Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DOCS-467, 468] Pentest collaboration preferences #384

Open
wants to merge 12 commits into
base: main
Choose a base branch
from
6 changes: 3 additions & 3 deletions content/en/Getting started/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,13 +22,13 @@ Take your first steps to get started:
<a class="btn btn-outline-primary rounded" href="/getting-started/pentest-preparation/">Pentest Preparation Checklist »</a>

- **Make your teams aware of the upcoming pentest**.
- Notify everyone who should be aware of the pentest. Ensure that the pentest doesnt disrupt anyones workflows.
- Notify everyone who should be aware of the pentest. Ensure that the pentest doesn't disrupt anyone's workflows.
- Prepare credentials and account details for pentesters.
- **Be responsive to pentest results**.
- Pentesters will share vulnerabilities ([findings](/platform-deep-dive/pentests/findings/)) that they discover in real time. Start remediating them. [Collaborate on the pentest](/platform-deep-dive/collaboration/collaborate-on-pentests/) and ask questions if you need help.
- Pentesters will share vulnerabilities ([findings](/platform-deep-dive/pentests/findings/)) that they discover in real time. Start remediating them. [Collaborate on the pentest](/platform-deep-dive/collaboration/collaborate-on-pentests/), and ask questions if you need help.
- **Be available to help find solutions to problems**.
- Most of the time pentesters are cautious and don't perform any actions that have detrimental effects on your software. However, as a precautionary measure, you should prepare for the worst. Prepare a backup copy of your software (especially when testing a production environment), and have a team ready to respond to any unexpected events.
- Establish communication with pentesters in [Slack](/platform-deep-dive/collaboration/collaborate-on-pentests/#use-slack-for-communication), and let them know you are there—available and responsive.
- Establish communication with pentesters, and let them know you are there—available and responsive.
- **Communicate significant changes to your environment made during a test to pentesters**.
- If you make significant changes to your environment during a test (including remediating vulnerabilities), make sure to communicate this to our pentesters. Any major updates to your asset that you make when the pentest is Live may impact pentesters' workflows and the testing process.

Expand Down
11 changes: 11 additions & 0 deletions content/en/Getting started/planning.md
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,17 @@ Once you've identified the [pentest scope](#scope-the-pentest), you can see the

You can see the final number of required credits when the pentest is Planned, after we review your pentest request.

## Select a Collaboration Platform

Select where you want to collaborate with Cobalt Staff and pentesters:

- Cobalt Chat
- Slack

You can change your preference until the pentest is Planned. Learn more about [collaborating on a pentest](/platform-deep-dive/collaboration/collaborate-on-pentests/).

![Select a collaboration platform when setting up a pentest](/deepdive/select-collaboration-platform.png "Select a collaboration platform when setting up a pentest")

## Assign a Point of Contact

Cobalt Staff may reach out to the point of contact with questions regarding the pentest.
Expand Down
8 changes: 3 additions & 5 deletions content/en/Getting started/what-to-expect.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,9 @@ results. Here's what you can expect:
pane. You should see your pentest listed, with an [In Review](/platform-deep-dive/pentests/pentest-process/pentest-states/) label.
1. We'll select the best available pentesters before the start of the pentest. The time we need
depends on your {{% ptaas-tier %}} and any [additional requests](/getting-started/review-pentest/#additional-requests) you have.
1. Once our pentesters start the pentest, they'll update you on their progress. You can [collaborate on the pentest](/platform-deep-dive/collaboration/collaborate-on-pentests/) using the following communication channels:
- {{% beta-label %}} [Messaging in the Cobalt app](/platform-deep-dive/collaboration/collaborate-on-pentests/#collaborate-in-the-cobalt-app). Select **Messages** on the pentest page. In the sidebar that opens, you can read updates from pentesters and communicate in the chat.
<!--![Collaborate on a pentest in the Messages sidebar](/deepdive/MessagesSidebar.png "Collaborate on a pentest in the Messages sidebar")-->
- A [Slack channel](/platform-deep-dive/collaboration/collaborate-on-pentests/#use-slack-for-communication) dedicated for your pentest.
- [**Pentester Updates** sidebar](/platform-deep-dive/collaboration/collaborate-on-pentests/#read-updates-from-pentesters) in the Cobalt app.
1. Once our pentesters start the pentest, they'll update you on their progress. Depending on the [collaboration platform](/platform-deep-dive/collaboration/collaborate-on-pentests/) you selected, you can communicate in:
- [Cobalt Chat](/platform-deep-dive/collaboration/collaborate-on-pentests/#collaborate-through-cobalt-chat); or
- [Slack channel](/platform-deep-dive/collaboration/collaborate-on-pentests/#use-slack-for-communication) dedicated for your pentest.
1. You may get questions from your pentesters. You can also elaborate
on your requirements for the pentest.
1. As our pentesters analyze your asset, they'll add updates frequently. If they discover vulnerabilities ("[findings](/platform-deep-dive/pentests/findings/)"), you can start
Expand Down
2 changes: 1 addition & 1 deletion content/en/PMP/complete-pentest.md
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ Start testing the asset. Use techniques and tools appropriate for the asset type

