DependencyTrack / DependencyTrack/dependency-track
DefectDojo risk acceptance sync to DependencyTrack
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior:
DependencyTrack syncs the findings to DefectDojo. In DefectDojo there is the possibility to accept a risk for a finding, e.g. if a finding does not apply. These accepted risks are not synced back to DependencyTrack. Thus, the number of vulnerabilities between DefectDojo and DependencyTrack might be different.
### Proposed Behavior:
DependencyTrack syncs the findings to DefectDojo. In DefectDojo there is the possibility to accept a risk for a finding, e.g. if a finding does not apply. It would be nice if DefectDojo and DependencyTrack are always on the same page (e.g. if in DefectDojo a finding was risk accepted) it will be closed in DependencyTrack as "suppressed" with "false positive" and an automatical comment "risk accepted in DefectDojo".
Contributor guide
Assessment
This issue has not been assessed yet.