> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/web-application-and-api-protection-waap/application-security-testing/ast-basics-and-workflow/ast-issue-management.md).
# AST Issue Management
Updates (July 2026 to September 2026)
* *August 2026* — Updated the page to add information about virtual patching. For more information, see [Drill Down to an Issue](#2-drilling-down-into-an-issue).
Traceable's [Issues](/web-application-and-api-protection-waap/application-security-testing/ast-basics-and-workflow/ast-issues-overview.md) page provides a view of detected API security issues, enabling you to monitor, analyze, and remediate them effectively. The Issues page lists these issues, providing important information such as severity, endpoint count, and OWASP category.
## What will you learn in this topic?
By the end of this topic, you will be able to:
* The issue flow navigation and drill down into each issue to access its evidence, context, and logs.
* The status of issues and remediation methods.
* The Issue auto-resolution and deletion logic.
Refer to the [Issues Overview](/web-application-and-api-protection-waap/application-security-testing/ast-basics-and-workflow/ast-issues-overview.md) to understand issues, their lifecycle, and their key components.
***
## Navigate the issues flow
When you first land on the [Issues](/web-application-and-api-protection-waap/application-security-testing/ast-basics-and-workflow/ast-issues-overview.md) page, Traceable shows a list of detected issues, grouped by their name. This list displays key information, including Severity, Last Seen, and the Number of API Endpoints where the issue was observed. The grouping and filtering options enable you to narrow your focus based on a specific indicator. After applying these options, you can drill down into a specific issue to view more detailed information, such as Overview, References, and Status Log.
You can view the evidence for a particular issue for deeper analysis of the data, including its URL, status code, last seen, mutations, and assertions. The Detailed View page for an issue is divided into sections that offer data, logs, and insights that help you understand its impact on your application.
### 1. Main issues view
Upon navigating to the Issues page, Traceable displays a comprehensive list of issues in the *Open* or *Reopened* state. This page serves as a dashboard where you can:
Issues View
* **View listed issues** — Each issue is presented with details, such as its severity and the number of endpoints it was observed in. For more information, see [Issue Listings](/web-application-and-api-protection-waap/application-security-testing/ast-basics-and-workflow/ast-issues-overview.md#issue-listings).
* **Group and filter** — While Traceable groups the data on the page based on **Issue Names** by default, you can group the data based on other categories as well. Additionally, you can filter data based on the issue's impact or your specific requirements. For more information, see [Grouping and Filtering Options](/web-application-and-api-protection-waap/application-security-testing/ast-basics-and-workflow/ast-issues-overview.md#filters).
### 2. Drill down into an issue
After choosing how to group and filter the issues, you can drill down into a specific issue for a more granular view. Based on the grouping, click a list item to view the issues under it, and then click the **Issue Name**. The detailed view page highlights the following information about the issue:
* **Issue Details** — The top section of the page provides details about the issue, including the Endpoint, Source, Last Seen, Severity, CVSS Score, OWASP Rank, and CWE Rank. Using these details, you can take the necessary steps to mitigate such issues and enhance your application security.
* **Overview** — The Overview section describes the issue, its impact, the attack methodology, and how to mitigate it. Traceable also provides you with the Issue Evidence for you to drill down on.\
If you have enabled [AI Features](https://docs.traceable.ai/docs/ai-features) in your account, Traceable shows **AI Generated Insights** along with the Evidence in the **Overview** section. These insights are context-sensitive, and you can use them to analyze, prioritize issues, and work towards their remediation.
AI Generated Insight
For each issue detected using AST, Traceable displays the following evidence:
* Assertions and Mutations applied by Traceable as part of the scan. You can also customize these according to your requirements. For more information, see [Mutation and Assertion Overrides](/web-application-and-api-protection-waap/application-security-testing/advanced-usage/mutation-and-assertion-overrides.md).
* The Headers, Cookies, and Body in the Request and Response of the API endpoint.
For issues detected by AI scan policies, Traceable displays the evidence as a conversation that triggered the vulnerability. For information on setting up an AI scan, see [AI Security Testing](https://docs.traceable.ai/docs/ai-security-testing).
