DependencyTrack / DependencyTrack/dependency-track
Ability to change default values of severities in risk score calculation
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Right now the risk scores are calculated as follow:
`((critical * 10) + (high * 5) + (medium * 3) + (low * 1) + (unassigned * 5))`
I believe this is the formula used across all risk scored in DT.
### Proposed Behavior
If we could have the ability to change these weights based on how users rate each risk types it would allow us a more personal view on risk scores after the calculation has been done. This could could be achieved via uploading a file with new rates or, more involved, creating UI elements to select weights for critical, high, etc.
This may be opened up later to change the calculation but right now being able to change the severity weights would be a good starting point.
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.