Customer Object

[richardschwabe]

I think a great addition would be to have a Customer object that can be used in reports.

As well as the ability to link projects to a client and therefore have a "client page", which shows all reports for a single client.

When a new test comes up you can easily create new project for an existing clients with all existing details.

Since the reporting software is very "open" it can easily be used to create offers or incident response reports as well.

Therefore it would help in the long run with a client to save time.

It could very well be linked to this DT: #9 as you might opt for an option of a "client portal" where they download their reports etc.

[aronmolnar]

Thank you for this idea.
We will add it to our list and discuss implementation details.

[unixerius]

I am very much looking forward to this, as I was about to submit this same feature request.

It would be ideal to group multiple engagements / reports per customer.

[aronmolnar]

One possible implementation approach would be:

There is a dedicated customer overview. Customers have some static attributes, like customer.name or customer.address.
We also add new predefined fields for reports that match the naming of customer attributes. The user must now be able to select a customer in a report (so that report fields are filled out with the data from the customer). This might be done with a new report field which only adds a searchable dropdown field for choosing the customer. If the customer is selected in a report, all customer attributes that are used in the design are copied to the report.
If in the meantime the customer attributes change, this would not affect the customer data in the report. The report holds a static copy of the customer data.

In an additional step, it could be made possible that users can define additional customers attributes (similar to defining report fields). Users could then define report fields that match the attribute names (like customer.account_number) and could then be filled out in the report automatically.

Customer objects would also require additional permissions. It should be possible to configure that guest users (and also regular pentesters?) are not able to access customer data (this should be the default setting for guest users). This would also mean that a user without access to customer objects cannot use the dropdown to prefill customer data. We might also need a customer manager permission who is then allowed to edit customers?

It could also be possible to do read/write-permissions per customer, but that might be an overkill.

[unixerius]

Some meta information which I would hope to at least store per customer:

• Customer name, like company / department / team.

The following would be linked to the customer, but could be unique per engagement.

• Customer management contact (who ordered this? responsible/accountable):
  • Name
  • Email (not in report)
  • Telephone (not in report)
• Customer technical contact:
  • Name
  • Email (not in report)
  • Telephone (not in report)
• Customer emergency contact (for critical findings or for suspected fraud/breach):
  • Name
  • Email (not in report)
  • Telephone (not in report)
• Customer delivery instructions (where does the report go?)

I reckon billing info, address info etc might not be the most relevant for this tool.