Previous Releases on Documentation - V2

2.10

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version	Summary of content	Comments
2.10.0-funcrel	Updates: Removal of violations from the Action Plan and Scheduled Exclusion list using the Rules Violation table Convertion of an action item into an exclusion Automatic assignment of NO_ROLE, when a new profile is created Minor UI updates for the CAST Dashboard Administration panel Contains customer bug fixes	Can be used with: ≥ 8.3.3

Version

Summary of content

Comments

2.10.0-funcrel

Updates:

Removal of violations from the Action Plan and Scheduled Exclusion list using the Rules Violation table
Convertion of an action item into an exclusion
Automatic assignment of NO_ROLE, when a new profile is created
Minor UI updates for the CAST Dashboard Administration panel
Contains customer bug fixes

Can be used with:

≥ 8.3.3

2.10.0-funcrel

Feature Improvements

Summary	Details
UI - Security Dashboard - Converting an action item into an exclusion	In the rules violation table (available in the Risk Investigation, Application Investigation, Transaction Investigation and Advanced Search pages), it is now possible to move a violation that is already in the Action Plan list into the Scheduled Exclusion list using the “Manage > Manage exclusion of the violations” option. In previous releases it was only possible to do this directly using the Scheduled Exclusion list. See https://doc.castsoftware.com/display/SECURITY/Security+Dashboard+-+Exclusions#SecurityDashboardExclusions-ViatheRiskInvestigation,ApplicationInvestigation,TransactionInvestigationandAdvancedSearchviews.
UI - User Authorization roles - Read-only [NO_ROLE] role	The NO_ROLE role (read-only role) has now been made available for selection in the CAST Dashboard Administration panel for all Dashboards (in previous releases this role was not available for selection). When a new profile is created, the NO_ROLE role will be automatically assigned. See https://doc.castsoftware.com/display/DASHBOARDS/User+roles+-+2.x+and+above.
UI - Security Dashboard - Remove violations from the Action Plan and Scheduled Exclusion list using the Rules Violation table	In the rules violation table (available in the Application Investigation, Risk Investigation, Transaction Investigation and Advanced Search pages), it is now possible to remove violations from the Action Plan and the Scheduled Exclusion list using the “Manage > Remove from Action list” and the “Manage > Remove from Scheduled List” options. In previous releases it was only possible to remove violations directly using the Action Plan or the Scheduled Exclusion list. See https://doc.castsoftware.com/display/SECURITY/Security+Dashboard+-+Action+Plan#SecurityDashboardActionPlan-Removingviolations(objects)fromtheActionPlan and https://doc.castsoftware.com/display/SECURITY/Security+Dashboard+-+Exclusions#SecurityDashboardExclusions-removeRemovingviolations(objects)fromtheExclusionlist.
UI - User Authorization - Users/Groups panel - Remove SAML/LDAP users/groups	A remove option is now available for selected SAML/LDAP users/groups in the CAST Dashboard Administration panel for all Dashboards. See: https://doc.castsoftware.com/display/DASHBOARDS/User+roles+-+2.x+and+above#Userroles2.xandabove-Users/Groupspanel.
UI - User Authorization - Users/Groups panel - Search	A search option is now available in the column header for the Users/Groups panel in the CAST Dashboard Administration interface, allowing you to search for users/groups that have already been granted a profile. See: https://doc.castsoftware.com/display/DASHBOARDS/User+roles+-+2.x+and+above#Userroles2.xandabove-Users/Groupspanel.

Other Updates

Internal Id	Details
DASHBOARDS-4890	A change has been made to improve overall performance of the CAST Security Dashboard when a large number of domains are configured in the domains.properties file. This change is aimed at improving the loading time of the Home page and the Application selection page.
DASHBOARDS-4906	Fixes an issue where the diagnostic.html page was found to be accessible by users without the ADMIN role. Only users with the ADMIN role can now access this page.
DASHBOARDS-4864	Fixes an issue where the result of the “Check for update” option available in the UI was displaying incorrect information.

Resolved Issues

Customer Ticket Id	Details
38908	Fixes an issue where rules are duplicated (i.e. displayed twice) in the UI when the criticality of the rule (attached to new custom technical criterion) is changed.
38744	Fixes an issue causing some UI elements (the violations download icon) to be hidden when the “no license” warning banner is displayed in the UI.
39244	Fixes an issue causing an unsuitable error message to be displayed when logging in and a timeout occurs.
39389	Fixes a performance issue found in Security Dashboard. Due to multiple API calls performance was affected, after the fix the number of API calls is reduced.

AJS.$('[data-macro-name="markdown-from-url"] code').each(function(i, block) { hljs.highlightBlock(block); });``AJS.$('[data-macro-name="markdown-from-url"] .language-mermaid').each(function(i, block) { const config = { startOnLoad:true, theme: 'default', flowchart:{ useMaxWidth:false, htmlLabels:true } }; mermaid.initialize(config); window.mermaid.init(undefined, block); });

2.9

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version Summary of content Comments

2.9.1-funcrel

This release contains one feature enhancement which is specific to the CAST Health and Engineering Dashboards when embedded in CAST Console. There are no other new features provided and no changes for those using the standalone CAST Security Dashboard.

