DependencyTrack / DependencyTrack/dependency-track

Implement EPSS Scaling (Total Threat for Component or Project or Portfolio)

Open
#2,512 4 comments 3 reactions 1 assignee Claimed by @nscuro View on GitHub
enhancement p2
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
Dependency-Track v4.5.0 introduced support for [EPSS](https://www.first.org/epss/model). This is currently provided via the `"Exploit Predictions" tab in each project.

The scatter graph is definitely useful. It does allow one to follow general EPSS recommendations for prioritization (pay attention to the top right first) However, things can get a bit complicated when the graph is busy. To illustrate..

![image](https://user-images.githubusercontent.com/4938718/170798077-a4b122fa-dece-4f05-b2bb-eb81c51b378f.png)

This represents 112 separate predictions. However, in this project just one single component has 12 vulnerabilities (with a total DT risk score of 108).

### Proposed Behavior:

What I would like to see is implementation of scaling, the combination of individual EPSS scores to give a measure of the risk from multiple vulnerabilities. The EPSS website explains how this can be done [here](https://www.first.org/epss/user-guide). Scroll down to the section titled "EPSS Can Scale, to Produce System, Network, and Enterprise-level Exploit Predictions".

This would then allow for:

* EPSS graph for individual components in a project. ie, showing how the score has changed over time.
* EPPS visualisation on Dependency Graphs for projects (ie, showing total current EPSS risk for each component). And perhaps the total could increase as one move up the tree? ie inheritence of risk from transitive dependencies.
* EPSS graph for each project's overview. ie, showing how the score has changed over time.
* EPSS graph for DT Dashboard. ie, showing how the score has changed over time.
* Addition of EPSS column to projects page
* Addition of EPSS column to components page
* etc? (I am sure that I have missed some things).

In the future, EPSS can then possibly be reported for (say) tags or other "collections" that might be implemented in DT. eg, a score for one's integration environment and a score for own's production environment

I have logged this as a Frontend enhancement, although I am sure it would also require backend changes.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.