Caido

Creating Findings ​

Findings consist of the following set of properties:

  • Title (required): A string value header.
  • Request (required): The alias of the associated request.
  • Reporter (optional): An string value that identifies the reporting process.
  • Description (optional): Details about the finding.
  • Dedupe Key (optional): A string value that is matched against the raw request or response to prevent duplicate findings.

INFO

The Dedupe Key can also be set with the Check Finding node.

Creating a Finding with a Node ​

To create a finding, click on the + Add Node button within the workflow editor and click on the + Add button attached to the Create Finding node. Connect this node to your workflow.

The Create Finding node.

The editor of the Create Finding node contains input fields for all of the properties available to a finding.

INFO

Descriptions support Markdown syntax.

The Create Finding node editor.

Creating a Finding with JavaScript ​

To create a finding programmatically, click on the + Add Node button within the workflow editor and click on the + Add button attached to the Javascript node. Connect this node to your workflow.

The Javascript node.

The editor of the Javascript node contains a coding environment. Findings are defined as objects and created using the sdk.findings.create() method.

js
/**
 * @param {HttpInput} input
 * @param {SDK} sdk
 * @returns {MaybePromise<Data | undefined>}
 */
export async function run({ request, response }, sdk) {
  if (request) {
    const path = request.getPath();
    if (path === "/admin") {
      let finding = {
        title: "Admin Path Detected",
        request: request,
        reporter: "Admin Path Detection Workflow",
        description: `A request to the ${request.getPath()} path was proxied.`,
        dedupeKey: request.getPath()
      };
      await sdk.findings.create(finding);
    }
  }
}
The Javascript node editor.

TIP

View the workflow SDK reference in the developer documentation to learn more about JavaScript in workflows.

Viewing Findings ​

All generated findings can be viewed in the Findings interface.

INFO

Findings are project-specific.

The Findings interface.