Extend the vulnerability status model to incorporate Open/Closed States

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

Proposal

Our ultimate goal is to usher users downstream with vulnerability statuses, in the simplest way possible. So considering Open as a parent status would equate to Open:Needs triage and Open:Confiremd. Both require work to get to Closed:Resolved or Closed:Dismissed. With this paradigm we simplify the triage experience down to Open vs Closed while adding in granularity.

What this would eventually look like while taking into account dismissal reasons, auto-resolve, new UX of MR/Vuln interaction, and even the conceptual auto-dismiss and reopening of vulns:

End state status organization End state status flow
Status_relationships__end_state Screen_Shot_2021-08-19_at_1.16.51_PM

Findings vs Vulnerabilities

This model proposes uniques statuses for both findings and vulnerabilities. Given findings are meant to be ephemeral, (detected or not detected) one could argue the only statuses needed are detected, Ignored and fixed. See more details on ignoring findings in this issue.

New Findings

graph TD;
  Finding:Status_Detected-->Finding:Status_Ignored;
  Finding:Status_Detected-->Finding:Status_Fixed;
  Finding:Status_Detected-->Branch_Merged;
  Branch_Merged-->Vulnerability:Status_Needs_Triage;
  Finding:Status_Ignored-->Branch_Merged;

Details

More TBD

Edited by 🤖 GitLab Bot 🤖