OWASP ZAP REPORT WITH ADVANCED FILTERING BY TAGS AND SEVERITY

It is a vulnerability scanner and interception proxy that delivers a great report, using a confidence classification based on the reference below

False Positive The tool identified something that the security analyst has already confirmed is not a vulnerability When you mark an alert as a false positive it falls into this category

Low ZAP found indications suggesting a vulnerability but there is a considerable chance it is a false positive It requires careful manual validation

Medium There is solid evidence that the vulnerability exists based on more robust matching rules The accuracy rate is high

High ZAP is almost entirely certain of the finding This usually occurs when the tool successfully exploited the vulnerability or obtained an unequivocal response from the target

Identifying the Need

After a period of using OWASP ZAP I wondered if it would be possible to create a report that provides Key CWE OWASP WSTG POLICY etc Value Reference link to the key filtering right out of the box Doing this vulnerability by vulnerability manually and then mapping them by severity risk and custom tags was very time consuming With the help of AI it became possible to generate this report saving a significant amount of time during report validation

Comparison Between the Custom Report and the Standard Report

Step by Step Implementation

Prerequisites

OWASP ZAP installed version recommended

Updated Report Generation add on from the OWASP ZAP Marketplace

How to Use the Templates

Copy the three files below from the repository https://github.com/luizfelipe-sec/owasp-zap-custom-reports owasp zap custom reports into the custom tags report folder located at home usuario ZAP reports custom tags report

Messages properties

report html

template yaml

In OWASP ZAP when generating the report it will fetch the attribute report template name Relatorio Tradicional Completo com Secoes from the Messages properties file feel free to change the name if needed

There you go! Now your reports will be organized and ready to enhance your security analysis.