AI Issue Evidence
* **References** — The References tab provides curated links to trusted external sources where you can gather deeper insights into an issue's nature, impact, and remediation. This tab helps you understand key details about the issue, such as the attack mechanism and its effects, which you can use to inform remediation.
* **Status Log** — The Status Log tab provides a timeline of all status changes for the issue, including timestamps and updates. This helps you track the issue lifecycle and understand when and how the issue was opened, reopened, or fixed.
* **Remediation** — Based on the above details, you can take the necessary actions to remediate the issue. Traceable provides the following options for you to do so:
* **Integrations** — Traceable supports multiple integrations for you to choose from. You can use either of these to create tickets in your corresponding projects and work towards their remediation. For more information, see [Integrations](https://docs.traceable.ai/docs/integrations-2).
* **Status Change** — Use the drop-down to change an issue's status as needed. When changing the status, Traceable also displays a pop-up window where you can add a comment for the status change. This helps you maintain a log of historical events related to the issue. Further, this comment is visible in the **Status Log** tab of the issue where you changed the status. For more information on the available statuses, see [Issue Status Management and Remediation](#issue-status-management-and-remediation).
* **Create Virtual Patch** — Virtual patching enables you to apply a temporary Web Application Firewall (WAF) rule to an API endpoint where API Security Testing (APIST) has detected a vulnerability, without waiting for a code-level fix. Traceable scopes an existing WAF threat rule to the affected endpoint, so it can monitor or block the exact attack pattern the scan identified while your team resolves the underlying issue.
**Why virtual patching matters**
Fixing a code-level vulnerability can take days or weeks, and the endpoint stays exposed until it does. It is useful in the following ways:
* It allows you to apply protection directly from the Issues page.
* It enables Traceablet to scope an existing WAF rule to only the affected endpoint.
* It allows you to choose *Monitor* mode or *Blocking* mode.
**How virtual patching works**
Virtual patching lets you mitigate an eligible vulnerability at the affected API endpoint without waiting for a permanent code-level fix. When an issue detected by API Security Testing meets the eligibility requirements, Traceable lets you create a virtual patch directly from the issue.
The virtual patch workflow consists of the following steps:
Granular drill-down of an issue
1. **Detection** — API Security Testing detects a vulnerability and creates an issue for the affected API endpoint.
2. **Eligibility evaluation** — Traceable evaluates whether the issue is eligible for virtual patching. It also checks your environment's protection state, including whether a WAF is deployed and whether a matching WAF rule is already enabled.
3. **Patch availability** — If the issue meets the eligibility requirements, Traceable displays the **Create Virtual Patch** action on the issue.
4. **Create the virtual patch** — From the issue, select **Create Virtual Patch** and review the WAF rule and endpoint details before applying the patch.
5. **Track the patch** — Traceable links the virtual patch to the source issue and WAF rule. You can use this linkage to track how frequently the rule is evaluated, detects matching traffic, and blocks requests.
**Steps to create a virtual patch**
To create a virtual patch for an eligible issue, complete the following steps:
Create a Virtual Patch
1. Navigate to **Testing** → **Issues**.
2. Select the issue for which you want to create a virtual patch.
3. Click **Create Virtual Patch**.
4. Select the **Threat Type** and **Threat Rules**.
5. Select the **Action** you wish to take. For example, M*onitor* or *Block.*
6. Select **Create**.
7. Verify that the patch is active and scoped to the intended endpoint. For more information, see [Custom Signatures](https://docs.traceable.ai/docs/custom-signatures).
The following demo walks you through the steps to create a virtual patch in the issues page under Testing:
***
## Issue status management and remediation
Traceable enables you to create integration tickets and change the status according to your requirements for issue remediation.
