DependencyTrack / DependencyTrack/dependency-track
Graph the Trend of Tracked Vulnerabilities on Dashboard
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
As of v4.7.1 (and v4.8.0 SNAPSHOT), the Dependency-Track Dashboard does not display a total for the number of vulnerabilities tracked by the system, nor a trend for same.
The Vulnerabilities page on my deployment reports that there are 224097 vulnerabilities total. This includes vulnerabilities with old NPM ids, plus CVE, Sonatype, GHSA, and some old OSS Index vulns such as `01fa430e-ebce-4504-bcbd-1a58bd22b168`.
There is no indication of what the totals are per analyser, and no indication of what the totals might have been in the past.
### Proposed Behavior
Track vulnerability totals per analyser and display a trend on the Dashboard.
This enhancement was inspired by Discussion #2438
Having a Dashboard insight into such metrics would help illuminate such questions as:
- What is the overall trend?
- What is the trend on GHSA vulnerabilties?
- When was Snyk enabled and what sort of impact did it have?
- Is there a step-change in detected vulnerabilities that does not match a change in tracked vulnerabilities?
- Why are there zero new Sonatype vulns in the last 2 months... did we "break"our authentication token? (yes I have managed to do exactly that).
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.