Can be used with:

≥ 8.3.3

2.9.0-funcrel

Updates:

Bug fix to resolve two CVE vulnerabilities found in CAST Dashboards, for CVE-2022-31160. Refer: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31160
Contains customer bug fixes

Can be used with:

2.8

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

2.8.0-funcrel

Updates:

UI improvements in the Report Generation page
Multi language support in Report Generation
Support for CWE Top25 2022 Compliance Reports and CWE Top25 2022 Detail PDF Reports
Contains customer bug fixes

Can be used with:

≥ 8.3.3

2.8.0-funcrel

Feature Improvements

Summary	Details
UI - Improvements to the Report Generation page	The Report Generation page has been re-designed to make it more user friendly. The changes will help users to sort and search the reports in the “Standard Compliance Report Category”. In the “Miscellaneous Reports” category, users can now view the details of the selected report on the same page. Refer: https://doc.castsoftware.com/display/SECURITY/Security+Dashboard+-+Report+Generation
UI - Report Generation - Multi language support	With the multi language support, reports can now be generated in the following languages - German, Italian, Spanish, French, and Chinese. Refer: https://doc.castsoftware.com/display/SECURITY/Security+Dashboard+-+Report+Generation#SecurityDashboardReportGeneration-Introduction
UI - Report Generation - Support for CWE Top25 2022 reports	Two new reports have been added: CWE Top25 2022 Compliance and CWE Top25 2022 Detail to provide data on the CWE TOP 25 2022 standard. Refer: https://cwe.mitre.org/top25/archive/2022/2022_cwe_top25.html.

Other Updates

Internal Id	Details
DASHBOARDS-4776	Fixes an issue related to “Log4j - 2.17.1” in the Dashboard for Console SE (present in cast-integrated-health-engineering-dashboard-for-console-se.jar).

Resolved Issues

Customer Ticket Id	Details
37136	Fixes an issue, where an error occurred while configuring LDAP with Dashboard.

2.7

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

2.7.0-funcrel

Updates:

Contains customer bug fixes

Can be used with:

≥ 8.3.3

2.7.0-funcrel

New Features

Summary

Details

Reports in PDF format

To simplify the deployment and configuration of the CAST Security Dashboard, Security Reports and Industry Compliance Reports will now be generated automatically in PDF format - rather than needing to rely on the installation and configuration of CAST Report Generator for Dashboards. See https://doc.castsoftware.com/display/SECURITY/Security+Dashboard+-+Report+Generation. Note that as a result of this change, the ability to generate Custom Reports has been disabled.

Other Updates

Internal Id	Details
DASHBOARDS-4658	Fixed an issue where checkboxes remained selected in the Profiles panel (Admin Center) after updating an authorization.

Resolved Issues

Customer Ticket Id	Details
36764	Fixed an issue where data is not loading in various violation sections when using a legacy format restricted license key and with normal read access.
36807	Fixed an issue where the Datamart process fails with the following error: “ERROR: duplicate key value violates unique constraint “app_violations_evolution_pkey””.
36710	Reduced the time to start up/restart the Dashboard when a large number of applications are present.

2.6

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version Summary of content Comments

2.6.3-funcrel

Updates:

Implementation of ''All Applications" option, which lets user to assign "All Applications" to multiple profiles or a single profile without adding any role.
Contains customer bug fixes for the Engineering Dashboard and the Health Dashboard

Can be used with:

≥ 8.3.3

2.6.2-funcrel

Updates:

Action Plan Recommendation documentation is updated with remediation effort details
Bug fix to resolve two CVE vulnerabilities found in CAST Dashboards, for CVE-2022-23457. Refer: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23457
Contains customer bug fixes

2.6.1-funcrel

Updates:

2.5

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version Summary of content Comments

2.5.2-funcrel

Updates:

When there is no data, all SD tiles will show N/A instead of loading icon so that the home page does not hang.
Pagination has been implemented in CAST Administration page (profiles and users tabs).
The .ICO file used in the Dashboards (visible in the browser tab) has been updated and improved.
In Action Plan, for Solved violations, the last snapshot date is displayed. For Added and Pending violations the last updated date is displayed.

Can be used with:

2.4

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version	Summary of content	Comments
2.4.3-funcrel	Bug fixes to resolve two CVE vulnerabilities found in CAST Dashboards: CVE-2021-45046 (for Apache Log4j) and CVE-2021-23463 (for h2database).	Can be used with: ≥ 8.3.3
2.4.2-funcrel	This version is not available.
2.4.1-funcrel	Bug fixes to resolve two CVE vulnerabilities found in CAST Dashboards: CVE-2021-44228 (for Apache Log4j) and CVE-2021-43466 (for OWASP).
2.4.0-funcrel	Roles and data authorizations: Roles and data authorizations feature moved from beta to functional release User Profile: In LDAP mode, if there is no search object, the user list is displayed based on the assigned profile/s

2.4.3-funcrel

Other Updates

Internal Id	Details
DASHBOARDS-4238	Upgrade Log4j to v 2.16 to resolve CVE-2021-45046. Refer: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046 and https://doc.castsoftware.com/display/CAST/Apache+Log4j+-+CVE+vulnerabilities (CAST documentation).
DASHBOARDS-4241	Update to fix CVE-2021-23463. Refer: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23463.

2.4.2-funcrel

Note

This version is not available.

2.3

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

2.3.1-funcrel

Enhancement in display for results generated by the OMG Technical Debt

Can be used with:

≥ 8.3.3

2.3.0-funcrel

UI - Improvements to the Roles/Data Authorization interface
Dashboard updated for the new release of the extension "OMG Technical Debt"

2.3.1-funcrel

Feature Improvements

Summary

Details

Support for new CTDM extension

Dashboard has been updated to provide improved display for results generated by the OMG Technical Debt extension, v 2.x (Refer: https://doc.castsoftware.com/display/TECHNOS/OMG-CTDM+-+2.0 ). The Security Dashboard now includes (out of the box) a “Technical Debt (OMG) tile. By default this tile shows ISO-5055 index data, but it can be manually configured to show TQI or CISQ Index data if necessary.

