DependencyTrack / DependencyTrack/dependency-track

DefectDojo risk acceptance sync to DependencyTrack

Open
#1,926 5 comments 2 reactions 0 assignees View on GitHub
enhancement integration/defectdojo
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
DependencyTrack syncs the findings to DefectDojo. In DefectDojo there is the possibility to accept a risk for a finding, e.g. if a finding does not apply. These accepted risks are not synced back to DependencyTrack. Thus, the number of vulnerabilities between DefectDojo and DependencyTrack might be different.

### Proposed Behavior:
DependencyTrack syncs the findings to DefectDojo. In DefectDojo there is the possibility to accept a risk for a finding, e.g. if a finding does not apply. It would be nice if DefectDojo and DependencyTrack are always on the same page (e.g. if in DefectDojo a finding was risk accepted) it will be closed in DependencyTrack as "suppressed" with "false positive" and an automatical comment "risk accepted in DefectDojo".

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.