## Executive Summary The first release of the security dashboard is intended for users who want to use reporting to identify, analyze, and root cause security trends that indicate the most effective places to target their appsec efforts. This is distinct from release 2 which includes modules that demonstrate value to executives (as well as building upon the first use case). ### DRIs * PM: @mclausen35 * Engineer: tbd * EM: tbd * ~"group::security insights" * Engineering Owner: @nmccorrison ## Scope ### In scope 1. Risk score at the group level 2. Vulnerabilities over time at the project and group level 3. Vulnerability counts at the project and group level 4. Documented page level and panel level filters ### Out of scope * See Release 2 epic. ## Designs See associated epics ## Dependencies * Security Infrastructure ## Functional Requirements ### Page Level Support * [x] Project * [x] Group * [ ] Pipeline \> Security (findings) * [ ] MR Security Widget (findings) * [ ] Security Center * [x] Security Dashboard ### Workflow * [ ] Requires an additional filter on the Vulnerability Report ([docs](https://docs.gitlab.com/development/internal_analytics/internal_event_instrumentation/quick_start/)) * [ ] Requires an addition to the Vulnerability Report export ([docs](https://docs.gitlab.com/user/application_security/vulnerability_report/#exporting)) * [ ] Requires an additional filter on the Dependency List ([docs](https://docs.gitlab.com/user/application_security/dependency_list/)) * [ ] Requires an addition to the Dependency List export ([docs](https://docs.gitlab.com/user/application_security/dependency_list/#export)) * [x] Requires ~documentation ## Non-Functional Requirements ### Product Usage * [x] Requires new instrumentation ([docs](https://docs.gitlab.com/development/internal_analytics/internal_event_instrumentation/quick_start/)) ### Feature Flag Usage * [x] This feature should be released behind a feature flag? ([docs](https://handbook.gitlab.com/handbook/product-development/product-development-flow/feature-flag-lifecycle/#when-to-use-feature-flags)) ### Testing * [x] Requires new E2E test coverage ([docs](https://docs.gitlab.com/development/testing_guide/end_to_end/)) * [ ] Requires extended manual / UAT phase * [ ] Performance testing needed ([testing](https://docs.gitlab.com/ci/testing/load_performance_testing/))