported from one of PlexTrac’s [CSV finding templates](https://docs.plextrac.com/plextrac-documentation/product-documentation/reports/findings/csv-findings-templates) * imported from an [API integration](/plextrac-documentation/product-documentation-1/integrations-and-file-imports#apis), such as Snyk or HackerOne * [imported via PlexTrac’s API endpoints](https://api-docs.plextrac.com/#fb4b754f-e02b-46a6-9708-1a532a5594da) * [created after an assessment was completed](https://docs.plextrac.com/plextrac-documentation/product-documentation/assessments/take-assessment-1#assessment-findings-status) * [created after an engagement was submitted](https://docs.plextrac.com/plextrac-documentation/product-documentation/runbooks-1/engagements#submitting-an-engagement) in the **Runbooks** module ## Accessing Findings Findings can be accessed either through a report or the **Clients** module: ### **Via a Report:** 1. Click **Reports** from the main menu. 2. Select a report. 3. Click the **Findings** tab. ### **Via the Clients module:** 1. Click **Clients** from the main menu. 2. Select the client. 3. Click the **Findings** tab. A count for the number of findings is displayed at the top of the table to the left of the filter boxes.

## Identifying the Finding Source The source of a finding can be found on the Finding detail side drawer, which appears when clicking the row of a finding seen in the **Findings** tab of a report or client. If the finding was created in PlexTrac, a value of `plextrac` exists. If the finding was imported, the source of that file or integration is also recorded.

## Finding ID The finding ID can be found on the Finding detail side drawer, which appears when clicking the row of a finding in the **Findings** tab of a report or client. The finding ID is generated by importing it from the source tool or dynamically by PlexTrac when the finding is created. For example, [importing a Nessus file](/plextrac-documentation/product-documentation/reports/findings/import-scanner-data) will pull in the Nessus `plugin ID` as the PlexTrac `Finding ID`.

Every finding in a PlexTrac report must have a unique finding title. When importing findings from two scans into the same report, only additional findings from the second scan and any assets tied to existing findings are imported, even if duplicates exist. When two findings with the same title are created in two different reports for the same client, they are displayed on the **Findings** tab in the **Clients** module, as they each receive a unique finding ID. ## **Finding Reported Date** The finding reported date is when the finding was added to the report. This value is displayed under the "Date Reported" column from the **Findings** tab. This value can be modified through the "Actions" button when selecting one or more findings.

# Creating a Finding Creating a finding within PlexTrac can be initiated either through the **Clients** module or the **Reports** module, but either approach involves selecting a report to add the findings. When created within PlexTrac, users can update using five tabs: **Finding** **Details**, **Affected** **Assets**, **Screenshots/Videos**, and **Code Samples**.

Step 1: From the **Reports** module, click the row of the impacted report.

Step 2: Click the **Findings** tab.

Step 3: Click **Create Finding** from the "Add Findings" pulldown menu.

Step 4: Enter a finding name and select the finding severity. Click **Create**.

Step 5: The edit finding page has four tabs for collecting data about a finding (further details on each tab are provided below).

1. **Title (required)**: All finding titles must be unique within a report. The tool will provide an error message after clicking Save if an existing title is used**.** 2. **Severity (required)**: Identifies the severity rating for the finding. The values are in ascending order: `Informational`, `Low`, `Medium`, `High`, and `Critical`. 3. **Score type:** Identifies the score associated with a finding. This can be used to record a general score, a CVSS 2.0 score, a CVSS 3.0 score, a CVSS 4.0 score, or [dynamically create a CVSS 3.1 score using the provided calculator](/plextrac-documentation/product-documentation/reports/findings/cvss-scoring). 4. **Priorities:** Associate the finding with a priority in the Priorities module. 5. **Status:** Defines the [status of the finding](https://docs.plextrac.com/plextrac-documentation/product-documentation/reports/add-custom-finding/draft-published-flag#finding-open-or-closed-status) (`Open`, `Closed`, or `In Process`). It defaults to `Open`. 6. **Sub-Status:** Provides further details on the status of a finding if [set up by admin](/plextrac-documentation/product-documentation-1/account-management/account-admin/tenant-settings/general-settings#manage-finding-sub-statuses). If no sub-status values have been configured, this field will not appear. 7. **Assigned to:** Identifies the user assigned to a finding. Only one user can be assigned, and an email will be sent once the finding is saved. The list in the pulldown menu is derived from the list of [users added to a client](/plextrac-documentation/product-documentation/clients/manage-client-users). 8. **Description (required):** An RTF field allowing content, images, links, code examples, tables, and lists to be entered as needed. This field has [collaborative editing](/plextrac-documentation/product-documentation/reports/findings/collaborative-editing) enabled. 9. **Recommendations:** An RTF field allowing content, images, links, code examples, tables, and lists to be entered as needed. This field has [collaborative editing](/plextrac-documentation/product-documentation/reports/findings/collaborative-editing) enabled. 10. **References:** An RTF field allowing content, images, links, code examples, tables, and lists to be entered as needed. It has [collaborative editing](/plextrac-documentation/product-documentation/reports/findings/collaborative-editing) enabled. 11. **CVE ID:** Common Vulnerabilities and Exposures (CVE) identifier(s) assigned to the finding. This field requires a format of *CVE prefix + Year + arbitrary digits*. There is no limit to the number of random digits. * Example ID with four digits: `CVE-2014-3127` * Example ID with five digits: `CVE-2018-54321` * Example ID with six digits: `CVE-2019-456132`

12. **CWE ID:** The Common Weakness Enumeration (CWE) identifier(s) assigned to the finding. This field requires a two-to-four-digit number format. * Example ID with two digits: `99` * Example ID with three digits: `243` * Example ID with four digits: `1423`

13. **Tags:** Stores any tags associated with a finding to help manage and retrieve the finding more easily later. 14. **Custom Fields**: Click **Add custom field** to insert more labels and values as needed. Step 5: Click **Save**. The information entered is now displayed in the **Findings Details** tab and can be modified as needed. More details of a finding can be added by continuing to the other available tabs. ## Affected Assets Tab This tab displays any affected assets associated with a finding. The Affected Assets page provides more information on this topic, such as how to import or create.

## Screenshots/Videos Tab This tab stores screenshots and videos associated with a finding, as videos are not allowed in the **Finding Details** rich-text fields. To add a file, drag it onto the box on the page or click to navigate to files on the computer. Repeat as needed.

## Code Samples Tab This tab stores any code samples related to a finding for future reference. Click **Add Section** to add additional sections. The code will be formatted when the report is published.

# Collaborative Editing PlexTrac offers collaborative editing to save time and reduce errors when working on reports, writeups, narratives, and findings. Collaborative editing is a process in which multiple individuals work together to create, edit, and refine content in real time, with contributors simultaneously working on the same document. Collaborative editing exists in rich-text fields (RTFs) within the platform, such as: * In the *Description*, *Recommendations*, and *References* RTFs of the **Findings Details** tab of a finding * In the *Value* RTF within the **Custom Fields** tab of a finding * In the RTF of the **Narrative** tab for a report * In the *Description*, *Recommendations*, and *References* RTFs of the **Readout** tab of a report * In the *Description*, *Recommendations*, and *References* RTFs of a writeup in **WriteupsDB** * In the Section Body RTF in **NarrativesDB** {% hint style="info" %} Track changes are unavailable until the content has been created and saved (i.e., the toolbar experience differs when creating a writeup vs. editing a writeup). {% endhint %} ## Avatar Notification When a user edits one of the fields listed above, an avatar is displayed at the top right of the content box. Up to six avatars can be displayed.

The user's full name is provided if the cursor hovers over it.

## Auto-Save Rules Messaging at the top right of the section or page where collaborative editing exists indicates when content was last saved.

On pages with multiple content sections, autosave is *per section* (not page), and the time stamp will update when one of the collaborative editing content blocks is modified. For example, when one user updates the finding description at the same time another user updates the finding recommendation, both updates are saved, and the time stamp represents the last edit. ## Offline Messaging If the internet or VPN connection is lost, an error notification will indicate the connection has been lost.

Users cannot modify any collaborative editing sections until they return online. ## Tracking Changes Track changes record any modifications made to the text, formatting, or other elements. It can be enabled for a particular RTF or at the report level. When the track changes feature is enabled, any modifications made to the document are highlighted and displayed. These changes can include additions, deletions, formatting adjustments, and comments. The original content remains visible, while the modifications are marked with specific indicators, such as colored text, underlines, or strike-throughs. Additionally, users can leave comments or annotations to provide further context or explanations regarding the changes made. Collaborators can accept or reject individual changes, and the document owner or editor can review and make final decisions on which modifications to keep. This feature is helpful when multiple individuals must work on a document simultaneously or when documents undergo several revisions. ### Tracking Changes at the RTF Level The toggle to enable track changes in an RTF is located in the RTF toolbar. Click the track changes icon to enable.

Track changes can also be enabled by clicking the icon and toggle on from the pulldown menu.

When enabled, the track changes icon in the RTF toolbar is blue.

Content additions are now shown in green, deletions in red, and a log of changes appears to the right of the RTF.

Changes can be accepted or rejected by clicking the checkmark or **X** in the audit box.

Once accepted or rejected, the box and markup will disappear, and the content will reflect the choices. ### Tracking Changes at the Report Level Track changes can be controlled at the report level. This toggle applies to all RTFs within a report and appears to the right of the tab headers.

When track changes are enabled at the report level, individual RTFs will indicate that changes are being tracked (the track changes icon in the toolbar will be blue).\ \ The toggle bar available from the pulldown menu is now green (indicating track changes are on), but the ability to turn off track changes for an RTF is greyed out.

{% hint style="info" %} If turned **on** at the report level, track changes can only be turned **off** at the report level. {% endhint %} ### Adding Comments Comments are added by highlighting content and clicking the comment icon in the RTF toolbar.

A comment box appears on the right of the RTF to capture any notes. Click **Comment** when finished.

Unless resolved or deleted, the comment will stay visible with the associated text highlighted in the RTF. Someone must click the checkmark within the text box to resolve a comment.

When resolved, the comment and highlighted text disappear, but a history of the comments can be viewed by clicking the comment archive icon in the toolbar. Comments can be viewed or reopened from the archive.

{% hint style="warning" %} The comment archive feature only applies to comments within an RTF. Comments for other fields, such as a title, must be deleted to be removed from view.\ \ ![](/files/2RxguoQKSilvTL5heeg7) {% endhint %} ### Bulk Actions In scenarios where multiple changes were made to an RTF, users can accept or reject them with one click using the options provided in the track changes pulldown menu. The solutions available depend on the scenario: * If a user has not specified specific RTF modifications, only "Accept all suggestions" and "Discard all suggestions" will be available. * If a user has manually highlighted RTF content, additional options are provided, allowing the user to approve only the selected content.

# Importing Findings from a File PlexTrac can import findings from third-party tools and a CSV template for centralized data. This provides real-time visibility, holistic analysis, and efficient reporting, simplifying compliance and promoting proactive risk management. {% hint style="info" %} If importing from a CSV file, visit the [CSV Findings Templates page](/plextrac-documentation/product-documentation/reports/findings/csv-findings-templates) for more information. For a list of all third-party tool integrations and field mappings, visit the [Integrations and Mappings](/plextrac-documentation/product-documentation-1/integrations-and-file-imports) section. {% endhint %} The file-queuing feature allows users to upload multiple files simultaneously, with the ability to view the progress and status of each import. This enhancement significantly improves efficiency by enabling background processing, which lets users continue working while files are being processed. The benefits include reduced wait times, increased productivity, and enhanced visibility into the import process. {% hint style="info" %} Up to 25 files no larger than 5GB each with a combined aggregate size of 20GB can be imported simultaneously. {% endhint %} ## Importing From a File Step 1: Within the **Reports** module, click the impacted report from the list to bring up the **Readout** tab. Step 2: Click the **Findings** tab.

Step 3: Click **Add Findings** and select **File Imports** from the pulldown menu.

Step 4: A side window appears. Drop the file into the provided box or browse it on the computer. Repeat as necessary for up to 10 files (totaling 20GB). If required, select the source from the pulldown menu.

Step 5: Click **Continue**. Step 6: On the second tab, "Select tags & upload," add any desired finding and asset tags (optional). When finished, click **Import**.

The status of files imported can be viewed by clicking the icon next to the notification bell at the top of the page.

# CSV Findings Templates PlexTrac understands the importance of simplifying the process of importing findings and other data into the platform, whether for a specific report or multiple reports and assets. To facilitate this, PlexTrac offers CSV templates and scripts that help streamline the import process and make it more efficient. CSV templates serve as pre-defined structures that align with the required format for importing data. These templates specify the fields and corresponding data types expected when importing findings or other information. Users can leverage these templates to ensure that their data is correctly mapped and formatted for import, minimizing errors and ensuring consistency. Two CSV options are available to import findings into a report. Consult the table below to determine the most suitable solution for your needs. | Report Findings CSV Import | Python General CSV Import | | ------------------------------------------------------------- | ---------------------------------------------------------------------------- | | Imports to a single report | Imports to multiple reports | | Request is processed on the backend in less than five minutes | Each finding is processed individually and can take up to several hours\* | | Must order CSV columns to match template schema exactly | CSV columns are mapped to findings on a finding and sequence is not relevant | | Imports to select finding fields only | Imports to all finding and asset fields | | Does not import client and report information | Imports client and report information | \*The script can create parsed findings in PlexTrac by sending API calls to create each finding individually (which results in an extended script runtime) or by generating a PTRAC file. Manually importing the generated PTRAC file takes the same time as the PlexTrac Report Finding CSV Template. {% hint style="info" %} The generated PTRAC only contains the report and finding information. Asset information will not be added. {% endhint %} ### Report Findings CSV Template Please click on the box below to access instructions and a downloadable CSV file that can serve as a template for uploading findings into a report. The CSV file contains fields pre-filled with sample values.

	used in	accepted file types
Report Finding Template	Findings/Reports	CSV		/files/xsjN3r5nYIw43KLZAAtp	/pages/jInAIQyUootzWtUVw0K4

### Python General CSV Template Click on the box below to learn about importing data through the PlexTrac API using a script. The script requires two CSV files: one for importing data and another for field mappings. This script is designed to help users import data into multiple clients and reports. It works by parsing a CSV file and creating client, report, finding, and asset objects. Once the objects are generated, the script uses the PlexTrac API to import and create them in the user's tenant.

	used in	accepted file types
Python General Template	Findings/Reports	CSV		/files/srTIX5Sd3Huq2XLYZTef	https://github.com/PlexTrac-Labs/general-csv-import

# Using Report Findings CSV Template PlexTrac provides a downloadable CSV file that can be used as a template for uploading findings offline and [importing them into PlexTrac](/plextrac-documentation/product-documentation/reports/findings/import-scanner-data) later using the **Add Findings** button within the **Findings** tab of a report.

