DAST

Managing issues in Burp Suite DAST

• Last updated: October 22, 2026

• Read time: 4 Minutes

After a scan, you can manage the issues that Burp Suite DAST finds. You can:

• Set an issue's status, for one issue or for every matching issue on a site.
• Add comments to issues.
• Edit the severity of an issue.
• Update many issues at once.
• Download issues as a CSV file.

Setting an issue status

After reviewing an issue you can set a status for it, such as False positive or Accepted risk. If you and the scanner set different statuses, Burp Suite DAST shows the status you set, unless the scanner confirms the issue is fixed. For more information, see Issue statuses.

To set an issue's status:

1. Go to the All issues tab on the Home page, or the Issues tab on a site or folder.
2. Select an issue to open it.

3. From the Status drop-down, select one of the following:

   • False positive
   • Accepted risk
   • Verified risk
   • Fixed (unconfirmed)
   • Use scanner status - clears a status you have set and returns the issue to its scanner status.

4. If you select False positive or Accepted risk, select one of the following under Apply to:

   • This issue only - Burp Suite DAST changes the issue you opened.
   • This issue type at this URL - Burp Suite DAST changes every issue of the same type at the same origin and path on the site.
   • This issue type anywhere on this site - Burp Suite DAST changes every issue of the same type on the site.
5. (Optional) Add a note.
6. Click Change issue status.

Burp Suite DAST records the change in the issue's timeline, along with the time, date, and your username.

The status stays with the issue in every later scan of the site. If you select This issue only, it does not apply to the same vulnerability found at another location, or on another site. For more information, see Issue statuses.

If you select a wider scope, Burp Suite DAST updates the matching issues on the site straight away and creates an issue management rule. The rule applies your decision to matching issues in later scans. For more information, see Issue management rules.

Adding a comment to an issue

Add comments to record your decisions and share context with your team. Comments appear in the issue's timeline.

To add a comment:

1. Select an issue to open it.
2. Select the Timeline tab.
3. Enter your comment.
4. Click Add comment.

Editing issue severity

Editing the severity of an issue can be useful if the real-world impact it poses is different from how Burp has rated it.

To edit the severity of an issue:

1. Go to the All issues tab on the Home page, or the Issues tab on a site or folder.
2. Select an issue to open it.
3. From the Severity drop-down, select a severity.
4. Under Apply to, select This issue only, This issue type at this URL, or This issue type anywhere on this site.
5. (Optional) Add a note.
6. Click Change issue severity.

Burp Suite DAST records the change in the issue's timeline, along with the time, date, and your username.

If you select a wider scope, Burp Suite DAST creates a rule that sets the severity of matching issues. Later scans cannot override a severity that a rule sets. For more information, see Issue management rules.

Updating issues in bulk

You can update many issues in a single action, across different sites and applications.

To update issues in bulk:

1. Go to the All issues tab on the Home page, or the Issues tab on a site or folder.
2. Select the issues you want to update.
3. Click Change status or Change severity, then select the new value.

You cannot add a note to a bulk change. A bulk change applies to the issues you select only, and creates no rule.

You can also change an issue's status directly from the issue list, without opening the issue.

Downloading issues as a CSV file

You can download the issue list as a CSV file. The file contains the issues that match your current filters.

To download issues as a CSV file:

1. Go to the All issues tab on the Home page, or the Issues tab on a site or folder.
2. Filter the issue list, if necessary.
3. Click Download as CSV, above the issue list.

The file lists the following details for each issue:

• Issue type.
• Origin.
• Path.
• Severity.
• Confidence.
• Site name.
• Status.
• Last seen date.

The file can contain up to 100,000 issues.