docs(output): document EPSS Priority Signal in reading output and HTML report guides - #1072
Conversation
sonukapoor
left a comment
There was a problem hiding this comment.
Thanks for picking this up, @RohithPariki - good initiative, and the overall direction is right.
Since this is still a draft, flagging a couple of factual corrections to address before marking it ready:
html-report.md: "highlighted in red for top 10%" is not quite right. The EPSS percentile cell gets a purple/violet highlight for the top 10% threshold - not red. Red is used for the Fix Now badge itself. Worth updating to "highlighted" or "highlighted in purple" to match what actually renders.
reading-output.md: The badge renders as ⚡ Fix Now with no brackets. The [⚡ Fix Now] formatting adds brackets that are not in the actual output - swap to backtick-quoted `⚡ Fix Now` to match exactly.
Minor: "lower exploitation activity" in the Fix Soon and Low Priority tier descriptions is slightly looser than the implementation's "EPSS not in top 10%" - up to you whether to tighten that wording.
sonukapoor
left a comment
There was a problem hiding this comment.
All three points addressed - looks accurate now. Merging.
|
Merged - thank you @RohithPariki! |
What changed and why
With the introduction of the EPSS Priority Signal (#1067), findings are classified into actionable priority tiers (
Fix Now,Fix Soon,Monitor,Low Priority) across terminal output, JSON, and HTML reports.While
cli-reference.mdwas updated in #1067,reading-output.mdandhtml-report.mdwere missing documentation for these newly added features and columns:website/docs/reading-output.md:Fix Nowbadge in compact mode.EPSS(raw exploitation percentile) andEPSS Priority(four actionable tiers) columns.Fix Nowfindings first alongside critical/high command groups.website/docs/html-report.md:EPSSpercentile andEPSS Prioritycolumns.Closes #1071