DependencyTrack / DependencyTrack/dependency-track

Enhance metrics to include audited/unaudited violations by classification

Open
#3,612 2 comments 0 reactions 0 assignees View on GitHub
enhancement good first issue hacktoberfest p3 size/S
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

There are a number of APIs that return `metrics` information in the following shape

```
"metrics": {
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"unassigned": 0,
"vulnerabilities": 0,
"vulnerableComponents": 0,
"components": 0,
"suppressed": 0,
"findingsTotal": 0,
"findingsAudited": 0,
"findingsUnaudited": 0,
"inheritedRiskScore": 0.0,
"policyViolationsFail": 0,
"policyViolationsWarn": 0,
"policyViolationsInfo": 0,
"policyViolationsTotal": 0,
"policyViolationsAudited": 0,
"policyViolationsUnaudited": 0,
"policyViolationsSecurityTotal": 0,
"policyViolationsSecurityAudited": 0,
"policyViolationsSecurityUnaudited": 0,
"policyViolationsLicenseTotal": 0,
"policyViolationsLicenseAudited": 0,
"policyViolationsLicenseUnaudited": 0,
"policyViolationsOperationalTotal": 0,
"policyViolationsOperationalAudited": 0,
"policyViolationsOperationalUnaudited": 0,
"firstOccurrence": 1234567890,
"lastOccurrence": 1234567890
}
```

For some dimensions it provides total, audited and unaudited breakdowns, with the exception being
* policyViolationsFail
* policyViolationsWarn
* policyViolationsInfo

### Proposed Behavior

Enhance the `metrics` object to include the total/audited/unaudited breakdown

```
{
...
"policyViolationsFailTotal": 0,
"policyViolationsFailAudited": 0,
"policyViolationsFailUnaudited": 0,
"policyViolationsWarnTotal": 0,
"policyViolationsWarnAudited": 0,
"policyViolationsWarnUnaudited": 0,
"policyViolationsInfoTotal": 0,
"policyViolationsInfoAudited": 0,
"policyViolationsInfoUnaudited": 0,
...
}
```

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.