DependencyTrack / DependencyTrack/dependency-track

Forward `vulnerability.analysis.detail` to DefectDojo

Open
#6,169 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Findings forwarded by the DefectDojo integration include the standard fields (title, severity, component name and version, CVE/GHSA identifiers, mitigation, references) plus a single `file_path` that holds the bare artifact filename. The rich audit text stored in `vulnerability.analysis.detail` on the corresponding DT vulnerability is not part of the payload that DefectDojo receives.

### Proposed Behavior

Include `vulnerability.analysis.detail` in the DefectDojo finding the publisher creates. The natural target is either an extension of the `description` field (appended after a separator so existing parsers keep working) or a dedicated field that DefectDojo's parser can render alongside the description.

This would let downstream auditors see the same context DT shows in its audit UI without context switching back to DT for the same vulnerability.

## Why this matters

In setups where DefectDojo is the primary triage surface and DT is the SBOM ingestion engine, the `analysis.detail` text is where the actionable per-finding information lives. Typical content we put there:

- Severity and CVSS at the top for quick scanning
- All `depscan:*` properties (`insights`, `prioritized`, etc.)
- Usage locations from the companion SBOM (`evidence.occurrences[].location` with `#line` anchors for js and ts, consuming projects derived from each component's `SrcFile` properties for dotnet, `ImportedModules` when present)
- Atom call paths from `*reachables.slices.json` when reachability analysis ran

Once a finding is in DefectDojo, none of this is reachable from there today.

## Related

#5843 (closed) requested similar enrichment for CVSS vectors, references, and publish date. This issue is in the same direction (more vulnerability metadata from DT reaching DefectDojo) but covers the audit text specifically.

## Environment

- Dependency-Track version: 4.14
- DefectDojo version: v.2.56.4
- Integration mechanism: built-in DefectDojo publisher driven by project `integrations:defectdojo.engagementId` property

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.