To download the template, click the file below: {% file src="/files/hZ2cdTDBxNZuYR9LED8v" %} The file has the required fields prepopulated in the CSV file, along with sample values. {% hint style="warning" %} Save the file in CSV UTF-8 format to prevent including non-UTF characters that may break the importer. {% endhint %} ## Importing the CSV File Step 1: Download the CSV file above. Step 2: Remove the sample values and populate the fields with desired values. A [list of the fields with definitions](#csv-mappings) and [instructions on importing custom fields](#undefined) is below. Step 3: [Import the file into PlexTrac](/plextrac-documentation/product-documentation/reports/findings/import-scanner-data). When importing the file via the **Add Findings** button in the **Findings** tab of a report, select the value "CSV" from the pulldown menu.

Step 4: Select the CSV file to upload and click **Continue**.

Step 5: Add any optional tags or leave them blank. Click **Upload**.

A message will appear, validating that the file is uploading.

Step 6: Validate that the information was added to the report. When the data has been imported successfully, the screen will display the information without refreshing the page. {% hint style="info" %} The time required to load depends on the amount of data in the CSV file. {% endhint %}

The source of the finding will list "CSV" as the value. Below is how the data is displayed in the Finding Detail window using the sample values in the CSV template.

## CSV Finding Field Mappings All fields below must appear as column headers when importing the CSV file. All field values must follow the rules defined in the table, or the file may be rejected when imported or require further manual editing within PlexTrac. {% hint style="warning" %} **Title**, **description**, and **severity** are required. {% endhint %}

PlexTrac Field	CSV Header Label	Notes
title	title	This is a required field.
severity	severity	This is a required field. The severity value must be one of the following (not case-sensitive): Informational, Low, Medium, High, Critical If no value is provided in CSV, a value of "Informational" will be assigned.
status	status	Value must be one of the following: Open, Closed, In Process
description	description	This is a required field.
recommendations	recommendations	This is the findings recommendations.
references	references	This field accepts multiple values delimited with a comma. For example: "Item 1, Item 2, Item 3" NOTE: Do not use commas if providing complete sentences, as any comma will result in a para break. Periods do not trigger a para break.
assets	affected_assets	This field accepts multiple values delimited with a comma. For example: "Item 1, Item 2, Item 3"
tags	tags	This field accepts multiple values delimited with a comma. For example: "Item 1, Item 2, Item 3"
riskScore	cvss_temporal	This is the CVSS 3.0 score. Example value: "5.5"
common identifiers	cwe	This field requires a format of CWE prefix + a two-to-four digit number. Example value: "CWE-772"
common identifiers	cve	This field requires a format of CVE prefix + Year + arbitrary digits. Example value: "CVE-2018-54321"
field: category		This column must exist in the CSV and is imported as a custom field.
label	category	The column header must be "category".
value	category value	This is the value entered for the category.

## Custom Fields The CSV import will accept custom fields, which must be added at the spreadsheet's end after the template's columns.

Row A of the CSV template will be the custom field title, and subsequent row(s) will be the custom field value(s), as entered in the spreadsheet. Add multiple columns and values as needed. When imported, the custom fields will appear on the **Finding Detail** page.

The custom fields can be edited or deleted after import via the **Custom Fields** tab of the finding.

# Importing Findings via an Integration Findings may be imported into PlexTrac via a licensed API integration and configured by an admin. ## Importing from an Integration Step 1: Within the **Reports** module, click a report from the list to bring up the **Readout** tab.

Step 2: Click the **Findings** tab.

Step 3: Click **Add Findings** and select **Integrations** from the pulldown menu.

Step 4: Select the desired integration from the pulldown menu (the values shown in the pulldown menu are entered by the admin when the integration is set up).

{% hint style="info" %} If an integration is not licensed or not configured by an admin, the option will not appear in the pulldown menu. {% endhint %} Step 5: Click **Continue with X** at the bottom of the page.

Step 6: The **Select Findings** tab appears with a list of filters and values that are tool-specific to an integration. Use the filters and facets to select the query parameters to determine which findings appear on the page.

Step 7: Click **Search** to retrieve the findings query results.

Step 8: Select the findings from the query results to import by clicking the box at the top left of the table header row or by selecting findings individually by clicking the box next to the finding.
At least one finding must be selected to continue.

Step 9: Click **Continue with X issues**.

Step 10: Insert desired tags associated with each finding and asset when imported (optional). Click **Import X Findings**.

Notifications will appear confirming that the import was successful.

{% hint style="info" %} More information on specific tools, such as field mappings, can be found on the [admin integrations page.](/plextrac-documentation/product-documentation-1/account-management/account-admin/integrations-and-webhooks/integrations-api) {% endhint %} # Importing Findings from WriteupsDB [**WriteupsDB**](/plextrac-documentation/product-documentation/content-library/writeupsdb) is a repository for all PlexTrac writeups. It categorizes, associates them with use cases, and facilitates reuse. By structuring and refining findings, writeups can be used in other deliverables, such as a report. Once a writeup becomes a finding, it is a standalone object that is not impacted if the source writeup or repository is deleted or the same writeup added to another report is edited or deleted. ## Importing from WriteupsDB Step 1: From the Reports module, click the report row or Readout under the "Actions" column.

Step 2: Click the **Findings** tab.

Step 3: Click **Add Findings**, then select **From WriteupsDB** from the pulldown menu.

Step 4: Search or use the provided filters to find the desired writeups to add, then click the box to select them.

Selected writeups to be added are shown in the column on the far right.

Step 5: Click **Add X Writeups** at the bottom of the page.

A confirmation message will briefly appear, and the writeups are added to the report and listed on the **Findings** tab.

# Finding Status Findings are associated with metadata and labels that provide status and current standing. Visual cues using color in the platform also identify specific finding status states. ## Draft or Published State Findings can be in draft or published mode, and this status is provided visually within the **Findings** tab. Findings in draft mode have an orange background row color and a dot next to the title. The published findings have a white background row color with no dot.

{% hint style="info" %} Analyst user roles cannot view draft findings, so publishing the finding before publishing a report allows other user roles within PlexTrac to see critical issues the client needs to address immediately without requiring the report to be completed. {% endhint %} ### Setting to Draft or Published Step 1: Navigate to the desired finding and click **Edit** under the "Actions" column.

Step 2: Update the finding status by clicking the toggle button to the desired state. Changes are autosaved.

### Bulk Editing Draft or Published Step 1: From the **Findings** tab, select one or more findings. An **Actions** button will appear.

Step 2: Click the **Actions** button and click **Set Published Status**.

Step 3: Toggle the publish status and click **Save**.

## Finding Status A finding can either be `Open`, `In Process`, or `Closed`. That status is displayed on the **Findings** tab. {% hint style="info" %} Admins can define and configure which finding statuses are available to users in RBAC under "Report Findings," if more granular control is needed. {% endhint %}

{% hint style="info" %} [Click here for the business rules](/plextrac-documentation/product-documentation/assessments/submitting-an-assessment) on a question in an assessment that is assigned a status as a finding after the assessment is submitted. {% endhint %} Findings may also have a sub-status value. These do not exist unless added by an admin. Once added, they will be available to associate with a finding but are optional.

The Sub Status column is available when viewing findings in a report. It does not exist when viewing findings for a client. ### Updating Finding Status Step 1: From the **Findings** tab, click the status button of the finding to change.

Step 2: Click **Add Update**.

Step 3: The "Add Update" model appears with any previously populated values. Use the pulldown menus to update Status, Sub-Status, and Assigned to values. Enter any optional comments to provide context. Click **Save**.

The changes are reflected in the log notes of the finding status tracker, which can be viewed at any time by clicking the finding status label.

### Bulk Updating Finding Status Step 1: From the **Findings** tab, select one or more findings. An **Actions** button will appear.

Step 2: Click the **Actions** button and click **Assign/Update Status**.

Step 3: The "Add Update" modal appears with any previously entered values. Use the pulldown menus to update Status, Sub-Status, and Assigned to. Enter any optional comments to provide context. Click **Save**.

The changes are added to the selected findings. # Creating Jira Tickets PlexTrac can be integrated with Jira and allow information about findings to be sent to Jira. Visit the [Jira Cloud integrations page](/plextrac-documentation/product-documentation-1/account-management/account-admin/integrations-and-webhooks/integrations-api/jira#setting-up-a-jira-integration) for details on setting up Jira. {% hint style="info" %} The PlexTrac to Jira integration supports field content only. Rich text formatting (e.g., bold, italics, bullet points) is not preserved when syncing data to Jira. {% endhint %} ## Linking a Finding to a Jira ticket Step 1: Navigate to the **Findings** tab of a report.

Step 2: Click the three dots under the "Actions" column of the finding to update.

Step 3: Click **Link Jira Ticket**.

Step 4: Select the Jira project and issue to associate the finding with. Click **Create ticket**.

Step 5: The Jira ticket is now listed under "Linked Ticket."

Clicking the linked ticket value will open Jira. If mapped by the Admin, the finding date reported value will appear in Jira as a value for "Start Date."

If set up for two-way data flow in integration mapping, updating the start date in Jira will update PlexTrac the next time synchronization occurs. ## Creating a Jira Ticket Step 1: Navigate to the **Findings** tab of a report.

Step 2: Click **Status** under the "Actions" column of the finding used to create a Jira ticket.

Step 3: Click **Create Jira Ticket & Link.**

Step 4: Select the Jira project and issue to link with. Click **Create ticket**.

A ticket in Jira is created, and the ticket number is listed under "Linked Ticket" on the **Findings** tab.

## Unlinking a Jira Ticket Step 1: Navigate to the **Findings** tab of a report.

Step 2: Click the three dots under the "Actions" column of the finding linked to a Jira ticket.

Step 3: Click **Unlink Jira ticket.**

Step 3: A modal appears, confirming the action. Click **Ok**.

## Bulk Creating Jira Tickets Step 1: Navigate to the **Findings** tab of a report.

Step 2: Select the desired finding(s) by clicking the check box of the finding row.

Step 3: Hover over the "Actions" button to bring up the pulldown menu and click **Create Jira Tickets**.

Step 4: Select the Jira project and issue type to which the finding(s) should be assigned. Click **Create ticket**.

Step 5: A message will confirm that ticket(s) were created, and the linked ticket number will now be displayed for finding on the page.

Clicking the linked ticket value will take you directly to Jira for viewing. # CVSS Scoring The Common Vulnerability Scoring System (CVSS) is an industry benchmark for evaluating the seriousness of identified vulnerabilities. It calculates a CVSS score by considering three metric categories (base, temporal, and environmental) encompassing various aspects of a vulnerability's impact and ability to persist in different contexts. PlexTrac allows users to input or adjust scores when generating or revising findings, facilitating precise vulnerability assessment. {% hint style="info" %} CVSS is owned by FIRST and used with permission. This calculator is based on [FIRST CVSS documentation](https://www.first.org/cvss/). {% endhint %} ## Entering a Findings Score Step 1: From the **Findings** tab, click **Edit** under the "Actions" column of the finding to modify.

Step 2: On the **Finding Details** tab, select the applicable standard from the **Score type** pulldown menu ([information specifically on CVSS v3.1 and CVSS v4.0 is located further below](#cvss-3.1-calculator)). If not using CVSS, click **General**.

Step 3: Enter values in the provided fields.

The score information for that finding is now displayed on the **Finding Detail** page.

## CVSS v3.1/v4.0 Calculator PlexTrac has a built-in calculator that generates a CVSS score based on selected input values. It also generates a CVSS vector and assigns severity to a finding based on the information selected and calculated score. Users can create a value by clicking through the provided calculator, typing in a vector, or combining both actions. The calculator is available when `CVSS v3.1` or `CVSS v4.0` is selected from the "Score type" field.

{% hint style="info" %} If the value in the **Severity** field is manually changed at any point after a CVSSv3.1 score has been created, a warning message will appear:

{% endhint %} ### Entering a Score Manually If the score is already known, it can be entered in the "Score" field, and the finding's severity will update to match the score.

### Entering a Vector Manually If the CVSS vector is known, entering the value in the "Vectore" field will dynamically set the finding severity.

### Using the Calculator Step 1: In the "Score type" field, select `CVSS v3.1` or `CVSS v4.0`, then click **Calculate Score**.

Step 2: To create a vector, select values by clicking the fields provided. All values must be entered. {% hint style="info" %} The metrics available to configure differ depending on the score type selected. {% endhint %}

After entering a value for all fields, a severity score, severity value, and vector value are populated.

Validation is performed on multiple fields to ensure accurate score and severity using vector string and record, which must be kept in sync. The calculator updates the vector record string when a field is clicked. However, the string is displayed only when all base values are selected. The option to save will appear afterward. When the vector string has changed, the string is then validated. If the string is valid, the record and selected values are updated in the calculator modal. If not, a warning message is displayed, and the save button is disabled. Step 3: For more advanced scoring options, expand "Show temporal and environmental scoring."

Additional fields specific to the score type will be displayed for editing.

Step 5: When finished, scroll to the bottom of the modal and click **Save**. The severity, score, and vector are populated in the appropriate fields on the **Findings Details** tab.

CVSS 3.1 scores can also be viewed on the **Findings** tab of a report or client if that field has been configured to appear in the table.

# Affected Assets Affected assets are managed from the finding, as opposed to the client. Affected assets contain information about an affected asset and relational metadata about the finding it is tied to. An affected asset object on a finding will have a subset of fields compared to the client asset with the same ID. Some additional fields make sense when the finding and client asset are viewed together, such as the date the finding started affecting the client asset, the affected ports, location access to vulnerability, vulnerable parameters, and evidence of the affection. {% hint style="info" %} [Click here](https://docs.plextrac.com/plextrac-documentation/master/plextrac-api-overview/object-structures/asset-object#affected-asset-structure) for more information about the affected asset object structure and all the fields and values it might contain. {% endhint %} ## Viewing Affected Assets Step 1: From the **Reports** module, click the row of the impacted report.

Step 2: Click the **Findings** tab.

Step 3: Click the row of a finding.

Step 4: If an affected asset(s) exist for this finding, they are listed on the Finding Detail modal.

A parent asset can be accessed directly by clicking the provided link within the table. Step 5: Click **View** under the "Actions" column of the affected asset to see more information.

The Asset Detail modal appears with information about the affected asset and a link to any parent, if applicable.

