DependencyTrack / DependencyTrack/dependency-track

Graph the Trend of Tracked Vulnerabilities on Dashboard

Open
#2,449 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

As of v4.7.1 (and v4.8.0 SNAPSHOT), the Dependency-Track Dashboard does not display a total for the number of vulnerabilities tracked by the system, nor a trend for same.

The Vulnerabilities page on my deployment reports that there are 224097 vulnerabilities total. This includes vulnerabilities with old NPM ids, plus CVE, Sonatype, GHSA, and some old OSS Index vulns such as `01fa430e-ebce-4504-bcbd-1a58bd22b168`.

There is no indication of what the totals are per analyser, and no indication of what the totals might have been in the past.

### Proposed Behavior

Track vulnerability totals per analyser and display a trend on the Dashboard.

This enhancement was inspired by Discussion #2438

Having a Dashboard insight into such metrics would help illuminate such questions as:

- What is the overall trend?
- What is the trend on GHSA vulnerabilties?
- When was Snyk enabled and what sort of impact did it have?
- Is there a step-change in detected vulnerabilities that does not match a change in tracked vulnerabilities?
- Why are there zero new Sonatype vulns in the last 2 months... did we "break"our authentication token? (yes I have managed to do exactly that).

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.