aquasecurity / aquasecurity/trivy-plugin-count
Add Option to Count Vulnerabilities by Selected Severity
- Dominant language
- Go
- Stars
- 5
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
Thank you for the continuous improvements and the robust tooling you provide. I would like to suggest a feature enhancement to the Trivy plugin system.
The idea is to enable plugins to count vulnerabilities based on a selected severity level, such as CRITICAL, HIGH, MEDIUM, or LOW. In many use cases, especially when integrating Trivy results into dashboards or CI/CD pipelines, teams need to track metrics like the number of critical or medium vulnerabilities for compliance and internal KPIs.
The idea would be to add an option such as --severity and to be able to retrieve KPIs only from a specific given criticality.
Additionally, for another recommendation of improvement, would it be possible to use in the future an option that would allow a user to distinguish vulnerabilities with several occurrences ? That would allow us to display only distinct vulnerabilities and avoid duplicates in the final vulnerability count.
Thanks again for the great work!
Contributor guide
Research direction
The issue names no files, tests, or entry points, so first locate the plugin's option parsing and vulnerability-counting logic. Define how a severity filter and distinct-vulnerability counting should behave, then add coverage showing the requested counts before considering the work complete.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100