## Configuring Views The table view can be customized by clicking the column view icon to the right of the **Add assets** button.

Once clicked, a modal appears that lists all fields. To remove a column, click **X** within the bar.

{% hint style="info" %} Fields that are required do not have an **X** available. {% endhint %} When fields are removed, an "Add Column" pulldown menu is added at the bottom left of the modal to store the field. Any removed fields can be added later by clicking **Add Column** and selecting the field to add. This modal represents the sequence of fields provided in the table, meaning the bar on top will be the column on the table's far left. The order of columns can be adjusted within this modal by clicking the six dots on the left of the bar for a field and dragging the bar to the desired sequence place.

Click **Save** when finished. ## Creating an Affected Asset Step 1: From the **Reports** module, click the impacted report.

Step 2: Click the **Findings** tab.

Step 3: Click **Edit** of the finding the affected asset is being added to.

Step 4: Click the **Affected Assets** tab.

Step 5: Click the **Add Assets** button and select **Create new asset**.

Step 6: Enter information about the affected asset in the appropriate fields within the **Asset Information** tab.

Step 7: Click the **Affected Areas** tab. Enter information about the following: * **Affected Ports:** Network ports vulnerable to a security exploit or attack. * **Location/URL:** The URL of the affected asset. * **Vulnerable Parameters:** The inputs or settings in a system or program that an attacker can exploit to compromise the security or integrity of the system. These parameters can include usernames, passwords, API keys, and configuration files. * **Notes:** A text box for any additional information to provide context on the affected asset.

Step 8: Click the **Evidence** tab. This tab contains two text fields (title and description) per item but as many items of evidence can be added as needed. Evidence represents when or how the affected asset was found, and often is the scanner output from the scanning process.

Step 9: Click **Save**. The asset is now listed in the **Affected Assets** tab of the finding. ## Editing an Affected Asset Step 1: From the **Affected Assets** tab of a finding, click **Edit** under the "Actions" menu.

Step 2: Edit or add information as desired and click **Save**. ## Deleting an Affected Asset Step 1: From the **Affected Assets** tab of a finding, click **Remove** under the "Actions" menu.

A modal appears, confirming the deletion. Click **Remove**. ## Adding Existing Assets Assets already in PlexTrac can also be added as an affected asset for a finding. Step 1: From the **Affected Assets** tab of a finding, click the **Add Assets** button and select **Add existing assets** from the pulldown menu.

Step 2: Choose the asset(s) from the pulldown menu and click **Save**.

## Importing Affected Assets Assets can be imported using a PlexTrac CSV Asset import template. [Click here](https://docs.plextrac.com/plextrac-documentation/product-documentation/clients/adding-assets-in-clients#importing-an-asset) to download the template and enter asset data to import. Step 1: From the **Affected Assets** tab of a finding, click the **Add Assets** button and select **Import assets** from the pulldown menu.

Step 2: Drag a file into the modal or click the box to navigate to the file on the computer.

Step 3: Click **Import**.

A message will appear confirming import. The asset(s) are now listed in the **Affected Assets** tab. ## Bulk Importing Affected Assets Step 1: From the **Affected Assets** tab of a finding, click the **Add Assets** button and select **Bulk paste** from the pulldown menu.

Step 2: Enter the assets into the box by separating each value with a comma. PlexTrac will parse the assets and add them to the finding. URLs with paths (ex., [www.plextrac.com/test/](http://www.plextrac.com/test/)) will be separated into parent and child assets. Click **Next**.

Step 3: Asset, ports, and child asset values are dynamically assigned. Review and uncheck the box next to any new assets that should not be added. Click **Next**.

{% hint style="info" %} Any subdirectories listed for an asset's domain will be loaded as its asset and considered a 'child' in relation to the 'parent' domain. This relationship will be tracked and maintained within PlexTrac.\ \ For example, **[www.plextrac.com/home](http://www.plextrac.com/home)** will become two assets, with **/home** a child to \*\*[www.plextrac.com.\*\*\\](http://www.plextrac.com.**\\) \ ![](/files/i8qfoGw87yN6ENbHAaNv) {% endhint %} Step 4: Add any desired optional tags. Tags will be assigned to all added assets. Existing assets will retain current tags. Click **Add X assets**.

The new assets are displayed in the **Affected Assets** tab of the findings.

## Bulk Updating Step 1: From the **Affected Assets** tab of a finding, click the box in the header row to the left of "Asset."

Step 2: The "Actions" button appears with the following options: * Add affected location/url * Add affected ports * Delete

Click the desired task from the pulldown menu and continue reading for additional details on each action. ### Add Affected Location/URL A modal will appear with a field to enter a URL. The query parameters will be parsed out into the inputs provided. Click **Add Parameter** to include vulnerable parameters. Click **Save** when finished.

The new value appears on the **Affected Assets** tab under the "Location/URL" column.

### Add Affected Ports A modal will appear with a field to enter any affected ports. Click Add Port to repeat the process as needed. Click Save when done.

The new values will appear under the appropriate columns on the **Affected Assets** tab.

### Delete A modal will appear, asking for confirmation of the action. Click **Delete Assets**.

# Importing a Report PTRAC files (.ptrac) can be imported into PlexTrac for cross-team collaboration. For instance, a red team from one tenant can share with a blue team client with its own PlexTrac instance. Reports can be imported either in the **Client** module or the **Reports** module. The instructions below are specific to the **Reports** module, assuming the user has an exported report in PTRAC format. ## Importing Permissions Admins can configure the options to import files via the **Admin Dashboard** on the "Role Based Access" page. To do so, select a custom role and click the "Ability to import reports" button under Reports Permissions. A dialog box will appear with options to turn on/off the ability to import reports.

## Importing a Report Step 1: From the **Reports** module home page, click **Import Report**.

Step 2: Select the client the report will be associated with from the pulldown menu on the modal.

Step 3: Drag the .ptrac file to the box provided or click the box and navigate to the file on the computer.

Step 4: Click **Submit**.

A progress bar will indicate the status; the upload may take a minute or two.

When completed successfully, a confirmation message will appear.

# Exporting a Report PlexTrac reports can be shared between tenants to enable cross-team collaboration through importing and exporting. For example, an external red team of one tenant may want to export a report and share it with an internal blue team client that manages its PlexTrac instance. ## Export File Formats The following export file options exist for reports: * **Portable Document Format (.pdf)**: While a .pdf file is not easily editable, it offers a reliable way to share and distribute documents while maintaining original formatting and visual integrity. * **Microsoft Word (.doc)**: A .doc file can contain various elements and formatting options, such as font styles, sizes, and colors. It supports rich text formatting, allowing users to customize the appearance of their documents.\ \ Desktop Microsoft Word (Windows/Mac) is the officially supported rendering environment for Word exports. Microsoft 365 Word Online compatibility is provided on a best-effort basis. * **Markdown (.md):** Markdown is a lightweight markup language that allows authoring in plain text that is then converted into formatted content using plain text characters to denote elements like headings, lists, emphasis (bold or italic), links, images, code blocks, etc. * **Comma-separated values (.csv)**: A .csv file is a plain text file format commonly used for storing and exchanging tabular data that allows data to be organized in rows and columns, similar to a spreadsheet. Each line typically represents a row of data, and commas separate the values within the row. Each value corresponds to a specific column, allowing the data to be structured in a tabular format. * **CSV - findings by assets (.csv)**: A CSV file format tailored explicitly for organizing and presenting findings by assets. Each row represents a unique asset, with columns detailing various attributes. This format allows for easy sorting, filtering, and analyzing asset-specific data, making it particularly useful for large-scale asset management and security assessments. * **Extensible Markup Language (.xml):** An .xml file is a plain text file that uses tags to define elements and their hierarchical relationships. * **PlexTrac/JSON (.ptrac)**: A .ptrac file provides more structure and the ability to maintain relational data similar to JSON and XML than a CSV. Images are stored using Base64, a binary-to-text encoding scheme representing binary data as a sequence of ASCII characters. {% hint style="warning" %} Comments made within a report are not exported, and images with a border larger than 6 points may not export correctly. {% endhint %} ## Exporting Permissions Admins can configure the options users see in the platform via the **Admin Dashboard** on the "Role Based Access" page. To accomplish this, select a custom role and click the "Ability to export reports" button under Report Access. A dialog box will appear with options to turn on/off the ability to export reports.

## Exporting a Report Step 1: From the **Reports** module home page, click the row of the report to export. Step 2: Click **Export report**.

Step 3: Select the desired export format from the pulldown menu. {% hint style="info" %} Options available depend on permissions and the [export template](/plextrac-documentation/product-documentation-1/account-management/account-admin/customizations/templates/export-templates) associated with the report. {% endhint %}

Once the option is selected, the file download to the local system begins processing. If an error exists, a message providing more information will appear.

# Priorities The **Priorities** module gives users an advanced view that provides valuable insights into their security efforts. This module is crucial for effectively managing findings and assets. It offers a collaborative platform that empowers team members to work together and address security challenges efficiently. Additionally, users can customize security measures to meet the unique requirements of individual clients or business groups. Users access the module by clicking **Priorities** in the application's main menu.

{% hint style="warning" %} More detailed instructions regarding the impact of tenant-level vs. client-level settings can be found in the [Licensing](/plextrac-documentation/product-documentation-1/account-management/account-admin/licensing/licensing#priorities) section. Information on equations can be found in the [Automations](/plextrac-documentation/product-documentation-1/account-management/account-admin/automations/risk-scoring/managing-priority-equations) section. {% endhint %} ## Overview The Priorities module offers value to teams seeking to streamline and automate reporting processes while providing a layer of risk assessment to existing manual pentests and offensive security data. Key benefits include: 1. **Automated Workflow Efficiency:** Automating workflow processes streamlines reporting cycles, reducing manual efforts and time spent on tasks. 2. **Risk Prioritization:** Enables custom scoring equations to prioritize identified risks, allowing teams to focus on the most critical issues for immediate remediation. 3. **Proactive Risk Management:** This tool enables a proactive approach to managing offensive security data by providing an aggregated view of vulnerabilities, allowing for better risk assessment and remediation planning. 4. **Continuous Risk Reduction:** Through ongoing validation, it demonstrates a continuous risk reduction, ensuring that remediation efforts effectively mitigate future security risks.

## Dashboard Visibility An indicator will be displayed on the **My work** button if a user owns or authors a priority. Clicking the **Your priorities** box will display the priority and role assigned, along with other fields specific to the Priorities module.

The following roles will result in a user having a priority box displayed: * Priority Owner * Priority Author * Treatment Owner ## Notifications Depending on the tenancy configuration and user role assignment, an email may be sent to users for the following event changes: * Priority status * Priority assignment * Finding status * Finding substatus * Assignment # Priorities Components Users can view and access all priorities related to their tenancy on the **Priorities** home page. This view provides options for sorting and filtering on multiple fields.

Clicking the priority row or **View** under a priority's "Actions" column directs users to the priority **Details** summary, including additional tabs for **Findings** and **Assets**. ## Details Tab The **Details** tab provides the priority description, recommendation, treatment, and any assigned tags. The column on the right provides additional information about the priority.

## Findings Tab This tab displays all findings contained in the priority.

### Bulk Actions Bulk action options appear after one or more findings are selected on the home page. To access them, click the checkbox to the far left of the finding title field or the box next to the column header. Click **Actions** to see the list of options, such as adding tags or changing the reported date. ### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. Once clicked, a modal appears that lists all fields. To remove a column, click **X** within the bar. {% hint style="info" %} Fields that are required do not have an **X** available. {% endhint %} When fields are removed, an "Add Column" pulldown menu is added at the bottom left of the modal to store the field. Any removed fields can be added later by clicking **Add Column** and selecting the field to add. This modal represents the sequence of fields provided in the table, meaning the bar on top will be the column on the table's far left. The order of columns can be adjusted within this modal by clicking the six dots on the left of the bar for a field and dragging the bar to the desired sequence place.

Click **Save** when finished. ## Assets Tab This tab displays all assets contained in the priority.

### Bulk Actions Bulk action options appear after one or more findings are selected on the home page. To access them, click the checkbox to the far left of the finding title field or the box next to the column header. Click **Actions** to see the list of options. ### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. ## Additional Configuration Admins do additional setup and configuration in the **Admin Dashboard**. {% hint style="warning" %} It is recommended to read the admin settings documentation before using priorities to understand the impact each setting has on the experience. {% endhint %} ### Tenant Level Settings Priorities can be set at the tenant or client levels and configured under "Priorities" in the **Admin Dashboard**.

### Risk Scoring PlexTrac allows admins to leverage a priority score equation instead of the manual approach of setting a score based on likelihood and impact. Equations can be enabled and customized under the "[Risk Scoring](/plextrac-documentation/product-documentation-1/account-management/account-admin/automations/risk-scoring)" section of the **Admin Dashboard**. ### Viewing the Priority Score The priority score can be viewed under the progress bar on the **Details** tab of a priority.

# Creating a Priority Step 1: From the **Priorities** module home page, click **Create Priority**.

Step 2: Set the scope of the priority, and select what should be prioritized, *Assets* or *Findings.* Click **Add details**. If client-specific priorities are enabled, select a client by scrolling through the list or using the search box to filter.

Step 3: Enter a priority name and additional information into the fields on the page.

* **Priority name (required**): The title of the priority. * **Automatically add new recurring instances to this priority (optional):** Check this box if for every instance of an Asset or Finding, it will be brought into the priority automatically. This is recommended for a project whose scope might change. * **Ignore information instances (optional):** Check this box if the priority excludes instances that do not contain a vulnerability. * **Assignee(s) (optional):** Click the input field to select the assignee(s) for the priority. * **Remediation owners (optional)**: A list of owner(s) who will own the priority remediation. * **Target remediation date (optional)**: Identifies the ideal date on which findings for the priority will be resolved. Place the cursor in the field box to select a date from the calendar. * **Description (optional):** An RTF field to enter a description of the priority. * **Recommendation (optional)**: An RTF field to enter a recommendation for remediating the priority. A recommendation is the ideal advice or guidance to address a particular issue or concern. It suggests a best practice or a course of action to help prevent or mitigate security risks. * **Remediation**: An RTF field to enter a remediation of the priority. * **Tags**: Enter any tags associated with the client (new or existing). Any special characters will be removed, and any spaces will be replaced with an underscore (\_). Step 4: Click **Link assets.** The information entered is presented on the priority details page.

# Linking Findings and Assets After creating a priority, findings and assets can be associated with the **Priorities** module. {% hint style="info" %} Findings and assets can also be linked to a priority from the **Clients** module using bulk actions. {% endhint %} ## Linking Findings Step 1: From the **Priorities** module home page, click the row or **View** under the "Actions" column of the priority to update.