Other Updates

Internal Id	Details
DASHBOARDS-3950	Session alert dialog box displays the time left seconds in negative.

2.3.0-funcrel

New Features

Summary

Details

Dashboards updated in preparation for new release of the OMG Technical Debt extension

The Dashboards have been updated in preparation for a new release of the OMG Technical Debt extension which will measure Technical Debt using CTDM (Contextual Technical Debt Measure) - a union of AIP and ISO metrics.

UI - Improvements to the Roles/Data Authorization interface

The Roles and Data Authorization interface has been updated to include the ability to assign roles/data authorizations to a “Profile”. Profiles (containing the roles and data authorizations) are then assigned to users/groups directly. See https://doc.castsoftware.com/display/DASHBOARDS/User+roles+-+2.x+and+above and https://doc.castsoftware.com/display/DASHBOARDS/Data+authorization+-+2.x+and+above.

Other Updates

Internal Id	Details
DASHBOARDS-3926	Update (correct) the error message for “become admin” failure from other machine.
DASHBOARDS-3909	DATAMART: Fix USR_EXCLUSIONS extraction.
DASHBOARDS-3908	DATAMART: Optimize app-findings-measures extraction.

Resolved Issues

Customer Ticket Id	Details
32072	Dashboard is not accessible after setting a search filter in main page after login.
31584	Re-using the cast_dashboards schema across two dashboards is not working correctly.
31722	Dashboard fails to start when CSS is configured in SSL mode.

2.2

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

2.2.1-funcrel

Bug fixes

Can be used with:

≥ 8.3.3

2.2.0-funcrel

Bug fixes

Can be used with:

≥ 8.3.3

2.2.1-funcrel

Other Updates

Internal Id	Details
DASHBOARDS-3942	Integrated mode and zip - need to fix home page from FE.
DASHBOARDS-3906	Integrated mode and zip do not work any more.
DASHBOARDS-3933	Cannot PUT domains-bindings when all domains have been aborted.
DASHBOARDS-3940	AIP Console: Cannot display Dashboard with a JVM > 8.
DASHBOARDS-3927	DATAMART: Revert DIM_SNAPSHOTS table, internal_id Column.
DASHBOARDS-3909	DATAMART: Fix USR_EXCLUSIONS extraction.
DASHBOARDS-3908	DATAMART: Optimize app-findings-measures extraction.

2.2.0-funcrel

Other Updates

Internal Id	Details
DASHBOARDS-3304	Comment list is not filtered based on ‘Security’.
DASHBOARDS-3728	SD user admin page is showing wrong tab icon.
DASHBOARDS-3552	Session timeout dialog box appears when accessing the admin page through URL.
DASHBOARDS-3673	Issue in application selection and deselection when the applications have same name.
DASHBOARDS-3696	Applications are duplicated in assign application drop down list.
DASHBOARDS-3698	Implement session timeout option in user management view.
DASHBOARDS-3718	SAML: User is also getting removed from the list when clicking on remove button.
DASHBOARDS-3726	Admin user is able to delete the admin role and on reload - display become admin page even though user context has admin role.
DASHBOARDS-3729	SAML: User management view does not load the list and API server/users-groups returns 500 internal server error.
DASHBOARDS-3747	Regression: User management view is displaying the list from LDAP when logged in with default user.
DASHBOARDS-3751	User management: on unselect all tags/technology selected applications are vanishing.
DASHBOARDS-3760	‘Re-Login’ button is not enabled after the timeout and the page is getting redirected to login page.
DASHBOARDS-3794	LDAP: User search list is disappearing after assigning a role to any user
DASHBOARDS-3797	APO window is disappearing when changing the effort grade value to 4
DASHBOARDS-3806	Auth: Update button is disabled in edit dialog for SD, when technology and tags changes.
DASHBOARDS-3807	Auth regression: application selection has issue in edit dialog.
DASHBOARDS-3848	LDAP: User authorization view is empty after assigning a role to group.
DASHBOARDS-3789	The “spring.datasource.url” in the application.properties file (specifically for managing the connection to the host PostgreSQL host on which the “cast_dashboards” schema is stored), has been modified to add in “ApplicationName=DASHBOARDS”. This is to ensure that the application initiating the connection to the host PostgreSQL instance can be more easily identified.

Resolved Issues

Customer Ticket Id	Details
31162	Users/groups that have been specifically assigned a role/data authorization is not listed in user configuration page with ldap authentication.
31088	Advanced search view violation report is not giving correct module name for all module report.
31197	Unable to migrate roles/authorizations using the XML files.
31360	Data Authorization 2.1

2.1

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version Summary of content Comments

2.1.0-funcrel

A graphical user interface has been implemented for managing the assignment of role and data authorizations to users and groups of users.
In advanced search, six new filter criteria (Business Criteria Name, Technical Criteria Name, Technology Name, Module Name, Weight, Critical value) are added as columns in exported excel reports.

