> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Vulnerability Groups

> Organize and manage related vulnerabilities across assets and assessments in unified, customizable groups.

<Frame caption="Vulnerability Groups — Manage categorized lists of vulnerabilities">
  <img src="https://mintcdn.com/snapsec-23724fa2/kPTpp5Mtz_2E7Tyz/images/vm/vuln-groups1.png?fit=max&auto=format&n=kPTpp5Mtz_2E7Tyz&q=85&s=b0dfc1691050bcb70c998fa0c3da9a54" alt="Dashboard view showing vulnerability groups like XSS and API Vulns" width="2856" height="1670" data-path="images/vm/vuln-groups1.png" />
</Frame>

## Overview

**Vulnerability Groups** enable you to organize vulnerabilities from multiple assets, assessments, and sources into logical collections — such as all *Access Control* issues or *API-related* vulnerabilities.\
This helps teams prioritize fixes, track themes, and export consolidated reports with ease.

Groups can be defined by vulnerability types, impacted components, responsible teams, or business context. They act as dynamic workspaces to simplify remediation management across large vulnerability datasets.

***

## Use Cases

* Group all *Access Control* or *Authentication* issues across multiple systems.
* Maintain separate vulnerability lists per *team* or *department*.
* Create category-based views (e.g., *API Vulnerabilities*, *Web XSS Issues*, *Encryption Weaknesses*).
* Generate consolidated reports for specific vulnerability families.

***

## Creating or Updating a Group

<Frame caption="Vulnerability Groups — Manage categorized lists of vulnerabilities">
  <img src="https://mintcdn.com/snapsec-23724fa2/kPTpp5Mtz_2E7Tyz/images/vm/vuln-groups2.png?fit=max&auto=format&n=kPTpp5Mtz_2E7Tyz&q=85&s=2bf33379f70cbbeed032191a49ba0001" alt="Dashboard view showing vulnerability groups like XSS and API Vulns" width="1900" height="1134" data-path="images/vm/vuln-groups2.png" />
</Frame>

<Steps>
  <Step title="Open Vulnerability Groups">
    Navigate to **Vulnerability Management → Vulnerabilities → Groups**.
  </Step>

  <Step title="Click ‘Create Group’">
    Provide a **name** (e.g., “XSS” or “API Vulnerabilities”) and an optional **description** to help categorize the group.
  </Step>

  <Step title="Save Group">
    Once saved, your new group will appear in the list, ready to be populated with vulnerabilities.
  </Step>

  <Step title="Updating a Group">
    To rename or edit a group’s description, click the **three-dot menu (⋯)** on the card and select **Edit**.
  </Step>
</Steps>

<Frame caption="Creating and managing vulnerability groups">
  <img src="https://mintcdn.com/snapsec-23724fa2/kPTpp5Mtz_2E7Tyz/images/vm/vuln-groups2a.png?fit=max&auto=format&n=kPTpp5Mtz_2E7Tyz&q=85&s=c249accfe70357604cac749fc78ee9d5" alt="Menu options for editing, managing, or exporting vulnerability groups" width="1916" height="1080" data-path="images/vm/vuln-groups2a.png" />
</Frame>

***

## Viewing Vulnerabilities in a Group

<Frame caption="Vulnerability Groups — Manage categorized lists of vulnerabilities">
  <img src="https://mintcdn.com/snapsec-23724fa2/kPTpp5Mtz_2E7Tyz/images/vm/vuln-groups3.png?fit=max&auto=format&n=kPTpp5Mtz_2E7Tyz&q=85&s=95e17066f47deb04ef78f874673e9416" alt="Dashboard view showing vulnerability groups like XSS and API Vulns" width="1938" height="1534" data-path="images/vm/vuln-groups3.png" />
</Frame>

<Steps>
  <Step title="Select a Group">
    Click on the **group name** or the **‘View’** link beside the vulnerability count.
  </Step>

  <Step title="Review Grouped Vulnerabilities">
    View all vulnerabilities added to that group, along with their severity, state, and associated assessments.
  </Step>

  <Step title="Drill Down">
    Click any vulnerability title to open its detailed view and remediation information.
  </Step>
</Steps>

***

## Adding or Removing Vulnerabilities

<Frame caption="Vulnerability Groups — Manage categorized lists of vulnerabilities">
  <img src="https://mintcdn.com/snapsec-23724fa2/kPTpp5Mtz_2E7Tyz/images/vm/vuln-groups4.png?fit=max&auto=format&n=kPTpp5Mtz_2E7Tyz&q=85&s=09231c7cfa07eb17506883b88e1ef1b3" alt="Dashboard view showing vulnerability groups like XSS and API Vulns" width="966" height="1082" data-path="images/vm/vuln-groups4.png" />
</Frame>

<Steps>
  <Step title="Manage Group">
    Open the group’s **Manage** option from the menu.
  </Step>

  <Step title="Add Vulnerabilities">
    Search across all vulnerabilities and select the ones you wish to add to the group.
  </Step>