Step 2: Click the **Findings** tab.

Step 3: Click **Link Findings**.

Step 4: Use the filters on the left nav bar to reduce the list.

Step 5: Select the findings to link. Click **Continue with X findings**.

Step 6: Select any affected assets to link. Use the assets filters to narrow the search results. Click **Link affected asset** or **Continue without assets**.

The user is returned to the **Findings** tab page. A notification confirms the action, and the page refreshes with the recently added findings.

Any affected assets added will be displayed on the **Assets** tab. ## Linking Assets Step 1: From the **Priorities** module home page, click the row or **View** under the "Actions" column of the priority to update.

Step 2: Click the **Assets** tab.

Step 3: Click **Link Assets**.

Step 4: Use the filters so that the list only shows assets relevant to the priority.

Step 5: Select the assets to link. Click **Continue with X assets**.

Step 6: Select any associated findings to link. Use the findings filters to narrow the search results. Click **Link x associated findings** or **Continue without findings**.

The user is returned to the **Assets** tab page. A notification will appear confirming the action, and the page will refresh with the recently added assets appearing. ## Unliking Findings and Assets Findings and assets included in a priority can be removed individually or via bulk actions. Any findings or assets removed from a priority will remain in their existing reports and not be deleted from PlexTrac. {% hint style="info" %} Any assets associated with a finding will remain in the priority after the finding is unlinked, and any findings added via its association with an asset will remain after an asset is unlinked. {% endhint %} ### Unlinking a Finding Step 1: Click the **Findings** tab from the priority details page.

Step 2a: Click the meatballs menu of the priority and click **Unlink finding from priority**.

Step 2b: Select multiple findings, click the Actions button, and click **Unlink findings from priority**.

Step 3: A dialog box will appear asking for confirmation. Click **Unlink**.

### Unlinking an Asset Step 1: Click the **Assets** tab from the priority details page.

Step 2a: Click the meatballs menu of the priority and click **Unlink asset from priority**.

Step 2b: Select multiple findings, click the Actions button, and click **Unlink assets from priority**.

Step 3: A dialog box will appear asking for confirmation. Click **Unlink**.

# Managing Priorities ## Updating Progress The progress meter for a priority can be viewed on the **Priorities** home page (if the table is configured to display the field) or on the **Details** tab of a priority. The value shows 0% when the priority is created and progress is updated manually. To edit the progress value, perform the following steps: Step 1: Click **Update progress** from the **Details** tab of a priority.

Step 2: Select the desired value on the scale with the cursor in increments of ten.

Step 3: Click **Update**.

The updated value now appears on the Details tab page. ## Updating the Score The priority score is viewed on the Priorities home page and the **Details** tab of a priority.

It can be updated by clicking **Update Score** under the meatballs menu.

## Updating Status The priority status is viewed on the Priorities home page and the **Details** tab of a priority.

Status can be updated via bulk actions, but to update for one priority, perform the following steps: Step 1: Click the priority status flag on the Priorities home page (or click the priority status flag displayed on the **Details** page).

Step 2: Select the desired status indicator from the pulldown menu.

Step 3: Click **Update status**.

A notification confirms the action. ## Editing Fields Existing priorities can be updated in two ways: Step 1a: From the Priorities home page, click **Edit priority** under the meatballs menu.

Step 1b: From the **Details** tab of a priority, click **Edit priority**.

All fields that were available when the priority was created can now be edited. Step 2: Click **Save** when finished. ## Bulk Actions Bulk action options appear after one or more priorities are selected by clicking the checkbox to the far left of the Priority title field or by clicking the box next to the column header. Click **Actions** to see the list of options. # Priorities Metrics The **Metrics** tab in the Priorities module provides a comprehensive overview and management system for priorities. It aims to give security teams a centralized place to track priority remediation efforts and related findings and assets. Users can filter by various criteria, utilize charts for in-depth analysis, and gain insights into top findings, asset tags, and severity breakdowns. This page is available by clicking **Metrics** from the Priorities home page.

## Overview The page is divided into multiple sections to help users quickly navigate and access the information. The modular layout ensures that each topic is self-contained, allowing users to find relevant details more efficiently.

## Managing Charts The fields in a graph can be removed or added by clicking the field name above the chart. When removed, the field is shown in grey, and the data for that field is removed from the chart. {% hint style="info" %} Although the field is removed for display purposes, it does not change the overall calculation of the metrics. {% endhint %}

Click a field that is greyed out to add it back. When applicable, a box provides a bar or pie chart of priorities by status and score. In the upper right-hand corner, click the option to toggle between the two views.

Some graphics provide more details by hovering over the image with the cursor.

Clicking results (when available) within a graphic launches a side drawer with more information about the prioritized items.

## Filters This section enables filtering of priority metrics displayed to the client by date range, severity, owner, tags, and status. {% hint style="info" %} The URLs within the Metrics tab will contain the filters used and shared with other users. {% endhint %}

## Priorities Health Indicator This section displays key priority metrics.

Click a box to view more detailed information about each metric (all boxes will open a side drawer except the "Percentage of linked findings to priorities" box).

Clicking the priority listed in the side drawer will open the Priority Detail side drawer for further investigation. # Content Library The **Content Library** menu provides access to repositories for narratives, writeups and runbooks. These repositories allow users to create, manage, and reuse content across the platform when generating reports or findings. Users access it by clicking **Content Library** in the application's main menu.

## Overview The Content Library repositories offer numerous advantages: * **Reusability**: Users can create and access reusable items such as writeups and narrative sections. Instead of recreating content from scratch, users can leverage existing content, saving time and effort. * **Standardization and Consistency**: The Content Library promotes standardization and consistency by organizing reusable content within repositories. Users can load and access predefined repositories and templates. * **Efficiency**: Users can quickly locate and retrieve relevant content, streamlining the report creation process and improving overall efficiency. * **Collaboration**: The Content Library is designed to promote collaboration and knowledge sharing. It allows users to designate repositories for multiple individuals to access and contribute. * **Scalability**: As the Content Library accumulates reusable items, it becomes a valuable resource that grows with the organization's needs. New users can leverage existing content, maintaining consistency even as the user base expands. * **Customization**: Users can create repositories, set permissions for viewing and editing, organize content within repositories, establish templates, customize layout, add tags or metadata, and integrate with external tools. # Types of Repositories In the Content Library, three types of repositories exist: 1. **Open Repository**: Open repositories are available to anyone with repository access. Users with permission can *view* and *edit* the content within this repository. Open repositories are created for easy access and collaboration, allowing users to contribute and modify content freely. They serve as a shared space. 2. **Managed Repository**: Managed repositories are accessible to anyone with repository access, allowing them to *view* the repository content. Editors must be added manually. Managed repositories are suitable for creating shared spaces where multiple users can access and utilize the content but have limited editing capabilities. 3. **Private Repository**: Private repositories are the most restricted. Only added users with specific permissions can view and edit the content within private repositories. Private repositories are ideal for in-process documents or content that should only be accessible to select individuals.

Users' level of access and editing permissions should be considered when selecting a repository type. Managed repositories allow for broader access with limited editing capabilities, private repositories restrict access to authorized individuals, and open repositories provide an open and collaborative environment for content sharing and editing.

## Open Repository **Definition**: A “Dropbox” to which any user with feature-level access may contribute content. **Default behavior**: None **Recommended Use**: To enable all users to contribute without restriction. ## Managed Repository **Definition**: Users can view, but only those added to a given repository as an editor and have an RBAC of `MANAGE_{content}_REPOSITORIES` under Content Library permissions may add or edit content. **Default behavior**: View-only access unless an editor is added to enable modification of content or the user has appropriate RBAC permissions. **Recommended Use**: To restrict edit access to qualified individuals (copy editors) within a defined set of narrative sections. This is ideal for teams working on various projects who want to maintain their versions of narrative sections and small to mid-size teams that don’t need to restrict access to use but want to limit curation to leadership. ## Private Repository **Definition**: A repository to store narrative sections is unavailable unless a user is explicitly given read and edit permissions. **Default behavior**: Users may view only (Viewer) or edit (Editor). **Recommended Use**: This is a place to copy manually created sections that may contain client-specific data that needs to be sanitized, a place to work on drafts for new narrative sections not ready for general use, or a place to store final narrative sections not available for general use. # NarrativesDB **NarrativesDB** is a repository that houses all of PlexTrac's narrative sections. Its primary purpose is facilitating categorization, association with defined use cases, and reusability. Users access by clicking **Content Library** in the application's main menu and then clicking **NarrativesDB**.

## Overview Reports use narratives to provide context, clarify complex information, and improve comprehension. These narratives also serve as persuasive tools, influencing opinions and motivating action through storytelling. By placing data and facts into real-life contexts, narratives help audiences understand the relevance of information, making them versatile and impactful tools. As a result, narratives are valuable assets in reports and promote effective communication. NarrativesDB enables users to create and manage this messaging, freeing up time for problem-solving. For example, instead of initiating each report from scratch and composing a unique narrative every time, organizations have the flexibility to create simple sections that serve as a starting point. These sections can be reused or further enhanced to align with the specific needs of each report, providing a time-saving and efficient solution for report generation.
# NarrativesDB Home Page The NarrativesDB home page consists of two tabs: * **Repositories**: A centralized location where all sections can be stored and managed. * **Sections**: A dedicated space to create reusable content for narrative sections within a report.

## Repositories Tab PlexTrac provides a sample narratives repository containing six sample narrative sections to demonstrate how content reuse might exist. The sample repository is an [Open repository](/plextrac-documentation/product-documentation/content-library/types-of-repositories#types-of-repositories) that cannot be deleted but can be modified. ## Sections Tab Sections are containers that contain a title, body, and tags. They are reusable in reports and are stored in this tab.

### Configuring Views The table view can be customized by clicking the column view icon to the right of the search bar. Once clicked, a modal appears that lists all fields. To remove a column, click **X** within the bar.

Click **Save** when finished. # Managing Repositories ## Changing Settings Admins can modify the repository name, prefix, description and access setting. Step 1: From the **Repositories** tab of the **NarrativesDB** home page, click the card of the repository to modify.

Step 2: Click **Repository Settings**.

Step 3: Click **Update**.

## Copying a Repository Step 1: From the **Repositories** tab of the **NarrativesDB** module, click the three dots in a repository card and click **Copy Repository**.

Step 2: Update the repository name, add a section ID, and validate access permissions. Click **Copy**.

The new repository is created and listed on the **Repositories** tab.

## Deleting a Repository {% hint style="danger" %} This action will permanently delete the repository and all its sections for all users. {% endhint %} Admins can delete a repository in two ways: Click the three dots in a repository card from the **NarrativesDB** home page, then click **Delete Retory**.

or Go to the repository settings and click **Delete Repository**.

## Configuring Views The table view can be customized by clicking the column view icon to the right of the search bar.

Once clicked, a modal appears that lists all fields. To remove a column, click **X** within the bar.

Click **Save** when finished. # Managing Users If the repository is not an "Open" type repository, admins have the option of managing users by clicking **Users & Permissions**. ## Adding Users Step 1: From the **Repositories** tab of the **NarrativesDB** home page, click the card of the repository to modify.

Step 2: Click **Users & Permissions**.

Step 3: Click **Add User**.

Step 4: Type in the user from the pulldown menu and select the permission. Repeat as necessary. Click **Add X Users**.

Step 5: Edit the permission or delete a user, if needed. Click **Done**.

## Deleting Users Step 1: From the **Repositories** tab of the **NarrativesDB** home page, click the card of the repository to modify.

Step 2: Click **Users & Permissions**.

Step 3: Identify the user to remove and click the **X** in that row.

Step 4: Click **Done**. # Creating a Repository Step 1: From the **Repositories** tab of the **NarrativesDB** module, click **New Repository**.

Step 2: Enter information in the fields (a red asterisk marks required fields), select the desired security access for the repository, and click **Create**. {% hint style="info" %} The Section ID Prefix value informs the future relationship of all sections created within the repository to a specific repository. Once assigned to a particular repository with the prefix, sections will automatically increment as they are added. {% endhint %}

The new repository is now listed on the **Repositories** tab.

# Managing Sections NarrativesDB comes with six sections that are part of the sample repository. These sections can be modified, copied to another repository, or deleted. {% hint style="info" %} Narrative sections can be created/edited but not copied from an external source. They can be added *to* a report from NarrativesDB but not *from* a report to NarrativesDB. {% endhint %} ## Editing a Section Step 1: From the **Repositories** tab of the **NarrativesDB** module, click **Sections**.

Step 2: Navigate to the desired section to update and click **Edit**.

Step 3: Make desired edits to the section. Click **Close** when finished.

{% hint style="info" %} All changes are saved dynamically. {% endhint %} ## Copying a Section Step 1: From the **Repositories** tab of the **NarrativesDB** module, click **Sections**.

Step 2: Navigate to the desired section to update and click **Copy To**.

Step 3: Select the repository to copy the section from the pulldown menu.

Step 4: Click **Copy**.

A notification confirms the action was successful, and the copied section now appears in the new repository. ## Deleting a Section {% hint style="warning" %} Completing this task permanently deletes the section and cannot be undone. {% endhint %} Step 1: From the **Repositories** tab of the **NarrativesDB** module, click **Sections**.

Step 2: Click the three dots under the "Actions" column, then click **Delete**.

Step 3: A modal will appear, confirming the action. Click **Delete Section**.

## Bulk Actions When editing multiple sections, PlexTrac offers bulk action capabilities. Bulk actions provide several advantages, including time-saving and increased efficiency by processing numerous items simultaneously. Bulk action options appear after selecting one or more sections by clicking the checkbox or the box next to the column header.

Click **Actions** to see the list of options available. ## Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar.

Once clicked, a modal appears that lists all fields. To remove a column, click **X** within the bar. Fields that are required do not have an **X** available. When fields are removed, an "Add Column" pulldown menu is added at the bottom left of the modal to store the field. Any removed fields can be added later by clicking **Add Column** and selecting the field to add. This modal also represents the sequence of fields provided in the table, meaning the bar on top will be the column on the table's far left. The order of columns can be adjusted within this modal by clicking the six dots on the left of the bar for a field and dragging the bar to the desired sequence place.

Click **Save** when finished. # Creating a Section ## Creating a Section Step 1: From the **Repositories** tab of the **NarrativesDB** module, click **Sections**.

Step 2: Click **New Section**.

Step 3: Enter desired information (required fields are marked with a red asterisk).