#### **Supported Statuses**
You can manually change the state of the detected issue to any of the following:
| State | Description |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Open** | Traceable has detected an issue. |
| **Under review** | The issue has been acknowledged. You are taking steps to remediate it. |
| **Fixed** | The issue has been closed. Traceable continues to monitor the asset (API endpoint or service) even after you mark it as fixed. If Traceable finds new issues, it automatically moves them to the *Reopened* state for you to review and resolve. |
| **Not an issue** | Move the issue to a *Not an Issue* state when you do not want Traceable to report it. If Traceable continues to see this issue category, it does not move it to an open state. |
| **Accepted risk** | You can move the issue to this state when you understand and accept the impact. |
| **Reopened** | Traceable has rediscovered an issue. This typically occurs when an issue previously marked as *Fixed* or *Not an Issue* is detected again during subsequent scans. |
#### Issue remediation
You can update the status or create integration tickets using either of the following methods:
* **Individual Update** — Update the status or create tickets for each issue individually.
* **Bulk Update** — Update the status or create tickets for multiple issues at once.
The following tabs outline the steps for the methods above:
{% tabs %}
{% tab title="Individual Update" %}
To remediate an issue, complete the following steps:
1. If the **Issues** page is grouped by a category, click the arrow corresponding to the category.
2. Click the issue name you wish to remediate.
3. In the **Issue Detailed View** page’s top right corner, click the **Integration** icon(s) or **Status** drop-down according to your requirements.
If you have not configured an integration, you can do so directly by clicking the relevant Integration icon. For the configuration steps, see the corresponding document under Integrations.
4. Do one of the following:
* If you clicked the **Integration** icon(s), specify the ticket details according to your requirements.
* If you clicked the **Status** drop-down, change the status, and add the comment in the pop-up window according to your requirements. This helps you maintain a log of historical events related to the issue. Further, the comment is visible in the **Status Log** tab of the Issue’s Detailed View.
You can remediate multiple issues at once by performing a bulk update. This includes changing the issue status in Traceable or creating Jira tickets for multiple issues simultaneously.
### Step 1: Select Issues
1. Navigate to the **Issues** page.
2. Use filters or grouping as needed to narrow down the list.
3. Select the checkboxes next to the issues that you wish to update.
### Step 2: Perform Bulk Action
At the bottom of the page, click one of the following options:
* **Update Status** - to update the status of the selected issues within Traceable.
* **Jira icon** - to create Jira tickets for the selected issues.
Issues Bulk Update
{% hint style="info" %}
**Note**
* Bulk ticket creation is currently supported only for the Jira integration.
* You must have an existing Jira integration configured to create tickets. If not already configured, clicking the Jira icon will prompt you to complete the integration setup. For configuration steps, see [Jira Integration](http://docs/jira).
{% endhint %}
***
### Updating Issue Status in Bulk
When you click **Update Status**, a pop-up window appears where you can:
* Select the new status for the selected issues.
* Optionally add a comment describing the change.
The status change is reflected in the **Status Log** tab of each issue. Additionally, if the issues are linked to Jira tickets, the status update is synchronized with Jira through Traceable’s bidirectional sync feature.
Issue Status Log
***
### Creating Jira Tickets in Bulk
When you click the **Jira** icon, a ticket creation dialog is displayed. This dialog allows you to specify the project and issue type for the Jira tickets. You can choose between two modes:
* **Single Ticket**\
Creates one Jira ticket that includes information for all the selected issues. The summary and description fields are populated with a combined view of the selected issues.
* **Separate Tickets**\
Creates an individual Jira ticket for each selected issue. Each ticket contains information specific to one issue. You can preview and customize each ticket before submitting.
***
### Handling Issues Already Linked to Jira
If one or more of the selected issues are already linked to Jira tickets, you are presented with two options:
* **Ignore linked issues** – Jira tickets will be created only for issues that are not currently linked.
* **Unlink and create new** – Existing Jira links will be removed, and new tickets will be created for all selected issues, including those previously linked.
***
### Additional Consideration
When creating Jira tickets in bulk, you can also update the issue status using the **Update Status** option from the same selection view. This bulk update action is fully compatible with the bidirectional sync functionality between Traceable and Jira, ensuring that updates made in Traceable are reflected in Jira and vice versa.
