Include Additional Information in Vulnerability Report export

Release notes

Include more comprehensive information in Security Dashboard exports to allow for complete and connected documentation. Additional fields enable linking of detections and responses that would otherwise be absent.

Problem to solve

The current export from the Vulnerability Report lacks information. The vulnerability objects contain more details than are exported. For example, what project/file/line the vulnerability was found in.

User experience goal

If somebody is exporting the data to CSV they are probably doing so because they need to maintain a record for security compliance, and the security dashboard isn't cutting it (#272485 (closed)). The export is great! However, it doesn't provide all the information that is available in the web UI.

image

image

Proposal

Include the following really useful fields in the CSV export for the Project, Group, and Security Center exports:

  • Date Detected
  • Location of detection
    • for files: file path and name, line number(s)
    • for apps/endpoints: the URL
    • for containers: the image name and container location
  • Activity, specifically if a vulnerability is no longer detected

Further details

Permissions and Security

Documentation

Update https://docs.gitlab.com/ee/user/application_security/security_dashboard/#export-vulnerabilities to capture the newly-added fields. It would be helpful to add examples of what the location fields might contain when the results is for a file, an image, or a URL.

Availability & Testing

What does success look like, and how can we measure that?

What is the type of buyer?

Is this a cross-stage feature?

Links / references

Implementation plan

  • Extend the exported attributes of Vulnerability by adding Location, Detected At and Activity in CsvService mapping
  • Use created_at field in mapping value for detected at in CsvService
  • Add location method as a delegate method to finding in vulnerability model delegate method list
  • Use finding_location(if we use prefix in delegate) in mapping value for location in CsvService
  • Use resolved_on_default_branch field in mapping value for Activity.
  • Update specs accordingly
Edited by Zamir Martins