Record threats, weaknesses, and vulnerabilities
Maintain the technical context linked to a risk and its optional CVE and CWE identifiers.
Open the Risk Register, choose a risk, and select Manage under Threats & vulnerabilities. The page has separate Threats, Weaknesses, and Vulnerabilities sections. Expand a section to inspect its records. Contributor, Admin, or Owner access to the risk's project is required to add, edit, or remove records.
Describe a threat
Choose Add threat. Enter the required Title, choose Source type if you can classify the threat, and add a Description of how it could act on this risk. Choose Add to save it. Leave the source type unclassified when you do not yet know it.
Use the record's edit control to update the title, source type, or description, then Save. Use Cancel to abandon the edit.
Record a weakness or vulnerability
Choose Add weakness for an underlying weakness or Add vulnerability for a vulnerability affecting the risk. Enter a Title and the description that explains its relevance. Add an optional CWE identifier for a weakness or CVE identifier for a vulnerability. A vulnerability can also include an external reference.
Choose Add to save the record. Use its edit control and Save to correct the description or identifier later. The title is required even when an identifier is present.
The row's menu offers Copy CWE id or Copy CVE id when an identifier is recorded. If clipboard access is blocked, copy the identifier from the row manually.
Remove a mapping
Use the record's remove control. Read the confirmation and choose Remove threat, Remove weakness, or Remove vulnerability as appropriate. This removes that record from the risk's linked context.
Finish or cancel an open edit before starting another change in the same section. If saving fails, keep the form open, read the message, check its title and identifier, and retry. An empty section means no items of that type have been linked to this risk yet.
Read a CVE or CWE context page
If you arrive at a CVE context or CWE context page for a risk, it shows the matching records linked to that risk, including the recorded titles and descriptions. Use Risk detail or Back to risk to return. If the identifier is no longer present in the loaded risk mappings, return to the risk and review its current linked items.