Skip to content

Use ES to fetch vulnerability severity counts

What does this MR do and why?

Use elastic search to fetch vulnerability severity counts. The graphQL endpoint remains the same i.e, vulnerabilitySeverityCounts.

  1. Added owasp_top_10_2021 as a new argument to filter by owasp 2021 values. Works only with ES configured.
  2. If identifier_name param is passed we always use ES now if its configured. Which means no 20k vulnerability count limit!
  3. All the existing filters should work as expected on the endpoint.

References

Screenshots or screen recordings

Before After

How to set up and validate locally

  1. Ensure that ES is setup in local and the vulnerabilities Index is created.

  2. Ensure that local setup is running SASS mode steps here

  3. Enable the FF globally in rails console Feature.enable(:advanced_vulnerability_management)

  4. Go to Security > Vulnerability report and filter by Identifier. The vulnerability counts should be fetched from ES and it should match the count vulnerabilities returned.

  5. Go to GraphQL explorer http://gdk.test:3000/-/graphql-explorer and query for vulnerabilitySeveritiesCount with owaspTopTen2021 filter applied. It should also fetch counts from ES now.

    Example query
    {
      project(fullPath: "gitlab-org/yarn-remediation") {
        id
        vulnerabilitySeveritiesCount(owaspTopTen2021: A1_2021) {
          critical
          high
          medium
          low
          info
          unknown
        }
      }
    }
6. To test that the above mentioned call in 5 is actually using ES disable the FF and run the query again from GraphQL explorer. It should return an error. NOTE: Even after ff is disabled 4 should work.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Relates to - #534629 (closed) Relates to - #534633 (closed)

Edited by Rushik Subba

Merge request reports

Loading