Dynamic testing findings

Identifies dynamic application security testing (DAST) findings and scanner reports - OWASP ZAP, Burp Suite, Acunetix/Invicti, AppScan, WebInspect - with tested endpoints, parameters/payloads and alert IDs. Penetration test reports are covered by global-top500-252-penetration-testing-reports.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: tool/report wording is discovery-only; enforcement requires endpoint, parameter or alert structure, and 85 adds a second structure and a weakness class.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF, CIS Controls
Data categories: security, technology
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:DAST\s+(?:findings?|report|results|scan)|dynamic\s+application\s+security\s+test(?:ing)?\s+(?:findings?|report|results)|dynamic\s+(?:application|security)\s+scan\s+(?:findings?|report|results)|(?:OWASP\s+)?ZAP\s+(?:scan|report|alerts?|baseline)|Burp\s+(?:Suite\s+)?(?:scan|report|issues?|findings)|(?:Acunetix|Invicti|Netsparker|AppScan|WebInspect)\s+(?:scan|report|findings)|web\s+application\s+(?:vulnerability\s+)?scan\s+(?:report|results|findings))\b

Corroborative evidence keywords

cross-site scripting, SQL injection, reflected, open redirect, session fixation

Proximity: 300 characters

Should match

OWASP ZAP scan report - permits.example.internal (authenticated scan, 18/09/2026) Alert: Cross Site Scripting (Reflected) Risk: High Plugin ID: 40012 CWE-79 URL: https://permits.example.internal/search?q=test Parameter: q Evidence: response reflects the q value unencoded in the results heading. — High tier (85) - endpoint, parameter/evidence and plugin/CWE IDs with a reflected XSS weakness
Burp Suite scan results for the booking portal: POST /api/v2/bookings/cancel accepted a booking number owned by another account. — Medium tier (75) - tested endpoint only
DAST findings for the library catalogue - Plugin ID: 10038 raised on every page. — Medium tier (75) - alert reference only
The DAST findings from last week are still being triaged. — Discovery tier (65) - report wording only

Should not match

unrelated generic text without domain phrases — No relevant topic phrases present
The penetration test report is due next week. — Penetration testing is handled by a separate classifier
Guidance note: agencies should run a DAST scan before each release and fix high-risk alerts. — Guidance text
DAST report template URL: ______ Parameter: ______ Plugin ID: ______ — Blank template
Media release: the vendor says its new dynamic application security testing report finds cross-site scripting faster. — News framing

Known false positives

Scanner documentation and training labs show example alerts, endpoints and payloads. Mitigation: Tool wording is discovery-only; enforcement needs finding structure, and guidance/training/demo/template framing is excluded.