DependencyTrack / DependencyTrack/dependency-track
Include tags in NEW_VULNERABILITY alerts
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
We are using a Jira integration where a new **Vulnerability** ticket is created for every vulnerability identified by DepTrack 4.13.2. We have a Jira custom field _Service_, with a predefined list of values. Setting this field automatically adds the relevant people as watchers of the ticket, which is hugely important for us to have these tickets tended to immediately (we need to meet SLRs on these). To set this custom field, we added tags to each of the projects in DepTrack (each tags is one of the values from the list of values for this custom field). We would like to use the (first) project tag to fill the custom field _Service_ on the tickets DepTrack creates in Jira.
Alert notifications in Dependency-Track for new vulnerabilities (`NEW_VULNERABILITY`) and new vulnerable dependency (`NEW_VULNERABLE_DEPENDENCY`) will send the details of the project(s) in members `notification.subject.affectedProjects` and `notification.subject.project`, respectively. However, the tags of the project are not included.
### Proposed Behavior
Please include the project tags in alert notifications payloads for new vulnerabilities (`NEW_VULNERABILITY`) and new vulnerable dependency (`NEW_VULNERABLE_DEPENDENCY`), in members `notification.subject.affectedProjects[...].tags` and `notification.subject.project.tags`, respectively.
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.