Suppressing findings

malscan reads installed third-party files, which you cannot annotate, so there are no nosec comments. Use one of these instead.

You want to	Use	Reach
Tell Vulnetix an indicator or package is not malware	A false-positive decision in the console	Every customer
Accept one finding in one repository	vulnetix ignore add --category malware	Your organisation, that repository
Stop a noisy detector for an ecosystem	A capability override with --catalog	The machine or job using the override
Scan less	--scan-depth, --max-file-size, --no-binary-analysis, --no-ioc-feeds	That run

Ignore rules

Ignore rules are applied after the scan and before the SARIF file, memory, upload and exit code. A suppressed finding no longer makes its package malicious. The CLI prints N malware finding(s) suppressed by ignore rules.

# One rule in one installed file
vulnetix ignore add --category malware --rule P-INSTALL-CURL \
  --file node_modules/sharp/package.json \
  --type false_positive --reason "downloads its own prebuilt libvips"

# Every IOC hit in a vendored test fixture, for 14 days
vulnetix ignore add --category malware --rule IOC-STIX-MATCH \
  --file vendor/github.com/example/parser/testdata/urls.txt \
  --type deferred --expires-in 14 --reason "upstream fixture, reported"

A rule matches on category, rule id and file. The file anchor matches the finding’s path exactly or as a suffix (/<file>), relative to the scan root. Paths in malscan findings are relative to the resolved scan root (node_modules/<pkg>/…). A file outside the root, in a home cache or a system directory, is reported by its base name only (package.json), so a --file anchor on it matches that name in every directory.

Flag	Value
--category	malware
--rule	The finding’s rule id: IOC-STIX-MATCH, P-CURL-PIPE, IS-G-PIPE, B-KNOWN-BAD-HASH and so on
--file	Path of the reported file
--type	false_positive, wont_fix, risk_accepted, mitigated, deferred, rego_rule or nosec
--reason, --expires-in	Free text; days until it stops applying

The rule is stored in .vulnetix/memory.yaml and, when authenticated, in your organisation for that repository.

Community false positives

Before reporting, malscan also drops findings whose indicator any organisation has marked false_positive (N malware indicator(s) cleared by false-positive curation). This needs no setup and covers IOC-STIX-MATCH findings and extracted IOCs, not pattern or behaviour findings.