DependencyTrack / DependencyTrack/dependency-track
Enhance metrics to include audited/unaudited violations by classification
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
There are a number of APIs that return `metrics` information in the following shape
```
"metrics": {
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"unassigned": 0,
"vulnerabilities": 0,
"vulnerableComponents": 0,
"components": 0,
"suppressed": 0,
"findingsTotal": 0,
"findingsAudited": 0,
"findingsUnaudited": 0,
"inheritedRiskScore": 0.0,
"policyViolationsFail": 0,
"policyViolationsWarn": 0,
"policyViolationsInfo": 0,
"policyViolationsTotal": 0,
"policyViolationsAudited": 0,
"policyViolationsUnaudited": 0,
"policyViolationsSecurityTotal": 0,
"policyViolationsSecurityAudited": 0,
"policyViolationsSecurityUnaudited": 0,
"policyViolationsLicenseTotal": 0,
"policyViolationsLicenseAudited": 0,
"policyViolationsLicenseUnaudited": 0,
"policyViolationsOperationalTotal": 0,
"policyViolationsOperationalAudited": 0,
"policyViolationsOperationalUnaudited": 0,
"firstOccurrence": 1234567890,
"lastOccurrence": 1234567890
}
```
For some dimensions it provides total, audited and unaudited breakdowns, with the exception being
* policyViolationsFail
* policyViolationsWarn
* policyViolationsInfo
### Proposed Behavior
Enhance the `metrics` object to include the total/audited/unaudited breakdown
```
{
...
"policyViolationsFailTotal": 0,
"policyViolationsFailAudited": 0,
"policyViolationsFailUnaudited": 0,
"policyViolationsWarnTotal": 0,
"policyViolationsWarnAudited": 0,
"policyViolationsWarnUnaudited": 0,
"policyViolationsInfoTotal": 0,
"policyViolationsInfoAudited": 0,
"policyViolationsInfoUnaudited": 0,
...
}
```
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.