DependencyTrack / DependencyTrack/dependency-track

Include tags in NEW_VULNERABILITY alerts

Open
#5,086 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

We are using a Jira integration where a new **Vulnerability** ticket is created for every vulnerability identified by DepTrack 4.13.2. We have a Jira custom field _Service_, with a predefined list of values. Setting this field automatically adds the relevant people as watchers of the ticket, which is hugely important for us to have these tickets tended to immediately (we need to meet SLRs on these). To set this custom field, we added tags to each of the projects in DepTrack (each tags is one of the values from the list of values for this custom field). We would like to use the (first) project tag to fill the custom field _Service_ on the tickets DepTrack creates in Jira.

Alert notifications in Dependency-Track for new vulnerabilities (`NEW_VULNERABILITY`) and new vulnerable dependency (`NEW_VULNERABLE_DEPENDENCY`) will send the details of the project(s) in members `notification.subject.affectedProjects` and `notification.subject.project`, respectively. However, the tags of the project are not included.

### Proposed Behavior

Please include the project tags in alert notifications payloads for new vulnerabilities (`NEW_VULNERABILITY`) and new vulnerable dependency (`NEW_VULNERABLE_DEPENDENCY`), in members `notification.subject.affectedProjects[...].tags` and `notification.subject.project.tags`, respectively.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.