DependencyTrack / DependencyTrack/dependency-track

Usability of VulnerabilityAudit

Open
#3,841 2 comments 2 reactions 0 assignees View on GitHub
enhancement good first issue p3 size/M
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

![Audit](https://github.com/DependencyTrack/dependency-track/assets/11981532/5dd64d66-415c-4491-b3dc-62b0421b86fd)

Add EPSS score and EPSS Percentile to column list (frontend, backend supplies necessary columns already)
Put from-to-filter-fields in one row (please see date fields)
Use a checkbox and a multi-range-slider for CVSSv2, CVSSv3 and new fields EPSS score and EPSS Percentile. The checkbox shows and hides the slider, and is responible for adding them to querystring.
Make data types of these fields "number". The checkbox value is better than an empty or non-emty "string".
Put CVSSv2, CVSSv3, EPSS score and EPSS Percentile on top of all filters. This are the criteria really used for audits, not comments, vendor responses, dates and text searches.
Do not forget to invert the showInactive flag (getAllFindings, getAllFindingsGroupedByVulnerability):

**_if (!showInactive) {_**
//End GOV
queryFilter.append(" WHERE (\"PROJECT\".\"ACTIVE\" = :active OR \"PROJECT\".\"ACTIVE\" IS NULL)");
params.put("active", true);
}

### Proposed Behavior

Show the correct projects and make it easier to use.
Provide EPSS score and EPSS Percentile
Think about, how companies would define their risk appetite.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.