DependencyTrack / DependencyTrack/dependency-track

Ability to change default values of severities in risk score calculation

Open
#2,824 10 comments 0 reactions 1 assignee Claimed by @leec94 View on GitHub
enhancement size/M
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Right now the risk scores are calculated as follow:
`((critical * 10) + (high * 5) + (medium * 3) + (low * 1) + (unassigned * 5))`

I believe this is the formula used across all risk scored in DT.

### Proposed Behavior

If we could have the ability to change these weights based on how users rate each risk types it would allow us a more personal view on risk scores after the calculation has been done. This could could be achieved via uploading a file with new rates or, more involved, creating UI elements to select weights for critical, high, etc.

This may be opened up later to change the calculation but right now being able to change the severity weights would be a good starting point.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.