Can be used with:

≥ 8.3.3

2.0

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

2.0.0-funcrel

Support for SAML authentication mode in 2.x WAR and ZIP files
Microsoft Windows Service installer
Shutdown script for ZIP file deployment on Linux

Can be used with:

≥ 8.3.3

2.0.0-beta1

Dashboard 2.0 comes with ZIP files (along with WAR files), which allows you to install Dashboard without Tomcat.
Dashboard 2.0 comes with support for SSL connection
Contains customer bug fixes

2.0.0-funcrel

Feature Improvements

Summary	Details
Authentication - SAML	SAML authentication mode is now supported in 2.x WAR and ZIP files. See: https://doc.castsoftware.com/display/DASHBOARDS/User+authentication
Logging - SQL traces	In the 2.0.0-beta1 release, DEBUG and SQL traces were enabled by default, inflating the log file size. DEBUG and SQL traces are now disabled by default, however, they can be enabled if required. See: https://doc.castsoftware.com/display/DASHBOARDS/Configuring+the+Log+and+Audit+Trail#ConfiguringtheLogandAuditTrail-EnablingDEBUGandSQLtracelogs
Deployment - Microsoft Windows Service installer	A batch script is now available to install a Windows Service specifically to handle the startup and shutdown of the deployed ZIP files. Instructions are provided in the installation guide - for example for the Security Dashboard See: https://doc.castsoftware.com/display/SECURITY/Deploy+CAST+Security+Dashboard+using+ZIP+file#DeployCASTSecurityDashboardusingZIPfile-step4Step4-InstalltheMicrosoftWindowsServicetostart/stoptheapplicationserver-optional
Shutdown script for ZIP file deployment on Linux	A shutdown.sh script has been added for those deploying the ZIP files on Linux. For Microsoft Windows deployments not using a Microsoft Windows Service, use the CTRL+C keyboard option to gracefully stop the web application. See: https://doc.castsoftware.com/display/DASHBOARDS/Start+and+stop+2.x+ZIP+deployments

Other Updates

Internal Id

Details

DASHBOARDS-3419

The file hierarchy in the deployed ZIP files has been updated. All configuration files are now located in a folder called “configurations” at the root of the unpacked ZIP. All documentation has been updated to reflect this change.

DASHBOARDS-00000

The custom HTTP status code “470” returned by the RestAPI in v. 1.x when a request is attempted and the user is not authenticated has been changed to a standard “401” status code in v. ≥ 2.x. If you are relying on the RestAPI to return a 470 status when unauthenticated requests are attempted, you should update your custom application to use the 401 status instead. See also https://doc.castsoftware.com/display/DASHBOARDS/User+Session+Services+-+2.0#UserSessionServices2.0-Login.

Resolved Issues

Customer Ticket Id	Details
27297	When attempting to use the following AppMarq related RestAPI URL “AAD/datamart/app-health-evolution” an error is displayed “ERROR: duplicate key value violates unique constraint”.

2.0.0-beta1

New Features

Summary

Details

Dashboard architecture change in 2.x

Release 2.0.0-funcrel is the first release of the CAST Dashboards that will use Spring Boot technology. In the most basic terms, this means that it is now possible to deploy the CAST Dashboards without the need for a standalone web application server such as Apache Tomcat - the web application server is instead embedded within the delivered dashboard. This will simplify and speed up the deployment of the CAST Dashboards. See https://doc.castsoftware.com/display/DASHBOARDS/2.0#id-2.0-Dashboardarchitecturechangein2.x.

SSL connection to PostgreSQL instance

It is now possible to configure the dashboards to connect to use an SSL encrypted connection to a PostgreSQL instance that is configured to accept incoming SSL connections. See https://doc.castsoftware.com/display/DOCCOM/SSL+encrypted+mode+configuration+for+CAST+Storage+Service+and+PostgreSQL.

Other Updates

Internal Id	Details
DASHBOARDS-3217	Console error on changing assessment model selector
DASHBOARDS-3216	Console error on drill down to exclusion
DASHBOARDS-3264	Background blur when Dialog is open in Action Plan and Exclusion views
DASHBOARDS-3214	Download button hover CSS need to fix for all Violation Tables
DASHBOARDS-3209	Console error with Architecture model view
DASHBOARDS-3293	Architecture models dependency arrows are not correctly oriented
DASHBOARDS-2220	Support of SSL connection
DASHBOARDS-3263	Same tooltip “Download AEP data to a file” is displaying in functional and enhancement size views

Resolved Issues

Customer Ticket Id	Details
28144	Mismatch in removed violations count between dashboard (Dashboard open through CMS and WAR)

Known Issues

Internal Id	Details
DASHBOARDS-3326	Dashboard version number is not displaying in Apache Tomcat Manager page.
DASHBOARDS-3325	SQL traces are activated by default in the log file.
DASHBOARDS-3324	Stop or shutdown batch file is not present in Spring Boot ZIP files.
DASHBOARDS-3170	SAML authentication not supported in this release.

1.27

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

1.27.0-funcrel

ISO tile displays the number of Violations (it has been changed from critical violation to non-critical, now it does not depend on the critical switch).
Contains customer bug fixes

Can be used with:

≥ 8.3.3

1.27.0-funcrel

Feature Improvements

Summary	Details
Industry standard tiles should show non-critical violation counts by default	Industry standard tiles will show total violation counts by default, and will not change when the Critical violations toggle is enabled.

Other Updates

Internal Id	Details
DASHBOARDS-3444	/server/reset web service should reload the roles.xml file
DASHBOARDS-3621	Action Plan Recommendation Algorithm Bug in the rules selection
DASHBOARDS-3655	Bad order of records for some extraction with modules

Resolved Issues

Customer Ticket Id	Details
30102	[AIP Datamart] ERROR: duplicate key value violates unique constraint “mod_health_scores_pkey”. This bug impacting the RestAPI is now fixed.
29825	EXCLUSIONS and ACTION tabs are not available in dashboard due to overlap of item in the view

1.26

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

1.26.1-funcrel

Bug fixes for:

Technical Size indicator view not working at single application level in the Health Dashboard.
All dashboards do not function in IE11.