Step 4: Click **Close**. ## # WriteupsDB **WriteupsDB** is a central repository for all the writeups available in PlexTrac. Its purpose is to categorize them, associate them with specific use cases, and facilitate reuse. By structuring and refining the findings, writeups can be seamlessly incorporated into other deliverables, such as a report. Users access by clicking **Content Library** in the application's main menu and then clicking **WriteupsDB**.

## Overview WriteupsDB serves as a valuable tool for tracking and organizing vulnerability information. Benefits of WriteupsDB include: * **Enhanced Organization and Access:** WriteupsDB provides a centralized database where items can be added or imported, making it effortless to organize and access information related to vulnerabilities. This centralized approach improves efficiency and streamlines tracking and documenting vulnerabilities. * **Improved Permissions and Segregation**: With the introduction of repositories, PlexTrac offers improved permissions and segregation capabilities. Instead of managing writeups as a list, users can create repositories to categorize and segregate writeups based on different contexts, such as incident response or vulnerability management. This feature ensures that the right users have the appropriate level of access in their specific domains and can work without interference from unrelated teams. * **Standardization and Collaboration:** WriteupsDB enables the standardization of vulnerability documentation by encouraging and reusing templates. This ensures consistency in the format and language, making it easier for stakeholders to understand and analyze vulnerabilities. The platform also supports collaboration, allowing multiple users to work on writeups simultaneously and facilitating peer reviews for improved quality and accuracy. # WriteupsDB Home Page The **WriteUpsDB** module has two tabs: * **Repositories**: Displays all writeup repositories that exist in a tenancy. A repository can be [Open, Managed, or Private](/plextrac-documentation/product-documentation/content-library/types-of-repositories). * **Writeups**: Displays all writeups in various repositories, including those created manually and imported. ## Repositories Tab PlexTrac provides a default repository container for any existing writeups. This repository can be renamed, modified, and deleted.

Once added, any extra repositories will be displayed on the page alphabetically according to their title.

Each repository card provides the following information:

1. **Repository Title** 2. **Repository Type**: Open, Managed, or Private 3. **Meatballs Menu**: options to copy or delete the repository 4. **Repository Description** 5. **Number of contained writeups** 6. **Number of added users** ## Writeups Tab Click the **Writeups** tab to view all writeups for a tenancy. This view will display helpful information such as the writeup ID, parent repository, writeup severity, source, assigned tags, and the ability to edit, copy, or delete any selected writeup.

### Bulk Actions When editing multiple reports, PlexTrac offers bulk action capabilities. Bulk actions provide several advantages, including time-saving and increased efficiency by processing numerous items simultaneously. Bulk action options appear after one or more writeups are selected by clicking the checkbox to the far left of the Title field or by clicking the box next to the column header.

Click **Actions** to see the list of options.

### Configuring Views The table view can be customized by clicking the column view icon to the right of the search bar.

Once clicked, a modal appears that lists all fields. To remove a column, click **X** within the bar.

Click **Save** when finished. # Managing Repositories A repository is a versatile tool for managing writeups. It organizes content into structured categories, allowing for efficient reuse across reports. Repositories grant varying access permissions, enhancing collaboration and control. ## Changing Settings Step 1: From the **WriteupsDB** module home page, click the repository to update.

Step 2: Click **Repository Settings.** {% hint style="info" %} If the repository is not an "Open" type repository, admins will also see a [**Users & Permissions**](/plextrac-documentation/product-documentation/content-library/writeupsdb/managing-users) link next to the settings option. {% endhint %}

All fields that existed when creating the repository are available for editing, with an additional button to delete the repository.

Step 3: Click **Submit** when finished. ## Copying a Repository Step 1: From the **Repositories** tab of the **WriteupsDB** module, click the meatballs menu found on the repository card to copy.

Step 2: Click **Copy Repository**.

Step 3: Change the repository name, add a section ID, update the description as needed, and validate access permissions. Click **Save**.

The new repository has been created and is listed on the **Repositories** tab. ## Deleting a Repository {% hint style="danger" %} This action will delete the repository and all its writeups for all users. {% endhint %} A repository can be deleted in two ways: 1. Click the meatballs menu on the repository card from the **Repositories** tab of the WriteupsDB module. Then, click the meatballs menu again in the repository card and click **Delete Repository**.\ ![](/files/hCzT5sya2YSpDkC2fNnF) 2. Click the meatballs menu on the repository card from the **Repositories** tab of the WriteupsDB module. Select **Repository Settings**, then scroll to the bottom and click **Delete Repository**.\ ![](/files/GLB1vKg9s49Lfw9SDMlq) A warning message will appear asking for validation. Click **Delete** to continue.

# Managing Users If the repository is not an "Open" type repository, admins can manage users by clicking Users & Permissions. ## Adding Users Step 1: From the **Repositories** tab of the **WriteupsDB** home page, click the card of the repository to modify.

Step 2: Click **Users & Permissions**.

Step 3: Click **Add User**.

Step 4: Type in the user from the pulldown menu and select the permission. Repeat as necessary. Click **Add X Users**.

Step 5: Edit the permission or delete a user, if needed. Click **Done**.

## Modifying Users Step 1: Select the desired repository card from the **WriteupsDB** home page and click **Users & Permissions**.

Step 2: Select the user to modify and change permissions from the pulldown menu.

Step 3: When finished, click **Done**. ## Deleting Users Step 1: Select the desired repository card from the **WriteupsDB** home page and click **Users & Permissions**.

Step 2: Select the user to remove and click the **X** in that row.

Step 3: When finished, click **Done**. # Creating a Repository Step 1: From the **WriteupsDB** module home page, click **New Repository**.

Step 2: Fill out the provided fields.

1. **Repository Name**: Describes the repository and is displayed on the repository card from the **Repositories** tab. 2. **Writeup ID Prefix**: A three-character value that is unique to this repository. The Section ID Prefix value informs the future relationship of all sections created within the repository to a specific repository. Once assigned to a particular repository with the prefix, sections will automatically increment as they are added. An error message will display if the prefix already exists after clicking the **Create** button.
3. **Description**: Describes the repository in 350 characters or less. The number of characters remaining in the description is presented at the bottom right of the box.
4. **Repository Access**: Defines what [users and roles can access](/plextrac-documentation/product-documentation/content-library/types-of-repositories) the writeups in this repository. Step 3: Click **Create**.

A notification confirms the action and the repository will appear as a card on the **Repositories** tab. # Creating a Writeup The process of creating a writeup is similar to that of creating a finding. Step 1: From the **WriteupsDB** home page, click the **Writeups** tab.

Step 2: Click **New Writeup**.

Step 3: A modal will appear with the option to start from default finding fields or use a custom findings layout. Choose an option and click **Next**.

Step 4: Enter the writeup name and select the repository and severity. Click **Create**.

Step 5: Enter the information in the provided fields on the "Create New Writeup" page. Required fields are denoted with a red asterisk. {% hint style="info" %} Visit the [Creating a Finding page](/plextrac-documentation/product-documentation/reports/findings/creating-a-finding) for documentation on the fields referenced below. {% endhint %}

New sections for the writeup can be added by clicking **Add new custom field** at the bottom of the page. There is no limit to the number of new sections that can be added. Any section can be deleted by clicking the **Remove** button. Step 6: Click **Close** at the top of the page. All changes are autosaved. # Copying a Writeup Writeups can be copied within the **WriteupsDB** module or from a finding within a report. ## Copying a Writeup Within a Report Step 1: Within a report, click the **Findings** tab.

Step 2: Find the finding to copy. Click the meatballs menu (three dots) under "Actions" and click **Copy to WriteupsDB**.

Step 3: Select the repository from the pulldown menu and click **Copy.**

{% hint style="warning" %} Finding details unique to this report will also be copied; remove any sensitive information. {% endhint %} ## Copying within WriteupsDB Step 1: From the **WriteupsDB** module, go to the writeup to copy and click **Copy To** under the "Actions" column.

Step 2: Select the destination repository from the pulldown menu and click **Copy**.

# Adding to a Report Step 1: From a report, click the **Findings** tab.

Step 2: Click **Add Findings** and select "From WriteupsDB" from the pulldown menu.

Step 3: Search for or use the provided pulldown filters to display the desired writeups(s) to add.

Step 4: Click the box next to the writeup(s) to add. Selected writeups will appear in the "TO BE ADDED TO REPORT" column on the right. Click **Add X Writeups**. {% hint style="info" %} Click the box next to "Writeups" in the table header to add all available writeups. {% endhint %}

The selected writeups now appear on the **Findings** tab of the report. {% hint style="info" %} Once a writeup becomes a finding, it is a standalone object that is not impacted if the source writeup or repository is deleted or the same writeup added to another report is edited or deleted. {% endhint %} # Importing via CSV Template PlexTrac provides a downloadable CSV file that can be used as a template for entering writeups offline and importing them into **WriteupsDB**. ## Downloading the CSV Template Step 1: From the **WriteupsDB** module, click the **Writeups** tab.

Step 2: Click **Import Writeups**.

Step 3: Click **Download CSV template file**.

The file will be downloaded locally for editing. {% hint style="warning" %} Save the CSV template in UTF-8 format to prevent including non-UTF characters that may break the importer. {% endhint %} ## Writeups CSV Field Mappings When importing the CSV file, all fields below must appear as column headers and follow the rules defined in the table. Otherwise, the file may be rejected when imported or require further manual editing within PlexTrac. {% hint style="warning" %} **Title**, **description**, and **severity** are required. {% endhint %}

PlexTrac Field	CSV Header Label	Notes
title	title	This is a required field.
severity	severity	This is a required field. The severity value must be one of the following (not case-sensitive): "Informational, Low, Medium, High, Critical" If no value is provided in CSV, a value of "Informational" will be assigned.
description	description	This is a required field.
recommendations	recommendations	These are the writeup recommendations.
references	references	This field accepts multiple values delimited with a comma. For example: "Item 1, Item 2, Item 3" NOTE: Do not use commas if providing complete sentences, as any comma will result in a para break. Periods do not trigger a para break.
tags	tags	This field accepts multiple values delimited with a comma. For example: "Item 1, Item 2, Item 3"
	custom field	The headers will be converted to keys and labels in the writeup after import. As many custom fields can be used as desired. For example, "custom field 1," "custom field 2," etc.
	score::cvss3	The value before the double colon is the score; the value after is the vector string (calculation), if provided. For example: "9.8::CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
	score::cvss	For example: "9.5"
	score::YourLabel	Replace "YourLabel" with the Label of a custom scoring system. The value before the double colon is the score; the value after is the vector string (calculation), if provided. For example: "1000::a+b+c+d"
	cves	Separate values with a column. For example: "CVE-1999-0001, CVE-2000-0001"
	cwes	Separate values with a column. For example: "CWE-787, CWE-79, CWE-89"
	score::cvss3.1	The value before the double colon is the score; the value after is the vector string (calculation), if provided. For example: "3.7::AV:A/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:L"
	score::cvss4	The value before the double colon is the score; the value after is the vector string (calculation), if provided. For example: "5.7::AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:H/SC:H/SI:L/SA:N"

## Importing the CSV Template Step 1: From the **WriteupsDB** module, click the **Writeups** tab.

Step 2: Click **Import Writeups**.

Step 3: Drag the file into the designated box or navigate to the file on the computer.

Step 4: Click **Upload**.

When completed, the imported writeups will be displayed within the selected repository. # RunbooksDB **RunbooksDB** enables collaborative testing for threat emulation and simulation, known as Purple Teaming. Organizations can create reusable test plans that encompass a set of procedures. Users access by clicking **Content Library** in the application's main menu and then clicking **RunbooksDB**.

## Overview Runbooks comprise a particular methodology, a series of tactics, techniques, and procedures collectively known as TTPs. Runbooks are executed and turned into an engagement tied to a specific client. Once the engagement is finished and submitted, it becomes a report. RunbooksDB offers several benefits: * **Standardization**: Runbooks provide standardized procedures and workflows for various tasks and processes. This consistency helps ensure that critical steps are not missed during an operation. * **Efficiency**: By having predefined procedures and automation scripts within runbooks, teams can respond to incidents and complete tasks more efficiently, which reduces the time and effort required for routine operations. * **Consistency:** Runbooks help maintain consistency in task performance. This is crucial in cybersecurity and incident response, as consistent procedures are necessary to identify and mitigate threats effectively. * **Training and Onboarding**: Runbooks are valuable training materials for new team members. They can use runbooks to learn how to perform various tasks and understand best practices, ensuring a smooth onboarding process. # RunbooksDB Home Page The **RunbooksDB** home page consists of five tabs: * **Repositories:** A set of processes that can be reused and have controlled access. * **Procedures:** A set of steps required to execute a tactic. For example, a procedure for browser extension-based persistence could describe how a malicious extension is injected to maintain persistence. * **Techniques:** A grouping of procedures. Techniques are added to a tactic for use in an engagement. For example, if a tactic is persistence, a technique could exist for browser extensions. * **Tactics:** A grouping of techniques. Tactics are added to a methodology for use in a runbook. This usually represents a type of attack, such as persistence or a privilege escalation from the [MITRE ATT\&CK](https://attack.mitre.org/) framework. This can also be a logical grouping or structure for techniques. * **Methodologies:** A grouping of tactics that are put into a runbook. It contains a title, ID, description, and the selected series of tactics. Tactics can be chosen to apply to the methodology when used as a runbook. This is similar to how the MITRE ATT\&CK is broken down, where the methodology represents the framework for TTPs**.**

## Repositories Tab PlexTrac provides a container for all instances called "PlexTrac Curated" that contains community-produced procedures on MITRE/CTI.

This repository contains over 1,500 MITRE procedures from the ATT\&CK matrix that can be leveraged. It is available to all users and cannot be deleted.

Once a test plan is imported, another default repository is created. This repository contains all procedures included in the imported test plans.

{% hint style="info" %} The default repositories cannot be deleted. {% endhint %} Once added, any additional repositories will be displayed on the page alphabetically according to their title. Each repository card offers an overview of its contents and settings. It includes the Repository Title, which helps identify the repository, and the Repository Type, which can be categorized as Open, Managed, or Private. The meatballs menu provides convenient options for copying or deleting the repository. Additionally, a Repository Description is available for further context. The card also displays the number of procedures contained, giving insight into the repository's complexity and the number of added users. This indicates the level of collaboration or access granted to others. ## Procedures Tab To view all procedures, click the **Procedures** tab. This view will display helpful information such as the procedure ID, repository ID, methodology, repository, source, assigned tags, and the ability to edit or delete a procedure.

### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. ## Techniques Tab Click the **Techniques** tab to view all techniques. This view will display the title, ID, leveraged tactics, and the ability to edit or delete them.

### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. ## Tactics Tab To view all tactics, click the **Tactics** tab. This view will display the title, ID, leveraged methodology, and the ability to edit or delete.

### Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. ## Methodologies Tab Click on the **Methodologies** tab to see all methodologies and find the title, ID, and options to edit or delete them.

# Managing Repositories ## Changing Settings Admins can modify the repository name, prefix, description, and access settings. Step 1: From the **Repositories** tab of the **RunbooksDB** home page, click the card of the repository to modify.

Step 2: Click **Repository Settings**.

Step 3: Make the desired changes, then click **Save**.

## Deleting a Repository {% hint style="danger" %} This action will permanently delete the repository and all its sections for all users. {% endhint %} From the RunbooksDB home page's **Repositories** tab, click the three dots in the repository card and then click **Delete Repository**.

A warning message appears asking for validation. Click **Delete Repository**.

# Managing Users If the repository is not an "Open" type repository, admins can manage users by clicking **Users & Permissions**. ## Adding Users Step 1: From the **Repositories** tab of the **RunbooksDB** home page, click the card of the repository to modify.

Step 2: Click **Users & Permissions**.

Step 3: Click **Add User**.

Step 4: Type in the user from the pulldown menu and select the permission. Repeat as necessary. Click **Add X Users**.

Step 5: Edit the permission or delete a user, if needed. Click **Done**.

## Modifying Users Step 1: From the **RunbooksDB** home page, click the desired repository card and click **Users & Permissions**.

Step 2: Select the user to modify and change permissions from the pulldown menu.

Step 3: When finished, click **Done**. ## Deleting Users Step 1: From the **RunbooksDB** home page, click the desired repository card and click **Users & Permissions**.

Step 2: Select the user to remove and click the **X** in that row.

Step 3: When finished, click **Done**. # Creating a Repository Step 1: From the **Repositories** tab of the **RunbooksDB** module, click **New Repository**.

Step 2: Enter information in the fields and select the desired security access for the repository.

1. **Repository Name**: Describes the repository and is displayed on the repository card from the **Repositories** tab. 2. **Writeup ID Prefix**: A three-character value that is unique to this repository. An error message will display if the prefix already exists after clicking the **Create** button in Step 3.\ ![](/files/Jdanl1W5qya6RHm90LFQ) 3. **Description**: Describes the repository. 4. **Repository Access**: Defines what [users and roles can access](/plextrac-documentation/product-documentation/content-library/types-of-repositories) the writeups in this repository. Step 3: Click **Create**.

The new repository now has a card on the **Repositories** tab.

# Creating a Procedure A procedure is a predefined set of steps and actions that must be followed to accomplish a specific security-related task or address a particular issue. Procedures are often documented and provide a systematic approach to incident response, patch management, access control, and vulnerability assessment. They help ensure that tasks are executed consistently and comply with security policies. Step 1: Click the **Procedures** tab of the **RunbooksDB** module. Step 2: Click **New Procedure**.

Step 3: Fill out the provided fields.

1. **Procedure Title (required):** The procedure title should include MITRE technique numbers when applicable (e.g., T1027), with an additional local indicator to distinguish it from the official MITRE technique, such as "Obfuscated Files or Information AE-T1027." 2. **Procedure ID (required):** The procedure ID should combine the MITRE technique number (e.g., T1027) with an organization-specific identifier and a sequential number, such as "AE-T1027-001" or "T1027-AE-001". This maintains consistency, links to MITRE techniques, and supports standardization within an organization. 3. **RunbooksDB Repository (required)**: Every procedure must be associated with a **RunbooksDB** repository and only repositories that the user can edit appear in the pulldown menu. 4. **Techniques**: Click **Add Techniques** to add existing techniques in **RunbooksDB** to the procedure. They will then appear on the "New Procedure" page.\ ![](/files/V1CMNgUo79Q4Jp3G15DH) 5. **Procedure Description (required):** A rich-text field to enter any content, images, or tables needed to describe the procedure. A procedure description should be detailed and actionable, including clear objectives, step-by-step instructions, and mapping to relevant MITRE ATT\&CK techniques. It should be based on real-world adversary behaviors and include technical details, expected outcomes, and potential variations. Additionally, it should provide safety precautions and guidance on detection and mitigation strategies. 6. **Tags:** Enter any tags to help future search and filtering tasks. 7. **Execution Steps (required)**: A set of steps to achieve specific security-related goals and address potential threats or vulnerabilities. A procedure must have at least one step. 8. **Add Step Success Criteria**: Click this to access a rich-text field to provide the success criteria of the previously entered step. A good step success criteria should include measurable outcomes that align with the exercise's objectives. These criteria should be based on observable indicators that reflect real-world adversary behaviors. For example, success might be defined as achieving unauthorized access within a certain timeframe using specific tactics. 9. **Add Another Execution Step**: Click this button to add additional steps. Step 4: Click **Save** at the top of the page. The procedure is now available from the **Procedures** tab and can be viewed, edited, or deleted from this location. # Creating a Technique Cyber attackers or threat actors use specific methods, tactics, and procedures known as techniques to compromise computer systems, gain unauthorized access, or achieve their malicious objectives. These techniques exploit vulnerabilities and weaknesses in computer systems and networks by adversaries. Step 1: Click the **Techniques** tab of the **RunbooksDB** module. Step 2: Click **New Technique**.

Step 3: Fill out the provided fields.

1. **Technique Title (required)** 2. **Technique ID (required)** 3. **Procedures**: Click **Add Procedures** to bring up a new modal to add procedures to the technique. 4. **Tactic**: Click **Add Tactics** to bring up a new modal to add tactics to the technique. 5. **Technique Description:** A rich-text field to enter any content, images, or tables to describe the technique. 6. **Tags:** Enter any tags to help future search and filtering tasks. Step 4: Click **Save**. The technique is now available from the **Techniques** tab, which can be viewed, edited, or deleted. # Creating a Tactic Tactics are higher-level categories or strategies used by adversaries to achieve their goals. In the MITRE ATT\&CK framework, tactics are broader than techniques and represent the overall objectives of an attack. For example, tactics might include "Execution," "Persistence," "Privilege Escalation," and "Defense Evasion." Tactics encompass a range of techniques that support a specific objective. Step 1: Click the **Tactics** tab of the **RunbooksDB** module. Step 2: Click **New Tactic**.

Step 3: Fill out the provided fields.

1. **Tactic Title (required)** 2. **Tactic ID (required)** 3. **Techniques**: Click **Add Techniques** to bring up a new modal to add techniques to the tactic. 4. **Methodologies**: Click **Add Methodologies** to bring up a new modal to add methodologies to the tactic. 5. **Tactic Description:** A rich-text field to enter any content, images, or tables to describe the tactic. 6. **Tags:** Enter any tags to help future search and filtering tasks. Step 4: Click **Save**. The tactic is now available from the **Tactics** tab, which can be viewed, edited, or deleted. # Creating a Methodology A methodology is a structured approach or framework to guide a comprehensive and systematic process. In cybersecurity, a methodology is often a documented set of guidelines and procedures for performing tasks such as penetration testing, risk assessment, security assessments, or incident response. Methodologies provide a structured way to conduct activities and ensure consistency in approach. Step 1: Click the **Methodologies** tab of the **RunbooksDB** module. Step 2: Click **New Methodology**.

Step 3: Enter a methodology title and ID (both fields are required).

Step 4: Click **Add Tactics**. A modal will appear with available tactics to add to the methodology. Click **Select** next to the tactics to add, and the selected tactics will appear in the right column.

Step 5: When finished, click **Add X Tactics**.

Enter a methodology description and any desired tags.

Step 6: Click **Save** at the top of the page. The methodology is now available from the **Methodologies** tab and can be viewed, edited, or deleted from this location. # Analytics The **Analytics** module provides one central location to obtain valuable metrics and view findings, assets, runbooks, and SLA trends. This module consists of four sections: **Findings**, **Assets**, and **Trends & SLAs**. {% hint style="info" %} Users with data from the legacy Runbooks V1 solution will see a fourth tab for [Runbooks](/plextrac-documentation/product-documentation/analytics/runbooks). {% endhint %}

{% hint style="info" %} Analytics filter values and data sets are updated every minute. If a tag or field was updated but does not appear as expected, wait one minute and try again. {% endhint %} ## Overview The **Analytics** module defaults to the **Findings** tab. Only data for findings from *published* reports (a status of "Published") that the user has permission to view are displayed.

Data can be refined using one or more filters in the right column. When filters are selected, the data displayed refreshes, and the active filters are listed at the top of the page. The number of active filters is displayed next to "Active Filters." Click **Clear All** to reset filters.

Filter options are specific to the type of data being queried, and the facets and values available dynamically change when navigating through the **Findings**, **Assets**, and **Trends & SLAs** tabs. ## Search Filter Presets A search filter set is a collection of grouped search filters to provide more comprehensive results. Practical search filter sets can improve the user experience by reducing the time and effort required to find relevant search results and increasing the likelihood of a successful search. {% hint style="info" %} Preset filters are available for all tabs in the **Analytics** module. {% endhint %} ### Creating a Filter Preset Step 1: Select the filters that will make up the preset. Step 2: Click **Create Preset** at the top of the filter column.

Step 3: Enter a value for "Filter Name." This value will be used to select the query later, so it should be intuitive. {% hint style="info" %} To make this preset the default filter, check the box next to "Make Default Filter." {% endhint %}

Step 4: Click **Create Filter**. The filter preset now appears in the pulldown menu as an available option. ### Updating a Filter Preset This process can be used to rename an existing filter preset, adjust the filter parameters, or use it as a clone to create a new filter preset. Step 1: Select the filter preset to delete from the pulldown menu.

Step 2: Adjust the filter parameters. Step 3: Click **Update Selected Filer**.

Step 4: A modal appears. Rename the filter to keep the original filter unchanged, or click **Update**. ### Deleting a Filter Preset Step 1: Select the filter preset to delete from the pulldown menu.

Step 2: Click **Delete Selected Filter**.

Step 3: A modal appears confirming action. Click **Delete Filter**. # Findings The **Findings** tab has two containers of information that can be expanded or collapsed: * **Findings**: an overall view of all findings that the user has access to view and have been published * **Findings by client**: a view of findings filtered by the client {% hint style="info" %} Only published findings from reports with a "Published" status are included in the analytics module. In the **Admin Dashboard**, administrators can [default findings to "Published"](https://docs.plextrac.com/plextrac-documentation/product-documentation-1/account-management/account-admin/tenant-settings/general-settings#findings-default-published) upon creation. {% endhint %}

When filters are selected, the data displayed refreshes, and the active filters are listed at the top of the page. ## Findings Filters Search filters allow users to refine and narrow their search results based on specific criteria or parameters. Analytics filter values and data sets are updated every minute. If a tag or field was updated but did not appear as expected, wait one minute and try again. A list of all filters and values for the **Findings** tab exists below: * Client(s) * Client Tags * Date Range * Asset(s) * Asset Tags * Finding Severity: Unchecking a severity will hide any asset with only findings of that severity. * Critical * High * Medium * Low * Informational * Asset Severity * Critical * High * Medium * Low * Informational * Unspecified * Finding Tags * Finding Status * Open * In Process * Closed * Report * Report Tags * Graph View * Horizontal * Vertical * Assignees: This field only relates to Clients, Client Tags, Finding Tags, Reports, and Report Tags. If other fields are selected, the pulldown menu for Assignees will be blank. Similarly, if a report with no assignees is set, the pulldown menu for Assignees will be empty. * CVE ID * CWE ID {% hint style="info" %} The CVE and CWE filters use an “and” query condition that requires both of the specified search terms or conditions to be present in the results. In other words, the search results must meet all of the specified conditions to be included in the results.\ \ For example, if two CVE values are added as a filter, the results will only display findings that contain both values. {% endhint %} ## Findings Container The **Findings** container displays the status, severity, client breakdown, and most critical findings for all tenant findings within defined query parameters and user permissions.

## Findings By Clients Container The **Findings By Client** container breaks down findings per client. Scroll down to see additional clients in the tenant.

## Finding Information More details about a specific finding can be obtained in the "Most Critical Findings" table.

Clicking the row of a finding brings up the finding details modal. 1. Access the **Findings** tab of the **Report** module for further editing by clicking the "Finding ID" value. 2. Modify the finding status by clicking the "Status" value. 3. View information on an affected asset by clicking the table row of the # Assets The **Assets** tab has two containers that can be expanded or collapsed to display all assets that the user has access to view: * **Asset findings overview:** an overview of all assets * **Assets**: a table view of assets with sortable headings

{% hint style="info" %} Only assets from reports with a "Published" status are included in the analytics module. {% endhint %} ## Asset Filters Search filters allow users to refine and narrow search results based on specific criteria or parameters. Analytics filter values and data sets are updated every minute. If a tag or field was updated but did not appear as expected, wait one minute and try again. A list of all filters and values for the **Assets** tab exists below: * Client(s) * Client Tags * Asset Types * Asset(s) * Asset Tags * Ports * Finding Severity * Critical * High * Medium * Low * Informational * Asset Severity * Critical * High * Medium * Low * Informational * Unspecified * Finding Tags * Report * Report Tags * Operating System * Data Owner * System Owner * Physical Location ## Asset Findings Overview Container This container graphically displays the number of assets that have findings and provides a breakdown of the severity of findings (for those assets with findings).

## Assets Container This container displays a table that lists the asset name, client, criticality, type, and finding count. Column headers can be clicked to change the sort order and how the data is displayed.