{% endtab %}
{% tab title="Bulk Update" %}
To remediate an issue, complete the following steps:
1. If the **Issues** page is grouped by a category, click the arrow corresponding to the category.
2. Click the issue name you wish to remediate.
3. In the **Issue Detailed View** page’s top right corner, click the **Integration** icon(s) or **Status** drop-down according to your requirements.
If you have not configured an integration, you can do so directly by clicking the relevant Integration icon. For the configuration steps, see the corresponding document under Integrations.
4. Do one of the following:
* If you clicked the **Integration** icon(s), specify the ticket details according to your requirements.
* If you clicked the **Status** drop-down, change the status, and add the comment in the pop-up window according to your requirements. This helps you maintain a log of historical events related to the issue. Further, the comment is visible in the **Status Log** tab of the Issue’s Detailed View.
You can remediate multiple issues at once by performing a bulk update. This includes changing the issue status in Traceable or creating Jira tickets for multiple issues simultaneously.
### Step 1: Select Issues
1. Navigate to the **Issues** page.
2. Use filters or grouping as needed to narrow down the list.
3. Select the checkboxes next to the issues that you wish to update.
### Step 2: Perform Bulk Action
At the bottom of the page, click one of the following options:
* **Update Status** - to update the status of the selected issues within Traceable.
* **Jira icon** - to create Jira tickets for the selected issues.
Issues Bulk Update
{% hint style="info" %}
**Note**
* Bulk ticket creation is currently supported only for the Jira integration.
* You must have an existing Jira integration configured to create tickets. If not already configured, clicking the Jira icon will prompt you to complete the integration setup. For configuration steps, see [Jira Integration](http://docs/jira).
{% endhint %}
***
### Updating Issue Status in Bulk
When you click **Update Status**, a pop-up window appears where you can:
* Select the new status for the selected issues.
* Optionally add a comment describing the change.
The status change is reflected in the **Status Log** tab of each issue. Additionally, if the issues are linked to Jira tickets, the status update is synchronized with Jira through Traceable’s bidirectional sync feature.
Issue Status Log
***
### Creating Jira Tickets in Bulk
When you click the **Jira** icon, a ticket creation dialog is displayed. This dialog allows you to specify the project and issue type for the Jira tickets. You can choose between two modes:
* **Single Ticket**\
Creates one Jira ticket that includes information for all the selected issues. The summary and description fields are populated with a combined view of the selected issues.
* **Separate Tickets**\
Creates an individual Jira ticket for each selected issue. Each ticket contains information specific to one issue. You can preview and customize each ticket before submitting.
***
### Handling Issues Already Linked to Jira
If one or more of the selected issues are already linked to Jira tickets, you are presented with two options:
* **Ignore linked issues** – Jira tickets will be created only for issues that are not currently linked.
* **Unlink and create new** – Existing Jira links will be removed, and new tickets will be created for all selected issues, including those previously linked.
***
### Additional Consideration
When creating Jira tickets in bulk, you can also update the issue status using the **Update Status** option from the same selection view. This bulk update action is fully compatible with the bidirectional sync functionality between Traceable and Jira, ensuring that updates made in Traceable are reflected in Jira and vice versa.
{% endtab %}
{% endtabs %}
***
## Issue auto-resolution
While you can resolve an issue by changing its status to *Fixed*, Traceable also auto-resolves it. The following table lists the scenarios in which Traceable auto-resolves an issue detected via scans:
* Traceable has not detected the issue in 60 days since its last occurrence.
* Traceable has not detected the issue in 15 scans since its last observation.
{% hint style="info" %}
The updated status of the auto-resolved issues may take up to 24 hours to reflect on the Traceable platform.
{% endhint %}
***
## Issue deletion
You can delete detected issues from the [Issue Detailed View](https://docs.traceable.ai/docs/issue-management#2-drilling-down-into-an-issue) by changing their status to *Fixed* or *Not an issue*. Traceable also deletes issues if they are deleted from all Sources. For example, let us say an issue has *AST* and *Live Traffic* as the Source. Then, Traceable deletes the issue when it is deleted from both Sources.