Can be used with:

≥ 8.3.3

1.26.0-funcrel

Support for ISO-5055 extension
ISO report names are added and OMG report names are removed
APR provides the number of occurrences during which the violation of a rule takes place
In Technical Debt (OMG), the Adjustment Factor value are now set to two decimal places
Release version is given in the home page
Contains customer bug fixes

1.26.1-funcrel

Other Updates

Internal Id	Details
DASHBOARDS-3454	Correction to fix an issue where the dashboard is not working in IE11.

1.26.0-funcrel

New Features

Summary	Details
Support for ISO-5055 Metrics in Dashboards	The ISO-5055-Security metric tile is now available, by default, in Dashboards with full functionality support.
GUI - Adjustment Factor	The “Adjustment Factor” column in the “Technical Debt (OMG)” table now displays the value using two decimal places.

Feature Improvements

Summary	Details
OMG efforts in APR	Action Plan Recommendation (APR) now uses the OMG specified/modified efforts in its calculation. One more column called “Occurrences” is added, it displays the number of occurrences of a violation.

Other Updates

Internal Id	Details
DASHBOARDS-3226	Exclusion View: Tooltip should be disabled in background, when dialog box is open
DASHBOARDS-3366	Multiple API hits in the Active/Scheduled exclusions view
DASHBOARDS-3388	APR: Criteria and rules are always displaying from AIP assessment model when you change the health measure from industry standards AM
DASHBOARDS-3327	The Dashboard build number has been removed from the footer.
DASHBOARDS-3427	Unable to navigate to violations table from Rules in Risk Investigation view.

1.25

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

1.25.0-funcrel

Contains customer bug fixes

Can be used with:

≥ 8.3.3

1.25.0-funcrel

Other Updates

Internal Id	Details
DASHBOARDS-3217	Console error on changing assessment model selector
DASHBOARDS-3216	Console error on drill down to exclusion
DASHBOARDS-3264	Background blur when Dialog is open in Action Plan and Exclusion views
DASHBOARDS-3214	Download button hover CSS need to fix for all Violation Tables
DASHBOARDS-3209	Console error with Architecture model view
DASHBOARDS-3293	Architecture models dependency arrows are not correctly oriented
DASHBOARDS-3263	Same tooltip “Download AEP data to a file” is displaying in functional and enhancement size views

Resolved Issues

Customer Ticket Id	Details
28144	Mismatch in removed violations count between dashboard (Dashboard open through CMS and WAR)

1.24

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

1.24.0-funcrel

User notification added for cache refresh
Contains customer bug fixes

Can be used with:

≥ 8.3.3

1.24.0-funcrel

New Features

Summary	Details
Add user notification after a cache reload	Appropriate user notifications are added to inform user about availability of new snapshots and new applications
Additional web services to reload the cache: refresh and reset	These new web services allows cache reloading without interrupting the user, when a new snapshot or new authorizations are available.

Feature Improvements

Summary	Details
Optimization of the cache reload	The procedure to reload/refresh the cache has been made more efficient

Other Updates

Internal Id	Details
DASHBOARDS-3080	APR - Slider drag is not accurate
DASHBOARDS-3062	Global search not working for other Industry Standard metrics
DASHBOARDS-2704	SD displays a blank page when you drill down from global search result

Resolved Issues

Customer Ticket Id	Details
27994	Violations are not visible in Transaction Investigation View of ED
27860	Compliance with WCAG Standard

1.23

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

1.23.1-funcrel

Contains a customer bug fix in the RestAPI

Can be used with:

≥ 8.3.3

1.23.0-funcrel

Action plan recommendation (Beta) is added - A feature that allows users to define the health improvement goals and an optimization algorithm that recommends the optimized set of violations required to be fixed to reach the goal.
Customer bug fix

1.23.1-funcrel

Resolved Issues

Customer Ticket Id	Details
27297	Issue in RestAPI while extracting data in Datamart

1.23.0-funcrel

New Features

Summary	Details
SD: Implement APR (Action Plan Recommendation) only for compliance score	This feature allows users to define the health improvement goals based on compliance score and an optimization algorithm that recommends the optimized set of violations required to be fixed to reach the goal.

Other Updates

Internal Id	Details
DASHBOARDS-2940	Sidebar icon is not selected on reload of the page

Resolved Issues

Customer Ticket Id	Details
26763	SD - “Application Components” Tile is not loading for the application.

1.22

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

1.22.1-funcrel

Contains a customer bug fix

Can be used with:

≥ 8.3.3

1.22.0-funcrel

"Applied filter" is added in Risk investigation view, it shows the filter/s that are selected
Default configuration of industry standard has been updated with a name instead of metric ID.

1.22.1-funcrel

Resolved Issues

Customer Ticket Id	Details
26763	The “Application Components” Tile is not loading for the application

1.22.0-funcrel

New Features

Summary	Details
In Risk investigation view applied filter section has been added and changed the filter icon	A new section, “Applied filter” is added in Risk investigation view, it shows the filter/s that are selected. If no filter is selected then “Applied filter” section is not displayed.

