The Vulnerabilities section is your centralized hub for tracking, prioritizing, and remediating security findings across all collections and engagements. It goes beyond a static list — offering direct integrations with code repositories, project management tools, and automation playbooks.
Accessing the Vulnerability List
Navigate to Vulnerabilities in the left-hand menu and select a collection to load its findings. The list provides a high-level overview of all vulnerabilities in that collection, with severity, status, exploitability, and remediation state visible at a glance.
Per-Vulnerability Actions
For each vulnerability, you can take the following actions:
Generate Pull Request — if your code repositories are linked, SpartanX generates a code fix and opens a pull request for developers to review and merge. For example, a cross-site scripting vulnerability would produce a PR implementing input sanitization and output encoding.
Create Jira Issue — with Jira connected, create a ticket for one or more vulnerabilities directly from this view.
Export to CSV — export selected vulnerability data to a spreadsheet for downstream processing or reporting.
Launch Targeted Validation — initiate a targeted attack validation specifically for selected findings.
Launch Remediation Verification — retest findings that have been marked as fixed.
Bulk Actions
Select multiple vulnerabilities to apply actions in bulk. This is useful when an engagement produces a large number of findings that need to be assigned, exported, or ticketed simultaneously.
Automation Playbooks
SpartanX includes 15 automation playbooks that can be applied to vulnerabilities. These automate multi-step workflows that would otherwise require manual coordination:
Atlassian Integration — analyze vulnerabilities and automatically generate fix pull requests, applying to all findings in the collection at once.
GitHub Issues — analyze, prioritize, and create GitHub issues for vulnerabilities.
Risk Management — detect anomalies in vulnerability data, identify patterns, and flag outliers.
Threat Intelligence — analyze attack paths across assets and map them to the MITRE ATT&CK framework, producing a graph-based output of interconnected risk.
What's Next
With vulnerabilities tracked and managed, the next step is communication. The following section covers SpartanX's reporting engine — 84 report types, including compliance reports for PCI DSS, HIPAA, SOC 2, and more.