DependencyTrack / DependencyTrack/dependency-track
Usability of VulnerabilityAudit
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior

Add EPSS score and EPSS Percentile to column list (frontend, backend supplies necessary columns already)
Put from-to-filter-fields in one row (please see date fields)
Use a checkbox and a multi-range-slider for CVSSv2, CVSSv3 and new fields EPSS score and EPSS Percentile. The checkbox shows and hides the slider, and is responible for adding them to querystring.
Make data types of these fields "number". The checkbox value is better than an empty or non-emty "string".
Put CVSSv2, CVSSv3, EPSS score and EPSS Percentile on top of all filters. This are the criteria really used for audits, not comments, vendor responses, dates and text searches.
Do not forget to invert the showInactive flag (getAllFindings, getAllFindingsGroupedByVulnerability):
**_if (!showInactive) {_**
//End GOV
queryFilter.append(" WHERE (\"PROJECT\".\"ACTIVE\" = :active OR \"PROJECT\".\"ACTIVE\" IS NULL)");
params.put("active", true);
}
### Proposed Behavior
Show the correct projects and make it easier to use.
Provide EPSS score and EPSS Percentile
Think about, how companies would define their risk appetite.
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.