Feature Improvements

Summary	Details
Change parameter names for “IndustryStandardsKeys” object in ed.json file	Default configuration of industry standard has been updated with a name instead of metric ID. For example, CISQ industry standard is configured as: “CISQ”: [“1062104”]

Other Updates

Internal Id	Details
DASHBOARDS-2926	Module and technology filter should get closed after selection is done
DASHBOARDS-2909	Title has disappeared from Dashboard when integrated in console
DASHBOARDS-2892	Architecture model - doesn’t get filtered on module selection
DASHBOARDS-2778	Dashboard displays a newly added business criteria as new assessment model
DASHBOARDS-2706	Architecture model - numbers are not aligned in Firefox
DASHBOARDS-2029	Rules table is getting refreshed in transaction investigation view when clicking on rules
DASHBOARDS-1851	List of removed violations: Critical column is inverted
DASHBOARDS-1456	Transaction is not displaying for robustness when you navigate from transaction view to application investigation

Resolved Issues

Customer Ticket Id	Details
23171	Snapshot is stuck due to a blocked query

1.21

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

1.21.0

Tags option added to the Rules Documentation
Technical Debt (OMG) data is displayed automatically

Can be used with:

≥ 8.3.3

1.21.0-funcrel

Feature Improvements

Summary	Details
Missing tags in QR documentation	Tags option is added in Rules Documentation. Refer: https://doc.castsoftware.com/display/SECURITY/Security+Dashboard+-+Risk+Investigation#SecurityDashboard-RiskInvestigation-RuleDocumentation
Technical Debt (OMG) data should be displayed automatically if the CISQ Index Assessment Model filter is used.	If the application is analyzed with the OMG Technical Debt extension and the CISQ Index extension, Technical Debt (OMG) data will now be available when you select the “CISQ Assessment Model” drop down regardless of whether you have configured the Technical Debt(OMG) tile.

Other Updates

Internal Id	Details
DASHBOARDS-2700	In internet explorer, download icon color removed in rule table section
DASHBOARDS-2694	Architecture model - does not display in IE and Edge
DASHBOARDS-1922	Scrollbar issue in action plan and exclusion view when you drill down from violations table
DASHBOARDS-2593	In ATDM view, Console error when navigating from action plan/exclusion icon
DASHBOARDS-2705	Metrics are greyed out though it has added and removed violations
DASHBOARDS-2729	Rule Tags filter is getting displayed in Architecture model view
DASHBOARDS-2752	Table design, filter drop-down width should be limited inside the table
DASHBOARDS-2779	In Risk Investigation view, change Violation icon to Tech Debt icon when viewing as Technical Debt (OMG)
DASHBOARDS-2738	Add APIKEY as an alternative authentication for default.html

1.20

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

1.20.0

Support of OWASP 2013 and OWASP 2017 Assessment Models
Critical filter is disabled in the Risk Investigation view for Industry Standards Assessment Models
Updates on Architecture Model View

Can be used with:

≥ 8.3.3

1.20.1

Resolved issues

Internal ID	Ticket ID	Summary	Affects Version/s
DASHBOARDS-2709	24036	Unable to generate the report “List of added violations” from report generator	1.20

1.20.0

Resolved issues

Internal ID	Ticket ID	Summary	Affects Version/s
DASHBOARDS-2203	22904	Incorrect Authentication Error Message displayed when LDAP Server is inaccessible or down	1.16
DASHBOARDS-2642	-	Excel export option is not displaying in Action Plan view	1.20
DASHBOARDS-2494	-	Risk view is getting loaded for a long time	1.18
DASHBOARDS-2493	-	Route is not proper Source view to Health Measures when any assessment models selected	1.18
DASHBOARDS-2468	-	Change Action plan default order to Last updated	1.17

Updates

Support of OWASP 2013 and OWASP 2017 Assessment Models

In the Risk investigation view, when the OWASP Industry Standards extension is installed, the Assessment Model drop down will now show the OWASP 2013 Assessment Model and OWASP 2017 Model (along with CISQ, MIPS, OMG-ASCQM Assessment Models that were introduced in 1.18), as shown below:

1.19

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

1.19

GUI updates
CISQ Technical Debt in SD Risk Investigation View

Can be used with:

≥ 8.3.3

Resolved issues

Internal ID	Ticket ID	Summary	Affects Version/s
DASHBOARDS-2400	23719	Filter and sort does not work together correctly	1.17.0
DASHBOARDS-2349	23348	‘Score’ column not showing up in the dashboard	1.17.0
DASHBOARDS-2286	23188	Dashboard should display appropriate error message when one of the snapshot in central is not successful	1.16.0
DASHBOARDS-2285	-	Manage semicolon in RestAPI	1.17.0
DASHBOARDS-2510	-	Excel download is not working in violations table	1.19.0
DASHBOARDS-2478	-	Action plan/Exclusion - drill-down from violation table is not working with New pagination implementation	1.19.0
DASHBOARDS-2469	-	“Check for updates” - version message showing wrongly when current and latest version both are same	1.18.0
DASHBOARDS-2408	-	AIP assessment model is selected when drill down from industry standard tile	1.18.0
DASHBOARDS-2348	-	SD Optimization: Load default locale translations file, and load other locale translations file on language change accordingly	1.18.0

Updates

SD Action Plan View: Move Object Search to Table header

Object search in Action plan Table has been moved to table header. There is an icon for search in the “OBJECT NAME LOCATION” section in the table header and the search functionality is same as before. The icon behaves as toggle button to open and close the search input field and there is a close button to clear the search input.

