Scheduler - PlexTrac

Transcript

Hi, I’m Tami Brannan, the enablement specialist here at PlexTrac. Let’s talk about the scheduler today. This is a new feature in PlexTrac and it allows you to easily schedule new engagements and manage inbound scheduling requests from internal teams or clients. It also streamlines the scheduling workflow with a detailed overview showing the capacity and availability for each tester on the team.

When you log into PlexTrac, if you have the scheduler license enabled on your instance, you’ll see Schedule over here. You can see this as any level of user because we allow you to come in as an analyst user and request an engagement through this Schedule module.

You’ll see here that when you first open up the schedule view, you’re able to see all of your pentesters and their upcoming engagements. You can only see the clients that you are authorized to see on this page. So if there are other engagements or other clients that you’re not authorized to see, you won’t be able to see those. You can see quickly statuses related to these items that are scheduled and very easily move around and get updates on. Oh, this one’s in progress, that one’s in review, and this one’s complete. And you can change your view to look at a list view as well as availability of all of your pentesters.

Let’s show you how an analyst user may request a demo. We’re going to move over and you can see the name has changed. This is my analyst user, Kylo Ren, and he can see only the client that he is authorized to. So this view looks a lot different than the other view. Our request engagement option eliminates that manual workflow and allows requests to quickly flow in instead of needing to email somebody and wait to hear back. This just brings it into the system.

We’re going to go ahead and request an engagement and Kylo Ren is going to name this engagement the June pentest because as we can see, there is already a May pentest scheduled and he’s going to choose Wayne Enterprises and then select his dates. He doesn’t need this to start until June 10, and then they can select their test window. All of these questions that they answer keep the details of this engagement organized in one space for easy administrative review, both for them and you. You can see when they want it done, when it’s okay to test any objectives that they may have, what they need tested, both in the type and the scope.

So let’s go ahead and pick mobile application as the type of test and testing the security and then their scope would be all of the required information is entered in, but there’s also an option to put in the objective as well as credentials and access information, special instructions or restrictions. So maybe I want to give them the login information for our developer instance, or maybe I want to say please only test on I think originally up here I put business hours, so we’re going to put weekend, Saturday and Sunday, please only test on Saturday evening, our highest use time, and then we click continue here he can add any files that he would like. These files are the same files that you would be able to put in a report, but you can put in source code or any other documentation related to the app, as well as an inventory of assets or any scans that they have done themselves. I don’t have any files to add, so I’m going to go ahead and submit it. It pops up and says, hey, your request has been submitted. And now if I were to scroll over to June, I can actually see that request as pending and waiting for someone to approve it.

So now I can come back over into my typical user and here I can see all of those things, but I can also move forward into June. I can also move forward into June and I can see. And I can see this pending June pentest. So let’s go ahead and look at how that looks for me as an administrator or a pentester within PlexTrac.

This process is built with team management in mind. It helps you increase automation and collaboration to reduce the time and cost of preparing for new engagements. Testers and administrators will have a clear view of the engagement requirements and can immediately jump in and get to work once it has been approved.

So we’re going to go ahead and say, yep, this is one. We’re going to go and schedule and create the report. It auto-fills in this information in the engagement details, so if there’s any updates that need to be done, I could go ahead and make those. Maybe I know a better way to phrase the scope or something like that, and click continue. Add any files I may need to add. I don’t have any of those. And then it auto-fills in the report details. So the report name is June Pentest. I’m going to give it a little bit more expansive name and I’m going to say Wayne Wonders Pentest because it’s specifically for that mobile app. Here I can update the status of the report as well as the report templates, finding layout, add reviewers, add tags, we’re going to add in a mobile tag and then click continue on this screen just like when you were looking at the availability screen on the main page. We can see all of our users who could complete this pentest so they have access to create a report for Wayne Enterprises and we can see their availability. So I can actually see on if I scroll forward.

Here we go. If I scroll and I select a user, I can see when this pentest would be scheduled and this user doesn’t have any other pentest scheduled during that time. So we’re going to go ahead and select Tami Brannan and click save. Now we can see that this status has changed to scheduled and it has been assigned to me and that color has been updated here.
As a tester, I can then click on this and it opens up this side drawer with all of the information from the schedule as well as a link directly to the report that was created when this was scheduled.

Let’s go look at this report. Just like any other report, it starts out the same way, empty, unless you have information as a part of your report template, but you can come in here and make any adjustments to those details. Maybe I wanted to change the report or the findings layout or I need to add additional tags, etcetera. Or add the report reviewer one of the things to note is the status of the report will update the status of the scheduled pentest and if I move it into ready for review, in review or approved, it will show up as in review on the scheduler. And if I move it to published, it will show as complete on the scheduler.

Once the date has passed that first date of June 10, it will show up as in process on the scheduler without me making any changes to this report. You can bring in findings, narratives, and everything else just like you normally do. And if you ever need to look at the scheduler information, you can click on the June Pentest link and it will open up that information for you.

Let’s go back to our analyst user. This is Kylo Ren again and he can see on this page all of the different pentests that his company has scheduled with us. So we have this one showing as in progress and we have this one showing as in review as well as this one and the June 1 showing as scheduled. If he were to click on this, he’s able to see all of the information related to this specific request if a request has been fully completed. If a report has been fully completed, he’s able to see that complete statement status here and click on this and go directly to the report so he can see what has been done for that report directly from the scheduler page. At a glance view for engagements allows stakeholders to stay informed and see when they can expect the engagements to be completed or when the status updates to In Review or Completed.

This helps deliver a differentiated client experience. Service providers can set their service delivery experience apart by enabling their clients to request these new engagements directly in PlexTrac through their client portal, and it encourages clients to submit more engagement requests, which ultimately drives more practice revenue while also delivering a superior client experience.