### Collaborate on the Pentest

Communicate with pentesters and [Pentest Team Members](/getting-started/glossary/#pentest-team-member) in the chat throughout a pentest. To open the chat, select the chat icon ![Chat icon](/icons/Chat.png "Chat icon") on the pentest page.
Collaborate with pentesters and [Pentest Team Members](/getting-started/glossary/#pentest-team-member) through Cobalt Chat. To open the chat, select the chat icon ![Chat icon](/icons/Chat.png "Chat icon") on the pentest page.

Use the chat to:

Expand Down
6 changes: 3 additions & 3 deletions content/en/PMP/manage-pentests.md
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ To launch an In-House Pentest:
If a user is already a Team Member on the pentest, you can change their role to In-House Pentester.<br><br>
![Switch a user's role to In-House Pentester](/pmp/switch-role-to-in-house-pentester.png "Switch a user's role to In-House Pentester")
1. When ready, select **Launch Pentest**. Your pentest goes Live.
- To launch a pentest, you need to assign at least one In-House Pentester.
- To launch a pentest, you need to assign at least one In-House Pentester.

Once the pentest goes Live, pentesters can start testing your asset. You can track the progress in real time.

Expand Down Expand Up @@ -110,9 +110,9 @@ As a [Pentest Team Member](/getting-started/glossary/#pentest-team-member), you

As an Organization Owner or Member, you automatically become a Pentest Team Member on all organization's pentests, unless someone (including yourself) removes you.

### Communicate in the Chat
### Collaborate through Cobalt Chat

Communicate with pentesters and team members in the chat throughout a pentest. To open the chat, select the chat icon on the pentest page.
Collaborate with pentesters and team members through Cobalt Chat. To open the chat, select the chat icon ![Chat icon](/icons/Chat.png "Chat icon") on the pentest page.

![Open the pentest chat](/pmp/open-the-pentest-chat.png "Open the pentest chat")

Expand Down
2 changes: 0 additions & 2 deletions content/en/Platform Deep Dive/Collaboration/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,5 +11,3 @@ Work with our pentesters and your team members on pentests.
{{% /pageinfo %}}

Make sure you add the right people from your organization to a pentest. You can discuss pentest details and follow up on [findings](/platform-deep-dive/pentests/findings/) together. To learn more, see [Collaborate on Pentests](/platform-deep-dive/collaboration/collaborate-on-pentests/).

As an [Organization Owner](/getting-started/glossary/#organization-owner), you can [manage users](/platform-deep-dive/organization/manage-users/) and [adjust settings](/platform-deep-dive/organization/organization-settings/) for your organization.
Original file line number Diff line number Diff line change
Expand Up @@ -7,60 +7,65 @@ description: >
---

{{% pageinfo %}}
Collaborate with pentesters, your teammates, and Cobalt Staff throughout the pentest.
Collaborate with pentesters, your teammates, and Cobalt Staff throughout a pentest.
{{% /pageinfo %}}

You can use the following communication channels:

- {{% beta-label %}} [Messaging in the Cobalt app](#collaborate-in-the-cobalt-app)
- A [Slack channel](#use-slack-for-communication) dedicated for your pentest
- [**Pentester Updates** sidebar](#read-updates-from-pentesters) in the Cobalt app

As our pentesters test your asset, they update you on their progress in real time. Here's what to expect:

- Pentesters report vulnerabilities that they discover in your software.
- You may get questions from our pentesters.
- You can submit comments to pentesters and your teammates.
- [Cobalt Staff](/getting-started/glossary/#cobalt-staff) members may get in touch to ask you for help.