1.18

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

1.18

GUI updates
Improvements for Industry Standards

Can be used with:

≥ 8.3.3

1.18.2

Resolved issues

Internal ID	Ticket ID	Summary	Affects Version/s
DASHBOARDS-2378	23542	Unable to access dashboard when SAML keystore is configured using SHA256 algorithm	1.16.0

Update

Dashboard supports the SAML Keystore file which is generated using the SHA256 algorithm

To generate a Keystore file with SHA256 algorithm:

1.17

Mon, 01 Jan 0001 00:00:00 +0000

Content matrix

Version

Summary of content

Comments

1.17

Customer bug fixes
Ability to filter violations based on status in Architecture Model section

Can be used with:

≥ 8.3.3

Resolved issues

Internal ID	Call ID	Summary	Affects Version/s
DASHBOARDS-1728	-	Source code is not displaying for secondary bookmarks	1.13.1
DASHBOARDS-1852	21474	Request from customer to get the associated values displayed in Dashboard for past snapshots	1.13.2
DASHBOARDS-2053	22383	Unable to download the list of new violations report from Dashboard	1.16.0
DASHBOARDS-2093	-	Show more button should not be displaying if a table has less than 10 violations	1.16.0
DASHBOARDS-2102	-	Education icon is overlapping with Rule name	1.11.0
DASHBOARDS-2118	22541	Variation in percentage even if when there is no added or removed critical violation.	1.16.0
DASHBOARDS-2119	-	Saga issue with Polyfill in IE browser	1.16.0
DASHBOARDS-2191	-	Architecture Model View not getting loaded while drill down	1.17.0

Updates

Filter violations based on status in Architecture Model

From the Architecture Model, on selecting the Red - links, we can get the violation details table between the selected layers. A status filter has been added on the table. The table can be filtered based on status, similar to other tables.

Release Notes - CAST Security Dashboard - 1.16.x

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: This page describes the new features and bugs that have been fixed in the CAST Security Dashboard Package 1.16.x.

Content matrix

Version

Summary of content

Comments

1.16.x

Customer bug fixes
Parameter values in App Investigation and Transaction investigation page
Module search added to Advanced Search view
Report Generator (1.14.0) templates in Dashboard
Remove Solved violations from the Action Plan
Add Architecture Model graphical representation and tile

Can be used with:

Release Notes - CAST Security Dashboard - 1.15.x

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: This page describes the new features and bugs that have been fixed in 1.15.x.

Content matrix

Version

Summary of content

Comments

1.15.x

Customer bug fixes
Improvements to the Action Plan > Exclusion view
Source and application name in audit trail log
Filter parameter details based on selected technology
Search feature for module selector
Parameter values for last snapshots and when there are no violations

Can be used with:

≥ 8.3.3

Resolved issues

Internal ID	Call ID	Summary	Affects Version/s
DASHBOARDS-1887	21468	The list of parameters displayed in the dashboard is limited to 1	1.14.0
DASHBOARDS-1892	21625	Cannot see the quality rules parameter values for past snapshots	1.14.0
DASHBOARDS-1886	21588	Parameters to be displayed for the QRs even when there are no violations present.	1.14.0
DASHBOARDS-1934	-	IE: Technology drop-down not displaying	1.14.0
DASHBOARDS-1844	-	Blank page is displaying if you click outside of the server reloading warning dialog box	1.14.0

Updates - Security Dashboard

DASHBOARDS-1817: UI updates for the Exclusion (Active/Scheduled) View

Few aspects of the Exclusion are updated to provide a better end-user experience:

Release Notes - CAST Security Dashboard - 1.14.0

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: This page describes the new features and bugs that have been fixed in the CAST Security Dashboard Package 1.14.0.

Content matrix

Version	Summary of content
1.14.0	Bug fixing GUI updates

Resolved issues

Internal ID	Call ID	Summary	Affects Version/s
DASHBOARDS-1606	20500	AED 1.12 - Action Plan View is displaying incorrect data in the drop down for the columns	1.12.0
DASHBOARDS-1802	21340	Custom rule parameter is not visible in dashboard	1.13.2
DASHBOARDS-1832	20845	Application missing from Engineering Dashboard after API call	1.13.2
DASHBOARDS-1839	21341	Violations details not displayed for new/custom rule	1.13.2, 8.3.16
DASHBOARDS-1850	21432	Non-Critical Violations Listed Incorrectly as Critical in List_Of_New_Violations Report	1.13.2

Updates

Improvements to Excel export in Transaction Investigation view

The Excel spreadsheet now includes the Application Name and Snapshot ID (usually the date):

Release Notes - CAST Security Dashboard - 1.13.2

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: This page describes the new features and bugs that have been fixed in the CAST Security Dashboard Package 1.13.2.

Content matrix

Version

Summary of content

1.13.2

Quality Distribution and Measure data now available

Rest API

New APIs for getting object count associated with a particular transaction

UI Changes

Excel download and show-more option for "Impacted Transaction" and "Impacted Objects with Violation" section
Status filter added for "Impacted Objects with Violation" table
Rule ID available in Source code viewer
Drill down to Application Investigation view from Top Cyclomatic complexity High fanout and Top Cyclomatic complexity Low documentation reports available as Miscellaneous Reports

RestAPI

Documentation

Updates

Various minor improvements to Security Resources - 1.13.x to improve output for:

Release Notes - CAST Security Dashboard - 1.13.1

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: This page describes the new features and bugs that have been fixed in the CAST Security Dashboard Package 1.13.1.

