Security Insight 17.9 Planning Issue
Summary
| Areas of focus | DRI | Delivery Scope for current milestone | Completion Milestone | Status (mid-milestone checkpoint) |
|---|---|---|---|---|
|
Support Filter by Identifier for group level (#508713 - closed) |
stage: implementation backend: @wandering_person frontend: @svedova |
Enable for Groups |
On Track Backend is complete. Frontend MR to add to UI is in review. Latest update #508713 (comment 2319959866) |
|
|
Efficient Dependency & Container Vulnerability ... (&11544 - closed) |
eng: @svedova |
EPSS, CVSS, KEV support for single vuln page. Waiting for GraphQL addition !177071 (merged). See &11544 (comment 2284618867) |
On Track Backend and Frontend are complete. Rolling out to test projects this week. Latest update &11544 (comment 2328920396) |
|
|
Implement EPSS / KEV / CVSS Filters (gitlab-com&2480 - closed) |
stage: spike backend: @bwill |
Filtering requires 3 new indices. We need to first understand our capabilities and if we can add these under the current database constrains. We will refine the first backend issue as a spike - [BE] [Post-MVC] Add support for filtering by EPSS (#511286) • Unassigned • Backlog |
Spike is complete Infrastructure has shared their analysis and plan to expand filtering capabilities. Waiting for scheduling &13510 (closed) |
|
|
Add `Reachable Library` to Vulnerability Report... (&16510 - closed) |
stage: implementation frontend: @sming-gitlab |
Add Reachable to Vulnerability Report and Details pages. [FE] Add "Reachable" to Vulnerability Report (#513995 - closed) [FE] Add "Reachable" To Vulnerability Details (#513989 - closed) backend work scheduled for 17.10 #513990 (closed) #513990 (closed) Out of scope: Filtering |
N/A for 17.9 Backend work is scheduled for 17.10. Optimistically we can implement frontend in 17.10. |
|
|
stage: implementation frontend: @lorenzvanherwaarden backend: @subashis |
Filter by component version |
Needs Attention Originally scoped to support < > operators, while it may only be possible to support EQ. This scope is additionally prioritized following the Enhanced Bulk Actions below. The team is discussing a revised proposal and will share this week. Latest update &16431 (comment 2326528127) |
||
|
typefeature Enhanced Bulk Actions for the Vulnerability Report (&13216 - closed) |
stage: implementation backend: @subashis frontend: @lorenzvanherwaarden |
|
On Track
Latest update &13216 (comment 2326519138) |
|
|
stage: design designer: @beckalippert |
Awaiting scheduling for refinement and implementation | |||
|
stage: implementation backend: @bwill frontend: TBD - likely 17.10 |
Dependency List On Track
Latest update #513149 (comment 2328552480)
Latest update #435843 (comment 2316342013) Vulnerability Report On Track
|
|||
|
Dependency list - Component Filter at the Proje... (&16490 - closed) |
stage: implementation backend: @wandering_person frontend: @sming-gitlab |
This is the first filter to be added to the project dependency list. It will take additional work to implement the scaffolding for search. |
On Track Feature is complete and enabled by default for 17.9. Documentation updated. Latest update &16490 (comment 2322231883) |
|
|
Inconsistent Display of Unknown Licenses Betwee... (#482764 - closed) |
stage: bug fix backend: @uokeadu |
At Risk for 17.9 due to incoming requirements and design updates. Development has started. The team is getting help on setting up test projects to replicate the varied examples. Latest update: #482764 (comment 2320273483) |
||
|
Closed. Was done by groupsecurity infrastructure |
||||
|
typefeature Split the "Tool" filter into separate filters f... (#503371 - closed) |
stage: implementation fullstack: @charlieeekroon |
On Track - Slightly Confident
Spike created for group report support. Latest update #503371 (comment 2326242485) |
||
|
Require a comment when dismissing vulnerabiliti... (#451480 - closed) |
stage: implementation frontend: @lorenzvanherwaarden |
Complete
Final update #451480 (comment 2317540665) |
||
|
https://gitlab.com/gitlab-com/security-risk-management-stage/-/issues/19+ |
stage: design design: @beckalippert |
https://gitlab.com/gitlab-com/security-risk-management-stage/-/issues/47+ @beckalippert to review and define which widgets to start with |
Started infrastructure discussion
|
Team member focuses
| Name | Focus Areas | Notes | |
|---|---|---|---|
| At capacity | |||
| At capacity | |||
| At capacity | |||
| At capacity | |||
|
At capacity | ||
| At capacity | |||
| At capacity | |||
|
At capacity | ||
| At capacity |
Projects
Filter by Identifier on the Vulnerability Report (gitlab-org#13340)
Filter by Identifier on the Vulnerability Report (&13340)
Design: Show EPSS, CVSS, KEV for CVEs (#427441 - closed)
Add filters for EPSS,CVSS, KEV
Duo Vulnerability Resolution: Gap Analysis for ... (gitlab-org#16060 - closed) • Meir Benayoun • At risk
https://gitlab.com/groups/gitlab-org/-/epics/16066+
Filter/Search Dependency List (Project / Group / JSON API / GraphQL API)
- Dependency list - Filter by specific version in... (#504984 - closed)
- Dependency list - Component Filter at the Proje... (#493775 - closed)
Vulnerability report and Dependency list exporting (&16290)
- https://gitlab.com/gitlab-org/gitlab/-/issues/425327+s
- Dependency list exports in CycloneDX SBoM forma... (#407453 - closed) • Unassigned • Backlog
Additional Risk Factors
Issue Creation Functionality
typemaintenance
typemaintenance focus
typebug focus
- Require a comment when dismissing vulnerabiliti... (#451480 - closed)
- Split the "Tool" filter into separate filters f... (#503371 - closed)
- Remove ignore rule of `vulnerability_count` col... (#497136 - closed) - Not yet planned for work -cc: @nmccorrison
- Failure in ee/browser_ui/10_govern/vulnerabilit... (#499388) - Not yet planned for work -cc: @nmccorrison
- Dependencies Export fails to validate SBOM usin... (#512133) - Not yet planned for work -cc: @nmccorrison
Scope being worked on by other teams
What's on the horizon?
Developer Advocacy
Features or maintenance items that the team would like to work on, where possible.
| Issue | Why | Type | BE/FE | Scope | Advocates |
|---|---|---|---|---|---|
| [Docs] Document how to generate vulnerabilities... (#509332) • Savas Vedova, Charlie Kroon | It can be difficult to properly test locally. Especially new datapoints like our scoring metrics. | typemaintenance | documentation | Small | @svedova @charlieeekroon |
| Migrate dependency page away from Vuex (#514535) • Samantha Ming • Backlog | Continuing to use a deprecated stack increases risk and slows down feature delivery. Let's migrate away now while the disruption is low. | typemaintenance | frontend & backend | Medium | @sming-gitlab |
Team OKRs
Planning Boards
- Delivery Board - columns are workflow labels
- Planning Board - columns are milestones
- Who's Working on What? - columns are individual team members
- Bug board - columns are severity and priority
-
Set the Milestone (current Milestone) -
Update the Milestone link for the Delivery Board -
Set the Due Date for the end of the current Milestone