Click an asset row for more information and a list of associated findings. Assets can be edited directly by clicking **Edit Asset** at the top right of the page. ![](/files/9YPL7hOQH1iVRMnZjcjf) # Runbooks {% hint style="warning" %} This tab only supports the legacy Runbooks V1 solution. {% endhint %} The **Runbooks** tab allows the ability to view success at remediating issues over time by displaying data from all published runbooks a user has permission to view. It reveals trends to see how blue and red team outcomes change (or not) over time to ensure that blue team success increases as red team success decreases. Each runbook is separated by a container that can be expanded or collapsed. Clicking a container for a runbook provides a graphical view of the following information: * **Runbook Stats**: overviews clients impacted, findings generated, and tactics covered. * **Tactics Covered**: shows how many procedures in a runbook were created as findings and how effective a security program was at stopping a technique. * **Red Team Outcomes:** provides a view and percentage breakdown of red team outcomes; moving the cursor around the pie chart provides additional information. * **Blue Team Outcomes:** provides a view and percentage breakdown of blue team outcomes; moving the cursor around the pie chart provides further information. * **Client Engagement Analysis:** provides a bar chart graph visual of blue and red team outcomes by date to measure progress over time

When filters are selected, the data displayed refreshes, and the active filters are listed at the top of the page. ![](/files/2QuLXZgGH03tGfZUqZka) ## Filters Search filters allow users to refine and narrow their search results based on specific criteria or parameters. Analytics filter values and data sets are updated every minute. If a tag or field was updated but did not appear as expected, wait one minute and try again. A list of all filters and values for the tab exists below: * Client(s) * Date range (values selected shown in query bar) * Runbooks (values selected shown in query bar) * Methodologies (values selected shown in query bar) * Engagements (values selected shown in query bar) * Engagement Tags * Tactics (values selected shown in query bar) * Red Team Outcome * Success * Partial Success * Failed * Unknown * Blue Team Outcome * Blocked * Alerted * Logged * No Evidence * Included as Finding * True * False # Trends & SLAs The **Trends & SLAs** tab displays how a security program is meeting goals from an SLA perspective and provides trending data about findings in a security program. It allows the configuration of SLAs based on specific criteria and allows visual data to determine if those criteria are being met. The Trends and SLAs tab contains multiple containers: * **Mean time to remediate by severity:** This includes only closed findings. The MTTR number is derived from the following calculation: *Total Sum of Creation to Closure Time / Total Number of Findings Closed.* * **Trend of findings opened vs closed**: This graph shows progress over a period of time. To better utilize space, days with zero findings opened or closed are hidden. * **Service-Level Agreements (SLAs):** This section will list every SLA that has been enabled for the tenant.

Admins can [set up SLAs](/plextrac-documentation/product-documentation/analytics/trends-and-slas) through the **Admin Dashboard** (Tenant Settings>Service-Level Agreements) or by clicking **SLA Settings**.

## Filters Search filters allow users to refine and narrow search results based on specific criteria or parameters. Analytics filter values and data sets are updated every minute. If a tag or field was updated but did not appear as expected, wait one minute and try again. A list of all filters and values exists below: * Client * Client Tags * Date Range * Finding Severity * Critical * High * Medium * Low * Informational * Finding Tags * Report * Report Tags * CVE ID * CWE ID ## **Mean Time to Remediate by Severity** The MTTR number is derived from the following calculation: *Total Sum of Creation to Closure Time / Total Number of Findings Closed.* {% hint style="info" %} This graph includes only closed findings. {% endhint %}

## **Trend of Findings Opened vs. Closed Container** This container displays a bar graph showing the monthly trend chart of open and closed findings over the period specified in the filter for findings that match the criteria. A trending blue line shows the total number of open findings. A green bar identifies the number of closed findings, while a red bar identifies the number of opened findings. {% hint style="info" %} To make this graph easier to view, days with no findings opened or closed are hidden. {% endhint %}

## **Service-Level Agreements (SLAs) Containers** These containers provide visual representations and snapshots of findings based on enabled SLAs and selected query parameters. 1. A total count for all findings that exceed, are nearing or are within one day of the SLA. 2. A view of the mean time to remediate, plus any findings nearing one day of SLA over time. 3. A view of how many findings by a percentage of overall findings exceeded SLA over a period of time.

Further details and the ability to directly edit any findings that apply to the SLA can be obtained by clicking on the appropriate box under "CURRENT SNAPSHOT."

# Runbooks In the **Runbooks** module, users can create detailed guides for red teaming and penetration testing, documenting the procedures, vulnerabilities, and recommendations for enhancing security. Runbooks work with the [**RunbooksDB**](/plextrac-documentation/product-documentation/content-library/runbooksdb) repository in the **Content Library**, enabling the reuse of existing procedures, tactics, and methodologies with or without modifications to fit new test plans. Users access the module by clicking **Runbooks** in the application's main menu.

## Overview In cybersecurity, professionals often rely on red teaming to test and strengthen their defenses. This process involves simulating real-world cyberattacks to assess vulnerabilities and response capabilities. During such engagements, teams create runbooks to guide actions and record findings. These runbooks serve as comprehensive records, documenting various procedures and tactics employed during the engagements. They outline the steps the red team takes, the vulnerabilities they exploit, and the recommendations they make to improve security. In essence, runbooks are the playbook for these security exercises. The ultimate objective of these engagements is to evaluate the red team's proficiency in executing attack procedures and the blue team's capability to detect, protect against, and respond to them. The outcomes of these engagements are compiled in reports, which are then shared with clients or internal teams. These reports offer valuable insights into the effectiveness of the existing security measures and provide recommendations for improvements. The **Runbooks** module has two tabs: * **Engagements:** Displays all runbooks created for a client, including those in progress and those submitted as a report (if not deleted).

* **Test Plans**: Displays all existing test plans created or imported.

{% hint style="info" %} **RunbooksDB** is accessible from both tabs by clicking **Manage RunbooksDB**. {% endhint %} # Managing Engagements Engagements are shown on the **Engagements** tab of the Runbooks module. This view displays the engagement title, associated test plan, related client, the date the engagement was last updated, and the progress of the engagement. In the "Actions" column, engagements can be viewed, edited, or deleted. ## **Engagement Status** Engagements are identified as submitted, not submitted, or in progress. Progress is based on the completion of contained procedures, and progress is displayed in two locations: * On the **Engagements** tab as a progress bar:

* Within the top toolbar of the engagement's home page:

Engagements completed but not submitted will display "Not Submitted" under the 100% progress bar.

Engagements submitted become reports and are identified with a green checkmark and label. They will remain listed in Runbooks until deleted.

{% hint style="warning" %} Only engagements that are in progress can be edited. Once an engagement is submitted and becomes a report, it cannot be edited. {% endhint %} ## Updating Engagement Procedures Step 1: Click **View** under an in-progress engagement's "Actions" column.

Step 2: The engagement overview page provides information about the engagement and procedures. Click **View** under the "Actions" column of the procedure to update.

Step 3: Update the procedure status or finding severity by selecting the desired values from the pulldown menus.

Step 4: Add operators by clicking **Managing operators**. Assign an operator(s) for the red and blue teams. Click **Save**. When the runbook is submitted, these names appear on the test plan and become a report.

{% hint style="info" %} All engagement sections are in containers that can be collapsed or expanded for usability. \ \ ![](/files/cJgiMZp4relv95eY81La) {% endhint %} Step 5: Run the procedure's execution steps. When completed, identify the outcomes for the blue and red teams from the provided options and enter an attack source in the provided box.

Step 6: Add assets, procedure logs, attachments, and notes as needed to provide additional support and context.

Step 7: Scroll to the top of the page and click **Save**.

Step 8: Click the page navigation aid at the top to continue the engagement.

Procedures can be viewed and edited on this page using the navigation icons at the top of the screen. # Starting an Engagement Step 1: From the **Runbooks** module home page (the **Engagements** tab), click **Start New Engagement**.

Step 2: Select the client from the **Client** pulldown menu.

Step 3: Select if the engagement is new or to be modified from an existing test plan.

Existing test plans are greyed out unless "Start from an existing Test Plan" is selected. These plans can be leveraged as a starting point by clicking **Select** next to the test plan.

To reduce the list of test plans provided, filter by tactic or test plan title in the search box. Step 4: Click **Next**.

Step 5: On the **Engagement Details** tab, enter a title (required), a description, and any required tags. If an existing test plan was selected in the previous step, information in that test plan is populated by default and can be edited. Click **Continue**.

Step 6: On the **Select Procedures** tab, select the procedures for this engagement by clicking the **Select** button next to the procedure to add. If leveraging an existing test plan, all procedures from that template are displayed in the right-hand column.

This list can be reduced by clicking the x button of the procedure to remove at the right of the box.

The procedure sequence can be adjusted by clicking and dragging the procedure to its desired line.

The list of procedures displayed on the screen can be adjusted using the provided filter options.

{% hint style="info" %} If required procedures have not yet been created, the engagement can be completed and procedures added later, but it is recommended to create the procedures first in [**RunbooksDB**](/plextrac-documentation/product-documentation/content-library/runbooksdb). {% endhint %} Step 7: Click **Add X Procedures** when finished. Step 8: View a summary of the engagement from the **Finalize Engagement** tab. The title, description, tags, engagement coverage, and assigned procedures are displayed. Click **Create Engagement**.

The engagement is now active and ready to be executed.

It also is now listed on the **Engagements** tab.

# Submitting an Engagement Step 1: Click **View** under the "Actions" column of an engagement.

Step 2: Click **Submit Engagement**. {% hint style="danger" %} Clicking **Submit Engagement** cannot be reversed. {% endhint %}

The engagement is now a report, and PlexTrac redirects to the **Procedures** tab of the **Reports** module.

Submitted engagements will still be displayed in the **Runbooks** module, but the engagement can no longer be viewed or edited, and the link provided under the "Actions" column will open the **Reports** module.

{% hint style="info" %} Deleting a submitted engagement in **Runbooks** does not delete the report. {% endhint %} # Managing Test Plans Test plans are displayed on the **Test Plans** tab of the **Runbooks** module.

## Starting a Test Plan Step 1: From the **Test Plans** tab of the **Runbooks** module, click **Start** under the "Actions" menu of the test plan.

Step 2: Select the client from the pulldown menu. Click **Next**.

Step 3: Review and update details as desired. Click **Continue**.

Step 4: Review the engagement. Add new procedures by clicking **Select** next to the procedure to include or delete existing ones from the engagement by clicking the x within the procedure box in the right-hand column. Click **Add X Procedures**.

Step 5: Review the engagement coverage. The plan can still be modified from this page by clicking Add Procedures or clicking the X to remove an existing procedure. The order of procedures can also be changed by selecting a box and dragging it to the desired location. When ready, click **Start new engagement**.

Step 6: Begin engagement by selecting a procedure and clicking **View**.

Step 7: The procedure page will appear. Conduct the procedure, then click **Save**.

Step 8: Click **Close** to return to the page of the test plan that lists all contained procedures, or click the navigation arrow to move to the following procedure.

{% hint style="info" %} Click **Close** from the test plan overview page to return to the **Engagements** tab. ![](/files/Qrtl3v4GaZideFkF0G0x) {% endhint %} ## Viewing a Test Plan From the **Test Plans** tab of the **Runbooks** home page, click **View** under the "Actions" menu of the test plan.

## Editing a Test Plan From the **Test Plans** tab of the **Runbooks** home page, click **Edit** under the "Actions" menu of the test plan. If the user cannot edit, the option will not exist.

## Deleting a Test Plan From the **Test Plans** tab of the **Runbooks** home page, click the three dots under the "Actions" menu of the test plan and then click **Delete**. If the user cannot delete it, the option will not exist.

# Creating a Test Plan Step 1: From the **Test Plans** tab of the **Runbooks** module, click **New Test Plan**.

Step 2: Select whether to start a new plan or modify an existing test plan.

If starting from scratch, click **Next**. If starting from an existing test plan, select that option, then click **Select** next to the plan to use as a template. Click **Next**.

Step 3: From the **Test Plan Details** tab, insert the test plan title (required) and enter a description and tags. Click **Continue**.

Step 4: From the **Select Procedures** tab, add the relevant procedures to the test plan. Use the filtering options to find desired procedures. Add new procedures by clicking **Select** next to the procedure to include or delete existing ones from the engagement by clicking the x within the procedure box in the right-hand column. Click **Add X Procedures**.

The engagement is now ready to be started. Click **Start new engagement**, or click **Close** and return to the **Test Plans** tab.

The test plan is now listed for future access on the Test Plans tab.

# Exporting a Test Plan Test plans can be exported locally as a YAML file. From the **Test Plans** tab of the **Runbooks** module, click the three dots under the "Actions" menu of the test plan and then click **Export**.

A dialog box will appear confirming the download. Click **Continue export**.

The test plan will download to the local device as a YAML file. # Findings PlexTrac's enhanced findings management capabilities aim to streamline Continuous Threat Exposure Management (CTEM) by breaking away from traditional report-centric workflows. These improvements give users a centralized and dynamic approach to managing findings, enabling real-time insights into security issues, prioritization, and remediation activities.

This approach allows pentesters to look at the vulnerability from the perspective of a finding or an instance. The key difference between a **finding** and an **instance** lies in their granularity and scope in identifying asset vulnerabilities. **Finding:** A finding refers to identifying a vulnerability on an asset. It represents a single occurrence of a vulnerability appearing on an asset, uniquely identified by attributes such as plugin ID, port, and protocol. Findings determine whether an asset is vulnerable to a specific issue. For example, if a vulnerability affects 50 assets, there will be 50 findings, one for each affected asset. **Instance:** An instance is a more granular representation of how a vulnerability manifests on an asset. It refers to the specific condition(s) on an asset that cause it to be vulnerable. An asset can have multiple instances of the same vulnerability due to factors like multiple versions of vulnerable software installed or exposure through different network ports. Instances provide the most detailed view of vulnerabilities and are critical for assessing risk at the most specific level. {% hint style="info" %} The views and functionality seen in the findings and instances tabs are the same if viewed from within the **Clients** module. {% endhint %} ## Key Benefits The findings and instances tabs offer several key benefits that enhance vulnerability management and workflow efficiency. * **Improved Visibility Across Clients**: The findings tab allows users to see all unique vulnerabilities across their authorized clients. This enables enterprise-level oversight of issues, deduplicated by source, title, and client, providing clarity on the scope of vulnerabilities within an organization. * **Granular Breakdown of Vulnerabilities**: The instances page complements the findings view by detailing specific occurrences of each vulnerability across individual assets. This differentiation helps users assess whether an issue is widespread across critical assets or isolated to low-priority ones, aiding in risk prioritization. * **Support for Light Vulnerability Management**: The tabs enable a streamlined approach to vulnerability management by creating unique records of vulnerabilities on specific assets. This allows organizations to track issues more effectively and navigate workflows more precisely. * **First Seen Tracking**: The platform tracks when vulnerabilities were first detected in external tools and within the platform itself. This historical context supports better risk assessment and positions the platform as a data aggregation tool for managing security issues. * **Simplified Permissions Model**: The tabs leverage existing client authorization without introducing new permissions. * **Automation of Findings and Instances Creation**: When reports are published, findings and instances are automatically created based on the data provided. This reduces manual effort and ensures accurate tracking of vulnerabilities across assets. # Findings Components By breaking away from traditional report-first workflows, findings are managed independently at the client and tenant levels, enabling teams to track, analyze, and remediate vulnerabilities more effectively. The Findings module consists of two tabs: **Findings** and **Instances**. {% hint style="info" %} A finding represents a unique vulnerability occurrence for a specific client, while an instance represents each specific occurrence of that finding on a single asset. {% endhint %} ## Findings Tab The findings tab displays client-level findings, deduplicated by source and title, providing a view of unique organizational issues. A user needs authorization for every client to see all findings across the tenancy. ### Findings Overview Section The Findings overview section provides a consolidated view of findings and is updated hourly. It includes analytics to understand progress, such as findings by severity and a breakdown of total open findings, so users can determine what to work on next. The data can be filtered by date values and client(s).