Content matrix

Version

Summary of content

1.13.1

UI changes:

add a critical flag for some Miscellaneous Reports
Add new Industry Compliance Reports
Improvements to the Action Plan

Resolved issues

No customer bugs fixed in this release.

Updates

Critical rule flag now displayed in some Miscellaneous Reports

The following Miscellaneous Reports have been modified to show the critical rule flag:

Release Notes - CAST Security Dashboard - 1.12.0

Mon, 01 Jan 0001 00:00:00 +0000

On this page:

Info

Summary: This page describes the new features and bugs that have been fixed in the CAST Security Dashboard Package 1.12.0.

Content Matrix

Version	Summary of content
1.12.0	Application Investigation view improvements Transaction Investigation view improvements Parameter details available for Distribution metrics New predefined Industry Compliance reports New Miscellaneous Report for Top Cyclomatic Complexity changes Action Plan filtering improvements Cache reload messages

New features

CAST AIP Datamart

Introducing AIP Datamart(Beta) - a new way to expose, explore, and integrate AIP data for management reporting, with the following notable features:

Release Notes - CAST Security Dashboard - 1.11.2

Mon, 01 Jan 0001 00:00:00 +0000

On this page:

Info

Summary: this page describes the new features and bugs that have been fixed in the CAST Security Dashboard 1.11.2.

Content matrix

Version	Summary of content
1.11.2	Bug fix to address missing Function Point/Transaction information when using CAST AIP 8.3.16.

Release Notes - CAST Security Dashboard - 1.11.0

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: This page describes the new features and bugs that have been fixed in the CAST Security Dashboard 1.11.0.

Content matrix

Version	Summary of content
1.11.0	RestAPI APIKEY for SAML bypass Parameter details now displayed for parameterized rules. Ability to add custom report categories New CODE_RESTRICTED role Background facts tiles

New features

RestAPI APIKey for SAML authentication

If you have enabled SAML authentication mode for your CAST Security Dashboard/RestAPI deployment, some clients applications may not be able to authenticate. This is because SAML is designed as a single sign-on mode for browsers and therefore non-browser clients cannot use the protocol. In order to resolve this issue, CAST provides the ability to define an API Key in the CAST Security Dashboard/RestAPI that can be used to bypass SAML authentication.

Release Notes - CAST Security Dashboard - 1.10.0

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: this page describes the new features and bugs that have been fixed in the CAST Security Dashboard 1.10.0.

Content matrix

Version	Summary of content
1.10.0	Generation of reports direct from the Security Dashboard JIRA integration feature for the CAST Security Dashboard (in alpha release) Custom reports in PPTX, XLSX and DOCX formats for the CAST Security Dashboard Full Chinese translation available by default

New features

Report Generation feature

The ability to generate a range of reports direct from the CAST Security Dashboard has been introduced in this release. Various reports can be generated, however, some rely on the presence of CAST Report Generator for Dashboards (v. ≥ 1.10.0) in order to function.

Release Notes - CAST Security Dashboard - 1.8.1

Mon, 01 Jan 0001 00:00:00 +0000

On this page:

Info

Summary: this page describes the new features and bugs that have been fixed in the CAST Security Dashboard 1.8.1.

Content matrix

Version	Summary of content
1.8.1	Minor tile update

Updates

The default tile GDPR has been renamed and now uses a different tag:

Old Name	Old Tag	New Name	New Tag
GDPR	AIP-GDPR	DATA SAFETY	DATA-SAFETY

The behaviour of the tile has not changed - i.e. the tile displays the number of Violations or Critical Violations in the Application for rules that have the selected tag (i.e DATA-SAFETY). Clicking on this tile navigates to the Risk investigation view with the specific tag selected at the top of the table . “All Rules” will be selected in the Technical Criteria table and the list of rules displayed will all be tagged with the selected tag:

Release Notes - CAST Security Dashboard - 1.8.0

Mon, 01 Jan 0001 00:00:00 +0000

On this page:

Info

Summary: this page describes the new features and bugs that have been fixed in the CAST Security Dashboard 1.8.0.

Content matrix

Version	Summary of content
1.8.0	Default Security tiles have been renamed and now show different content Education and Continuous Improvement introduced Educate option in Advanced search results now available Session time-out re-design

Resolved issues

Internal ID	Call ID	Situation
DASHBOARDS-564	-	Dashboard truncates “Rational” text in the violation drill-down page.

New features

SEC-207 - Default security tiles have been renamed and now use different tags

The default tiles CWE and OWASP have been renamed and now use different tags:

Release Notes - CAST Security Dashboard - 1.7.0

Mon, 01 Jan 0001 00:00:00 +0000

On this page:

Info

Summary: this page describes the new features and bugs that have been fixed in the CAST Security Dashboard 1.7.0.

Content matrix

Version	Summary of content
1.7.0	Introduction of "Advanced Search" Gracefully handle SAML logout Default tiles have been updated

New features

DASHBOARDS-143 - Advanced Search feature

This is a feature that allows you to search for an object name based on a list of violations. Filters can be enabled to limit the search scope.

Release Notes - CAST Security Dashboard - 1.6.0

Mon, 01 Jan 0001 00:00:00 +0000

On this page:

Info

Summary: this page describes the new features and bugs that have been fixed in the CAST Security Dashboard 1.6.0.

Content matrix

Version	Summary of content
1.6.0	Ability to add CISQ/OWASP/CWE related tiles in conjunction with the Quality Standards Mapping extension (com.castsoftware.qualitystandards)

New features

It is now possible to add CISQ/OWASP/CWE tiles that show the number of violations for rules tagged as follows: