Skip to main content

ASPM v1.6.0

I. Highlights​

FPT Smart Cloud introduces AI Review and Asset Inventory in AppSec v1.6.0 as part of the FPT Security Platform (FSP).

AI Review automatically analyzes security findings after each scan and determines whether Critical, High, and Medium severity issues on Source Control repositories are false positives. Confirmed false positives are automatically set to Ignored AI status — eliminating the need for manual triage on noise. Asset Inventory provides a unified overview of every asset added to the system — Source Code Repositories, Container Images, and DAST APIs — consolidated in a single screen for cross-workspace visibility.

II. Released Features​

1. AI Review — Enable via Add Asset / Rescan popup​

a. Description​

When performing Add Asset or Rescan on a Source Control integration, the system displays a popup asking whether to enable AI Review for the repositories in scope. This is the fastest activation path — no need to navigate to View Config separately.

b. Features​

  • Popup appears before the action proceeds, with two radio options:
    • Enable AI Review (selected by default): AI automatically reviews Code Analysis and Secret Scanning findings to filter false positives
    • Skip for now: proceed without enabling AI Review; can be enabled later in Integration → View Config
  • Popup title reflects the action context: Add assets to Workspace (Add Asset) / Rescan assets (Rescan)
  • The Enable AI Review radio is selected by default each time the popup opens, regardless of the previous selection
  • Cancel button and X icon: cancel both the action and any AI Review configuration change

c. Capacity​

  • Applies to Source Control (GitHub and GitLab) — Code Analysis and Secret Scanning
  • Activation applies simultaneously to all repositories in the scope of the Add Asset / Rescan action

2. AI Review — Configure via Integration View Config​

a. Description​

Users can manage the list of repositories with AI Review enabled through the DevSecOps AI Review section in the View Config screen of a Source Control integration. This method is suited for enabling or disabling AI Review on individual repositories after assets have been added.

b. Features​

Dual-panel interface:

  • Not Applying AI Review panel: repositories with AI Review disabled — supports search by name and lazy load (10 items per load)
  • Applying AI Review panel: repositories with AI Review enabled — loads all at once, supports search by name
  • > / < buttons: move repositories between panels; supports multi-select
  • Each panel header shows a real-time count that updates immediately when items are moved
  • Save Changes button: enabled when there are unsaved changes; toast "Changes saved successfully." on save

c. Capacity​

  • Supports enabling AI Review on multiple repositories simultaneously (multi-select)
  • Configuration is scoped to the selected team and persists across reloads and browser back navigation
  • Unsaved changes are discarded if the page is reloaded before saving

3. AI Review — Automatic false positive detection after scan​

a. Description​

AI Review runs automatically after each scan completes on Source Control repositories with the feature enabled. The system analyzes issues with Critical, High, and Medium severity, determines whether each is a false positive, and updates the issue status accordingly.

Results are tracked via the scan metadata row in the Issue List and the Activity section in Issue Detail.

b. Features​

Issue List — AI Review status per scan:

  • Displays "AI Review: In Progress" (with spinner) as soon as the scan completes and AI Review begins
  • Displays "AI Review: Success" when analysis finishes successfully
  • Displays "AI Review: Failed" with an error tooltip when analysis fails
  • No AI Review status is shown when the repository does not have the feature enabled

Issue List — Help text:

  • A fixed help text appears above the table when AI Review is enabled for the repository: "AI Review automatically marks False Positives on Critical, High, and Medium findings. Findings flagged as False Positive are shown in the Status column."
  • Applies to both the Code Analysis tab and the Secret Scanning tab

Issue List — Ignored AI badge in Status column:

  • Issues concluded as false positive by AI show an Ignored badge (gray) and an AI badge (blue) on the same row, with a False Positive label below
  • Clearly distinguishable from manually set Ignored statuses (False Positive, Accepted Risk, Other)

Issue Detail — AI Review Activity entry:

  • The Activity section shows an AI Review entry with: timestamp (DD/MM/YYYY HH:mm:ss), verdict Ignored as False Positive by AI Review, and reasoning text generated by AI
  • The entry is read-only and cannot be edited or deleted

Reopen an issue flagged by AI:

  • Users can click Change Status → Reopen to return the issue to Open status
  • The AI Review entry in the Activity section is preserved as a historical record

c. Capacity​

  • Applies to Source Control — Code Analysis and Secret Scanning findings
  • Analyzes only issues with severity Critical, High, or Medium; Low and Info severity issues are excluded
  • Analyzes only issues in Open status; issues already in an Ignored state are excluded

d. Performance​

  • AI Review starts automatically after scan completion — no manual action required
  • "AI Review: In Progress" status updates in real time with a spinner; transitions to "Success" or "Failed" when analysis ends
  • Status badge and Activity entry update immediately after AI completes analysis

4. Asset Inventory​

a. Description​

Asset Inventory is a new overview screen that consolidates all assets added to the system — Source Code Repositories, Container Images, and DAST APIs — in a single interface. Assets are grouped into cards by repository, image repository, or root domain, allowing users to monitor scan status and severity across branches, image tags, and endpoints without navigating each Workspace individually.

Access via App Security → Asset Inventory.

b. Features​

Asset card list:

  • Displays all assets for the selected team; sorted by Recently Scanned (most recent first) by default
  • First card is automatically expanded on page load; all other cards are collapsed
  • Click the chevron icon to expand or collapse individual cards

SCM card (Source Code Repository):

  • Groups all branches of the same repository into one card
  • Each branch shows: scan type chips (Full Scan / MR Scan / Commit Scan + SAST / Secret / IaC), severity count (C H M L), last scan timestamp
  • Maximum 5 branches displayed; if more exist → View more button redirects to Workspace with the repository name pre-filled in the search box

Container Image card:

  • Groups all image tags of the same image repository into one card
  • Each tag shows: Image Scan chip, severity count, timestamp
  • Maximum 5 tags; View more redirects to Workspace

DAST API card:

  • Groups all endpoints of the same root domain into one card
  • Each endpoint shows: full URL, API source name, severity count, timestamp
  • Maximum 5 endpoints; View more redirects to Workspace

Search, filter, and sort:

  • Search by asset name (press Enter to apply); filter by Asset Type (Repository / Container Image / DAST API); sort by Recently Scanned or Name A → Z
  • Search and filter combine with AND logic; result changes reset the view to the first card expanded

Navigate to Asset Detail:

  • Click a branch name, image tag, or endpoint URL to go to the corresponding Asset Detail screen

Add new asset:

  • + Add Asset button (top-right of toolbar, enabled after selecting a team) — uses the same logic as the Add Asset button on Workspace

c. Capacity​

  • Supports all three asset types: Source Code Repository, Container Image, DAST API
  • Permission scoped by team: Org Admin sees all teams; standard users see only their assigned teams
  • Pagination: 10 items per page by default; configurable to 10 / 25 / 50 / 100