### Findings Inventory Section The findings inventory list displays all client-level findings in one place, deduplicated by source and title. A user needs authorization for every client to see all findings across the tenancy.

## Instances Tab A finding is a unique vulnerability within a client, while an instance is a specific occurrence of that finding on a single asset. To illustrate: 1. **Findings Tab**: If a "Wireless Data Extraction" vulnerability exists, it is counted as one finding for each unique client where it occurs, provided the source and title are also unique. If a user has authorization to view all clients, they will see every unique vulnerability across the entire organization. 2. **Instances Tab**: When a user clicks on the "Wireless Data Extraction" finding and views its instances, they will see a list of all unique assets affected by that vulnerability. For example, if the vulnerability impacts three different assets, the page will display three instances, each representing the occurrence of the vulnerability on a specific asset.\ \ ![](/files/4Qw45OQnD2LyRrVkateU) {% hint style="info" %} A finding will always have one or more instances, while an instance will only have one finding. {% endhint %} ### Instances Overview Section The Instances overview section provides a snapshot of instances by status, score, and assignee, enabling users to analyze and organize finding data efficiently. The container can be collapsed by clicking the arrow at the top right.

### Instances Inventory Section The instances table provides a detailed breakdown of specific vulnerabilities or issues across an organization's assets. Each instance represents a unique finding on a single asset, offering granular visibility into where and how often an issue appears. Findings are deduplicated at a higher level, while instances show the exact scope of the problem across multiple assets, helping to determine whether an issue is widespread or isolated. Additionally, the table tracks when vulnerabilities were first detected, offering historical context for assessing how long issues have persisted.

# Managing Findings The **Findings** module provides a streamlined approach to managing findings, providing enhanced visibility, automation, and granularity for vulnerability management. ## **Interacting with Metrics** The metrics default to all clients that the user can access. Filtering by clients and date narrows the data set. {% hint style="warning" %} These fields do not impact the findings shown in the findings table. {% endhint %}

Hovering the cursor over a specific date will generate a pop-up with detailed information related to that date.

Clicking on severity values hides them from the chart.

Clicking the severity bar graph in the "open findings" window will result in all `Open` or `In Process` findings with that severity being displayed in the table below.

## Using Filters When filters have been set, the option to "Reset filters" is next to the findings count in the table header.

The number of filters used in a specific column is identified with a purple number next to the column header. ## Viewing a Finding Instance Click a finding row to view its instances (one or more, CVE and CWE scores (when applicable), seen history, metadata, and other options to edit the instance.

## Viewing the Finding Activity Log To view the activity log for a finding, click the **Activity** button in the top-right corner of the page. {% hint style="info" %} This feature is available to Admin users only. {% endhint %}

{% hint style="info" %} The activity log displays events recorded on or after the 2.17 release (May 21, 2025). Activity prior to this date is not included. {% endhint %} ## Deleting a Finding Click Delete under the "Actions" menu to delete a finding from this table.

## Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. Once clicked, a modal appears that lists all fields.

To remove a column, click the X within the bar. Fields that are required and cannot be eliminated do not have an X available. When fields are removed, an "Add column" pulldown menu appears at the bottom left of the modal to store the field. Any removed fields can be added later by clicking **Add column** and selecting the field to add. This modal represents the sequence of fields shown in the table, meaning the bar at the top corresponds to the column on the far left of the relevant box. The order of columns can be adjusted within this modal by clicking the six dots on the left of the bar for a field and dragging the bar to the desired position in the sequence. Click **Save** when finished. # Managing Instances The **Instances** tab provides users with a detailed view of vulnerabilities at the asset level, enabling precise tracking and management of specific occurrences. Instances pair a finding with an affected asset, offering granular insights into how vulnerabilities manifest across an organization's infrastructure. Users can edit instance details, such as severity, status, tags, and evidence, while activity logs maintain a complete history of changes for transparency. Bulk actions streamline workflows, allowing users to add instances to reports or update remediation statuses efficiently. ## **Interacting with Metrics** The metrics provide data on all instances the user has client permissions to view. Clicking on the status in the box can toggle a value and update the listing in the table.

Change the score value presented by selecting a different value in the pulldown menu.

## Using Filters When filters have been set, the option to "Reset filters" is next to the instance count in the table header.

The number of filters used in a specific column is identified with a purple number next to the column header. ## Viewing an Instance Click a row to launch a side drawer with details about the instance.

The Affected ports and Activity tabs are available for viewing. The instance can be edited by clicking the edit icon at the upper right-hand corner. ## Viewing the Instance Activity Log To view an instance's activity log, click the Activity tab in the instance detail. {% hint style="info" %} This feature is available to Admin users only. {% endhint %}

{% hint style="info" %} The activity log displays events recorded on or after the 2.17 release (May 21, 2025). Activity prior to this date is not included. {% endhint %} ## Actions Menu Click **Edit** under the "Actions" menu to go directly to the edit page.

Click **Delete** under the "Actions" menu to delete an instance.

Click the three dots for additional options, such as adding tags, changing status, or adding ports.

## Bulk Updates To access the bulk actions menu, click on any box to the left of an instance's name or next to the column header to select all instances on the page.

Click **Actions** to see the list of options for bulk update, such as adding tags, changing status, or adding ports. ## Configuring Table View The table view can be customized by clicking the column view icon to the right of the search bar. Once clicked, a modal appears that lists all fields.

For admins, the drop-down menu will provide options to select **Profile**, **Account Admin**, **Help Center**, and **Logout**:

# Profile (Personal Settings) The **Personal Settings** page allows users to upload a profile image, change the user display name, view the email on file, select a theme mode (light or dark), update the user password, configure how dates are displayed, and set up and manage multi-factor authentication (MFA). The personal settings page is reached by clicking the user name in the upper right and then clicking **Profile**.

## Overview The **Personal Settings** page has three tabs:


Profile	manage user name, profile image, date format, configure dark mode	/files/KWYE1tSGf8Aa5YRNPj3Q	/pages/P3y0pY2Tzw1zAKWSVx2h
Change Password	change and update password for security compliance	/files/KWYE1tSGf8Aa5YRNPj3Q	/pages/PjbWopAZWoiDajWa4oqe
Two-Factor Authentication	set up and configure two-factor authentication	/files/KWYE1tSGf8Aa5YRNPj3Q	/pages/UVjdGFbbHjp2GiPN5ia3

# Managing User Profile The Profile tab allows users to customize and manage their accounts by adjusting their user names and profile pictures. They can also tailor the date format to their personal preference or regional settings. Plus, there's an option for a dark mode interface that's easy on the eyes in low-light conditions. ## Changing User Profile Image Step 1: From the **Profile** tab of the **Personal Settings** page, click the avatar circle under "Profile Image" to bring up a dialog box.

Step 2: Drag an image to the dialog box or click the box to navigate to the file on the computer. Click **Submit**.

The new image is now shown in the **Profile** tab and next to the user name at the top right of the page. ### Deleting a Profile Image Step 1: From the **Profile** tab of the **Personal Settings** page, click the avatar circle under "Profile Image" to bring up a dialog box.

Step 2: Click **Delete Profile Image**. The modal will disappear, and PlexTrac will revert to the default grey avatar icon.

The modal will disappear, and PlexTrac will revert to the default grey avatar icon. ## Managing User Name The name displayed for a user throughout PlexTrac is managed here. Users can update their information by entering the desired values in the "First Name" and "Last Name" fields.

After making the necessary changes, click **Update Settings** at the bottom of the page to save the updated information. {% hint style="info" %} All changes to a user name must be confirmed by clicking **Update Settings**.\ ![](/files/sYSFRaAesB9T8LzK83Bb) {% endhint %} The new name value may not appear immediately without a browser refresh. To confirm the change, an email will be sent to the address on file. ## Choosing Theme Mode To switch between Light and Dark Mode on PlexTrac, adjust the toggle button under "Theme Mode."

## Choosing Date Format The date format can be configured to display in one of three options: **YYYY-MM-DD**, **DD-MM-YYYY**, or **MM-DD-YYYY.**

# Managing Password Users can change their password in the **Personal Settings** section by navigating to the **Change Password** tab. This feature empowers users to maintain the security and integrity of their accounts by periodically updating their passwords.

## Password Requirements All of the listed requirements must be met to create an acceptable password. * a minimum of 12 characters * one lowercase character * one uppercase character * one number * one special character {% hint style="info" %} Users can access the password requirements within the platform by clicking on the "?" next to the "Enter New Password" label. {% endhint %} # Setting Up Two-Factor Authentication PlexTrac enables two-factor authentication at the account level and is managed on the **Two-Factor Authentication** tab of the **Personal Settings** page. Two-factor authentication is a security measure that requires users to provide two forms of identification to access an account or system.

Two-factor authentication (2FA) is a security measure that significantly protects against unauthorized access to sensitive information and accounts. It works by adding an extra layer of verification to the traditional password or PIN login process. When users log in, they must provide their regular credentials, such as a username and password, and a second form of authentication. The second authentication factor can take various forms, such as a unique code sent to the user's mobile device via SMS or generated by an authentication app, a fingerprint or facial recognition scan, a hardware token, or even a one-time password sent to an email address. The significance of 2FA lies in its ability to counteract the vulnerabilities of using passwords alone. ### Setting up Two-Factor Authentication Step 1: Click the **Two-Factor Authentication** tab on the **Personal Settings** page.

Step 2: Click **Set up Two-Factor Authentication**.

Step 3: Scan the QR code with the phone and input the token provided on the device.

Step 4: Click **Confirm**. The modal will disappear, and a message will confirm that Two-factor Authentication is enabled.

### Resetting Token for Two-Factor Authentication Step 1: Click the **Two-Factor Authentication** tab on the **Personal Settings** page.

Step 2: Click **Reset Token**.

Step 3: A confirmation modal appears. Click **Reset**.

Step 4: Scan the QR code and click **Confirm**. ### Disabling Two-Factor Authentication Step 1: Click the **Two-Factor Authentication** tab on the **Personal Settings** page.

Step 2: Click **Disable Two-Factor Authentication**.

Step 3: A confirmation appears. Click **Disable**.

# Account Admin The **Admin Dashboard** is reached by clicking the user name in the upper right of the page and then clicking **Account Admin**.

The **Admin Dashboard** includes the following sections:


Tenant Settings	answer types, email templates, tags, SLAs, finding sub-statuses, short codes	/pages/wnKDolnhPymuPrJygXMA	/files/BgeFBOiVZraNWVmeDg9i
Customizations	findings layouts, report templates, export templates, dark mode, theme color configuration	/pages/BsoWdRXcUhemLQvejpqj	/files/78jQ5lSVCvpnEWD5h1TH
Automations	configuration of contextual scoring and score equations for the Priorities module, parser actions	/pages/HdsY2M2nofsPQt5miKfD	/files/Zx1Blunvl4ewEddaddfS
Integrations & Webhooks	integration set up and configuration for third-party solutions, filed mappings where applicable, webhook configuration	/pages/FEbwWcUjoLU6g3mczUBa	/files/3lxBxaziiJMgTISnE57F
Security & User Management	authentication setup, RBAC, manage users, passwords, classification tiers, and audit logging for the platform	/pages/Zk5TKrGS6AO0gkzGr7kT	/files/dyJief8pn6zutTW7d8Yl
Licensing	license key entry, log of tenant licenses for modules and integrations, configure priority association at tenant or client level	/pages/taIsctGuXqW6QJP3JaI3	/files/5LzI9YklhHMaa9V36PuT
White Labeling	menu item and white labeling, core platform white labeling	/pages/NdkJzKDUvfAy9PrljMYt	/files/aXXEwByf38btRzHZGmvJ

# Tenant Settings In **Tenant Settings**, admins can manage different aspects of their tenant effectively. They can change the tenant name, activate dark mode for a personalized feel, view and add licenses, set default finding status, configure sub-status options, manage notification and server settings, create email templates, and set up short codes. **Tenant Settings** contains the following sections:


Account Information	manage tenant name, set dark mode, update tenant logo and icons, enter and view licenses	/files/jl05Fgr4KMfaMNqfvMIa	/pages/-MRvquQ4i_Auyb16XalP
General Settings	answer types, default findings status, sub-status configuration, rapid templating	/files/jl05Fgr4KMfaMNqfvMIa	/pages/-MRvuXHxeDJME3LQA5bW
Email Settings	manage notification settings, server settings, email templates	/files/jl05Fgr4KMfaMNqfvMIa	/pages/-MRvxvwVbCuby88LbBKQ
Tags Settings	manage the list of tags existing in a tenant	/files/jl05Fgr4KMfaMNqfvMIa	/pages/-MRvzi-XEDyNQxpOLgrE
Service-Level Agreements	manage the business rules for SLAs	/files/jl05Fgr4KMfaMNqfvMIa	/pages/EW4dD2T4ngoUHF9iHhkS
Short Codes	set up and configure short codes	/files/jl05Fgr4KMfaMNqfvMIa	/pages/-MadzY9DH8VsQS_A_DvH

# Account Information The **Account Information** button under "Tenant Settings" in the **Admin Dashboard** provides configuration of tenant information, including changing the tenant theme (light or dark), uploading a tenant logo and icon, and changing tenant name.

## Changing Tenant Light/Dark Mode To change the mode of the tenancy from light to dark, click the desired mode. The change is immediate.

Any images loaded light mode will disappear. Images will need to be reloaded for dark mode. ## Adding Tenant Images {% hint style="info" %} The Tenant logo and icon need to be updated in both light and dark mode.
Dimensions of the tenant icon image file should have the same height and width. {% endhint %} Step 1: Click **Upload Tenant Images**.

Step 2: Click the box of the image to upload, and drag the file into the box or navigate to that image on the computer. {% hint style="info" %} The dimensions of the tenant icon image should have the same height and width (i.e., 500px x 500px). {% endhint %}

Step 3: Click **Submit**.

The logo will appear at the top of the left navigation bar.

## Editing Tenant Name Step 1: Click **Edit Tenant Information.**

Step **2**: Enter the desired information and click **Submit.**

The new value appears on the **Account Information** page. After refreshing page, the new value appears as the Tenant Administration value.

--- [Next Page](/plextrac-documentation/llms-full.txt/1)