## Collaborate in the Cobalt App
## Collaboration Platforms

When you set up a pentest, you can [select](/getting-started/planning/#select-a-collaboration-platform) where you want to collaborate with Cobalt Staff and pentesters:

- [Cobalt Chat](#collaborate-through-cobalt-chat):
- You can send messages through the Cobalt platform.
- You don't have access to the Slack channel dedicated for your pentest.
- [Slack](#use-slack-for-communication):
- We invite you to the Slack channel dedicated for your pentest.
- You have read-only access to Cobalt Chat, but you can't send messages.

{{< pageinfo >}}
<p>{{% beta-label %}}</p><p>To enable this feature, contact {{< csm-support-link >}}.</p>
{{< /pageinfo >}}
You can change your preference until the pentest is Planned.

Communicate with pentesters and [pentest collaborators](/platform-deep-dive/collaboration/user-roles/) in the Cobalt platform, without using third-party tools.
You can also read real-time [updates from pentesters](#read-updates-from-pentesters) in the Cobalt app, regardless of where you collaborate on the pentest.

Navigate to **Pentests**, select a pentest, and then select the chat icon ![Chat icon](/icons/Chat.png "Chat icon").
### Collaborate through Cobalt Chat

If you selected **Cobalt Chat** as your collaboration platform, you can communicate with pentesters and [pentest collaborators](/platform-deep-dive/collaboration/user-roles/) in the Cobalt app, without using third-party tools. You don't have access to the pentest Slack channel.

On the pentest page, select the chat icon ![Chat icon](/icons/Chat.png "Chat icon"), and then select **Chat** in the sidebar that opens.

![Collaborate on a pentest in the Messages sidebar](/deepdive/OpenMessagesSidebar.png "Collaborate on a pentest in the Messages sidebar")

In the sidebar that opens, you can see two tabs:
Use the chat to communicate with pentesters, pentest collaborators, and [Cobalt Staff](/getting-started/glossary/#cobalt-staff) in real time.

- **Pentester Updates**: Read updates from our pentesters as they test your [asset](/platform-deep-dive/assets/). On this tab, you can only view what pentesters posted. To start a conversation, go to the **Chat** tab.<br>
![Read updates from pentesters on the Pentester Updates tab](/deepdive/MessagesPentesterUpdates.png "Read updates from pentesters on the Pentester Updates tab")
- **Chat**: Communicate with pentesters, pentest collaborators, and [Cobalt Staff](/getting-started/glossary/#cobalt-staff) in real time.
- To send a message, enter it in the input field, and then select **Comment**.
- To mention a user in your message, type @, and select a user. Users get email notifications for each mention.
- You can add emoji to your messages.
- You can edit or delete your comments once posted.<br>
![Use the chat to communicate on a pentest](/deepdive/MessagesChat.png "Use the chat to communicate on a pentest")
- To send a message, enter it in the input field, and then select **Comment**.
- To mention a user in your message, type @, and select a user. Users get email notifications for each mention.
- You can add emoji to your messages.
- You can edit or delete your comments once posted.

![Use Cobalt Chat to collaborate on a pentest](/deepdive/MessagesChat.png "Use Cobalt Chat to collaborate on a pentest")

As our pentesters share vulnerabilities that they find in real time, you can start [remediating findings](/platform-deep-dive/pentests/findings/remediate-findings/) before the pentest is complete. Review and analyze each [finding](/platform-deep-dive/pentests/findings/). You can:

{{% process-findings %}}

## Use Slack for Communication
### Use Slack for Communication

If you selected **Slack** as your collaboration platform, you can communicate with pentesters and your teammates in a Slack channel dedicated for your pentest. You also have read-only access to [Cobalt Chat](#collaborate-through-cobalt-chat), but you can't send messages.

You can communicate with pentesters and your teammates in a Slack channel dedicated for your pentest. To learn more about Slack channels, read the [Slack documentation](https://slack.com/intl/en-gb/help/articles/360017938993-What-is-a-channel).
To learn more about Slack channels, read the [Slack documentation](https://slack.com/intl/en-gb/help/articles/360017938993-What-is-a-channel).

{{< alert title="Note" color="primary" >}}
The Slack channel is available until your pentest is [Closed](/platform-deep-dive/pentests/pentest-process/pentest-states/).
{{< /alert >}}

The image below illustrates how to use Slack throughout a pentest.