  <Step title="Remove Vulnerabilities">
    To remove, deselect items or use the **Remove** button in the group management view.
  </Step>

  <Step title="Auto-Sync Option (optional)">
    Groups can be configured to automatically include vulnerabilities matching filters like CWE, severity, or keywords.
  </Step>
</Steps>

<Banner color="blue">
  You can group vulnerabilities from **different assessments and sources** — ideal for tracking recurring issues across your environment.
</Banner>

***

## Exporting Group Data

<Frame caption="Vulnerability Groups — Manage categorized lists of vulnerabilities">
  <img src="https://mintcdn.com/snapsec-23724fa2/kPTpp5Mtz_2E7Tyz/images/vm/vuln-groups5.png?fit=max&auto=format&n=kPTpp5Mtz_2E7Tyz&q=85&s=42eddd02ee46f04202fede7de1d20140" alt="Dashboard view showing vulnerability groups like XSS and API Vulns" width="1944" height="1484" data-path="images/vm/vuln-groups5.png" />
</Frame>

You can export grouped vulnerabilities either as a **CSV file** for analysis or as a **PDF report** for sharing and documentation.

### Export CSV

<Steps>
  <Step title="Open the Group Menu">
    Click the three-dot (⋯) menu beside your chosen group.
  </Step>

  <Step title="Select ‘Export CSV’">
    A CSV file will be generated containing all vulnerabilities, including metadata such as title, severity, CVSS, asset, and owner.
  </Step>
</Steps>

### Export PDF Report

<Steps>
  <Step title="Select ‘Export PDF’">
    Generate a detailed **Consolidated Vulnerability Report** with full details, affected assets, CVSS scores, and remediation steps.
  </Step>

  <Step title="Download the Report">
    The report will automatically compile and download, formatted for executive or audit-ready reviews.
  </Step>
</Steps>

***

## CWE-Based Grouping

Vulnerability Groups support organizing findings using **CWE (Common Weakness Enumeration)** classifications.\
This allows teams to group vulnerabilities based on **root cause patterns**, not just individual findings.

<Frame caption="Vulnerability Groups filtered by CWE categories">
  <img src="https://mintcdn.com/snapsec-23724fa2/NWjYdbkO6UoZkIcZ/images/vm/vuln-groups-cwe.png?fit=max&auto=format&n=NWjYdbkO6UoZkIcZ&q=85&s=d2ddd20e0560f3f3708cf8b4b6ee936c" alt="Vulnerability group filtered using CWE identifiers" width="1657" height="817" data-path="images/vm/vuln-groups-cwe.png" />
</Frame>

### How CWE Grouping Helps

CWE-based grouping enables teams to:

* Track recurring **weakness classes** (e.g., CWE-79, CWE-89, CWE-287) across applications
* Identify **systemic security flaws** instead of isolated bugs
* Prioritize remediation based on **root causes**, not just severity
* Align remediation efforts with **secure coding standards** and training programs

***

### Creating a CWE-Based Group

<Steps>
  <Step title="Create or Edit a Group">
    Open **Vulnerability Groups** and create a new group or edit an existing one.
  </Step>

  <Step title="Select CWE Criteria">
    Choose one or more **CWE IDs** (e.g., CWE-79: Cross-Site Scripting, CWE-287: Improper Authentication).
  </Step>

  <Step title="Save Group">
    All vulnerabilities mapped to the selected CWE identifiers are automatically included in the group.
  </Step>
</Steps>

<Banner color="blue">
  CWE-based groups dynamically update as new vulnerabilities are discovered or reclassified.
</Banner>

***

### Example CWE Use Cases

* **CWE-79 (XSS):** Track all cross-site scripting issues across web applications
* **CWE-89 (SQL Injection):** Monitor database-related injection risks
* **CWE-287 (Authentication):** Review identity and access control weaknesses
* **CWE-22 (Path Traversal):** Identify file system exposure risks

These groups help teams address **patterns of weakness**, not just individual vulnerabilities.

***

### Reporting with CWE Context

When exporting a Vulnerability Group:

* **CSV exports** include CWE IDs for each vulnerability
* **PDF reports** summarize findings by CWE category, severity, and affected assets

This makes CWE-based groups ideal for:

* Secure coding reviews
* Engineering retrospectives
* Compliance and audit reporting
* Long-term risk reduction initiatives

***

## Best Practices

* Create functional groups (e.g., *API Issues*, *Auth Flaws*) to align with engineering teams.
* Use CSV exports for bulk remediation tracking in external tools.
* Use PDF exports for client reporting or audit documentation.
* Review and refresh groups regularly to ensure updated vulnerability context.

***

## Explore Live Demo

<Card title="Explore VM Live — No Signup Needed" icon="wand-magic-sparkles" href="https://suite.snapsec.co/demo">
  Jump straight into the live environment and see how Snapsec unifies asset intelligence, threat detection, and vulnerability tracking — all in one dashboard.
</Card>