DependencyTrack / DependencyTrack/dependency-track

Add Risk Score to Project Vulnerabilities graph

Open
#3,348 0 comments 2 reactions 0 assignees View on GitHub
enhancement p3
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
9h 4m
Merged PRs (30d)
229

Description

### Current Behavior

You provide a nice graph to show the total number of Vulnerabilities grouped by their level. You also show the current Risk Score at the bottom of the graph.
![image](https://github.com/DependencyTrack/dependency-track/assets/945587/6d6924b5-8b99-4e60-8425-af9e8635dfc4)

### Proposed Behavior

It would be nice to have the Risk Score also shown in the graph to also see the improvements made over time. It could be an independent graph, but in my opinion it would be best to have it included in the same graph with its own y-axis. At the moment, fixing a critical vulnerability only decreases one graph by 1, same as it would be a medium one. Showing the Risk Score would be reflect also the importance of your improvements with bigger jumps and it would provide you the values of the past.
![image](https://github.com/DependencyTrack/dependency-track/assets/945587/ed3633e4-2681-4fd5-93cd-480abad9c6eb)

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Research direction

Start by locating the Project Vulnerabilities graph and the code that supplies its historical vulnerability counts and Risk Score. Determine whether historical Risk Score data is available; done means the graph shows Risk Score over time with its own scale or axis while preserving the vulnerability-level series.

Written by the indexing model from the issue text.

Assessment

Domain
data-visualization, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.