![Communicate in Slack throughout a pentest](/deepdive/PentestFlowSlack.png "Communicate in Slack throughout a pentest")
![Communicate in Slack throughout a pentest](/deepdive/pentest-flow-Slack.png "Communicate in Slack throughout a pentest")

1. Once we move your pentest to [In Review](/platform-deep-dive/pentests/pentest-process/pentest-states/), we create a dedicated Slack channel. On the pentest page, select the Slack icon ![Slack icon](/icons/Slack.png "Slack icon"), and then select **Open Slack Channel #**.
- If you don't have access to the Slack channel, contact {{% csm-support %}}.
Expand All @@ -78,8 +83,8 @@ The image below illustrates how to use Slack throughout a pentest.

## Read Updates from Pentesters

Read updates from our pentesters as they test your [asset](/platform-deep-dive/assets/).
You can read updates from our pentesters as they test your [asset](/platform-deep-dive/assets/), regardless of where you collaborate on the pentest.

Navigate to **Pentests**, select a pentest, and then select the chat icon ![Chat icon](/icons/Chat.png "Chat icon"). You can view messages from pentesters in the sidebar that opens.
On the pentest page, select the chat icon ![Chat icon](/icons/Chat.png "Chat icon"). You can view messages from pentesters in the sidebar that opens, on the **Pentester Updates** tab.

![Read updates from pentesters in the Cobalt app](/deepdive/OpenPentesterUpdates.png "Read updates from pentesters in the Cobalt app")
![Read updates from pentesters on the Pentester Updates tab](/deepdive/MessagesPentesterUpdates.png "Read updates from pentesters on the Pentester Updates tab")
Original file line number Diff line number Diff line change
Expand Up @@ -16,17 +16,17 @@ for that pentest. We've set up these definitions as if you've set up the pentest
through our user interface.
<br><br>

![Pentest states](/deepdive/PentestStates.png "Pentest states")
![Pentest states](/deepdive/Cobalt-pentest-states.png "Pentest states")

Here's the meaning of each label:

| Label | Description |
|-------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Draft | You've started the **Create a Pentest** process. However, you may not have added the information that we need to start work on your pentest. |
| In Review | You've submitted the pentest. We're reviewing your submission. We may have questions for you. This status does not apply to [In-House Pentests](/getting-started/glossary/#in-house-pentest). |
| Planned | We've accepted your proposed pentest. We'll assign pentesters based on your technology stacks and methodology. You should also have access to a Slack channel dedicated to your pentest. |
| Live | We've started working on your pentest. Use the pentest chat channel to communicate directly with your pentesters. When we have questions and discover [findings](/getting-started/glossary/#finding), we'll share them in the channel. |
| Paused | We're unable to continue the pentest. You should see a reason in the Slack channel associated with your pentest. This status does not apply to [In-House Pentests](/getting-started/glossary/#in-house-pentest). |
| Planned | We've accepted your proposed pentest. We'll assign pentesters based on your technology stacks and methodology. |
| Live | We've started working on your pentest. Pentesters report [findings](/getting-started/glossary/#finding) and may ask questions. [Collaborate](/platform-deep-dive/collaboration/collaborate-on-pentests/) with pentesters and your teammates. |
| Paused | We're unable to continue the pentest. You should see a reason in the pentest chat or Slack. This status does not apply to [In-House Pentests](/getting-started/glossary/#in-house-pentest). |
| Remediation | We've completed and shared the results of our pentest, including our vulnerability findings. You can either accept or [remediate](/getting-started/glossary/#remediate) each vulnerability. Once complete, resubmit your request. We'll retest your asset. |
| Closed | You may have accepted our findings. Or we've retested each of our findings, and cannot reproduce them. We may have not found any vulnerabilities, or you've accepted any vulnerabilities that we've found. |
| Cancelled | If you no longer need a pentest, you're always welcome to cancel it. We'll keep the pentest in our records in case you change your mind. |
Expand Down
Binary file added static/deepdive/Cobalt-pentest-states.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed static/deepdive/PentestFlowSlack.png
Binary file not shown.
Binary file removed static/deepdive/PentestFlowWithSlack.png
Binary file not shown.
Binary file removed static/deepdive/PentestStates.png
Binary file not shown.
Binary file modified static/deepdive/SampleSlackFinding.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/deepdive/pentest-flow-Slack.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/deepdive/select-collaboration-platform.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.