Importing a Findings Library from Word, Excel or JSON

A findings library is years of a firm’s best writing, and it usually lives somewhere awkward: a Word document that has grown to hundreds of pages, a spreadsheet, or another platform’s export. Moving it should not mean retyping it. Import reads it into your own library, each finding with its own parts, and adds nothing until you have looked over what was read.

Where it is

Import into Your Library is the first card of Settings, Library, above Pental’s own finding library. Settings is an administrator’s, and an import adds to the firm’s library in bulk. What it adds goes into your own library, the Library page, which holds the findings your firm uses and nothing else.

A spreadsheet or another platform’s export

Excel, CSV, JSON, YAML or XML, a .zip or .gz of one, or a library exported from another platform opens on a screen that matches each column to a field of your library, with a value from your own file beside it to check (data that is not laid out as a table is read as a document instead, as below). With an AI provider connected, Match the columns with AI fills the matches in for you to look over. Several pentest platforms’ own library exports are recognised as libraries, and their comparison pages name which. A finding whose title your library already has is left alone.

A Word document

A Word document, Markdown, a text file or HTML is read by your own AI provider in two steps: first where each finding begins, then which part of each is its description, impact, remediation and references, with its severity, CVSS score and vector, CWE and category. The AI only says where those parts are. The words that reach your library are the document’s own, with its numbered lists, code, bold and links, so nothing is reworded or invented, and labels such as Description: or Recommendation: are taken out of them.

A long document is read in parts, as many at once as your provider takes, showing how far it has got, with Stop, and look over what is read to keep what is done so far. Findings whose request failed twice are named with the provider’s own words, and Read them again tries them once more. A model on your own machine works as well as a hosted one: see running AI on hardware you own.

Looking over it before it is added

• Every finding read is listed, ticked, with its severity and the parts that were read.
• One whose title your library already has, or that came earlier in the same file, is unticked and says so.
• Show opens a finding to check it, and Add adds the ticked ones.
• If adding stops part way, the findings not yet added stay in the list to add again.

Closing the import while it is reading, or with findings read and not added, asks first.

What does not come across

Pictures are not brought across: library entries are words. The library has no impact field, so a finding’s impact goes at the end of its description, under its own name. A PDF or an older .doc file is not read; import the Word document or the export it was made from.

Once it is in, it is a library like any other: the findings library covers using it on an engagement and choosing which fields travel. For keeping it worth reusing, see building a findings library your team actually uses.