diff --git a/example-prompts/Vulnerability-Reporting.md b/example-prompts/Vulnerability-Reporting.md new file mode 100644 index 0000000..740f236 --- /dev/null +++ b/example-prompts/Vulnerability-Reporting.md @@ -0,0 +1,80 @@ +# Vulnerability Report Generation Prompt for Contrast MCP + +## Objective +Generate a comprehensive, role-based security vulnerability report with interactive HTML interface that provides tailored views for different stakeholders (Developer, Manager, CISO, Business Person). + +## Instructions + +Please create an interactive HTML vulnerability report with the following specifications: + +### 1. **Data Collection** +- Use `mcp_contrastmcp_list_all_applications` to find available applications +- Select the most relevant application for analysis (or ask user to specify) +- Use `mcp_contrastmcp_list_vulnerabilities` to get all vulnerabilities for the chosen application +- Use `mcp_contrastmcp_get_vulnerability` to get detailed information for Critical and High severity issues +- Use `mcp_contrastmcp_get_ADR_Protect_Rules` to understand available protection capabilities + +### 2. **Report Structure** +Create an HTML file with these four distinct role-based views: + +#### **👨‍💻 Developer View** +- Technical vulnerability details with exact code locations +- Stack traces and vulnerable code examples +- Specific remediation code examples (vulnerable vs. secure) +- Time estimates for fixes +- Priority rankings for development planning + +#### **📊 Manager View** +- Visual dashboards with Chart.js charts showing: + - Vulnerability severity distribution (pie/doughnut chart) + - Fix time estimates (bar chart) + - Risk reduction over time (line chart) + - Security posture radar chart +- Project metrics (team size, sprint allocation, technical debt) +- Two-phase approach (immediate ADR protection + code fixes) + +#### **🔒 CISO View** +- Enterprise risk assessment with CVSS scores +- Compliance impact analysis (PCI DSS, GDPR, etc.) +- Financial risk projections +- Current ADR rule status and recommendations +- Board-level executive summary +- Threat landscape and attack vector visualizations + +#### **💼 Business Person View** +- Simple, non-technical explanations using analogies +- Timeline of potential attack scenarios +- Financial impact breakdown (direct and indirect costs) +- Probability assessments in plain language +- Cost-benefit analysis comparing protection options +- Emphasis on Contrast ADR as immediate protection solution + +### 3. **Key Features to Include** + +#### **Interactive Elements** +- Role selector buttons at the top +- Smooth transitions between views +- Charts that initialize properly without infinite scrolling +- Responsive design for different screen sizes + +#### **Contrast ADR Focus** +- Emphasize ADR as immediate protection strategy +- Show current rule status (monitoring vs. blocking) +- 5-minute activation timeline +- Business continuity benefits +- Cost comparison: ADR protection vs. emergency shutdown vs. doing nothing + +#### **Visual Design** +- Modern gradient backgrounds and card layouts +- Color-coded severity indicators (Critical=red, High=orange, Medium=yellow, etc.) +- Professional styling with hover effects +- Chart containers with fixed dimensions to prevent scrolling issues + +### 4. **Technical Implementation Details** + +#### **Chart.js Configuration** +```javascript +- Use initialization flags to prevent multiple chart creation +- Add setTimeout delays for DOM readiness +- Set fixed container heights and max-widths +- Include maintainAspectRatio: false for proper sizing \ No newline at end of file