## Problem to Solve Users encounter false positives in SAST. AI will help them identify which ones might be worth considering FPs earlier and with more efficiency. ## In Scope * Overview of number of false positives to potentially analyze vs the total number of vulnerabilities or blockers * The ability to save progress in case they accidentally close the false positive analysis modal with progress (this may move to out of scope depending on the level of effort required) * FP vulnerabilities dismissed from the current pipeline should change state and move to dismissed once the status is changed, similar to what is being discussed on the pipeline page [here](https://gitlab.com/gitlab-org/gitlab/-/issues/554078#note_2686677755). Status of vulnerabilities should be reflected in the MR widget (which already happens) * If an FP Vuln dismissed and a \_later\_ pipeline runs, it should stay dismissed and not show up. (I would expect this to be normal behavior) ## Out of Scope TBD ## Designs Design issue - [&563032](https://gitlab.com/gitlab-org/gitlab/-/issues/563032) ## Dependencies * Dependent on AI team ## Functional Requirements ### Page Level Support * [x] Project * [x] Group * [ ] Security Center * [ ] Security Dashboard ### Workflow * [x] Requires an additional filter on the Vulnerability Report ([docs](https://docs.gitlab.com/development/internal_analytics/internal_event_instrumentation/quick_start/)) * [x] Requires an addition to the Vulnerability Report export ([docs](https://docs.gitlab.com/user/application_security/vulnerability_report/#exporting)) * [ ] Requires an additional filter on the Dependency List ([docs](https://docs.gitlab.com/user/application_security/dependency_list/)) * [ ] Requires an addition to the Dependency List export ([docs](https://docs.gitlab.com/user/application_security/dependency_list/#export)) * [ ] Requires ~documentation ## Non-Functional Requirements ### Product Usage * [x] Requires new instrumentation - instrumentation on the FP modal is required. ### Feature Flag Usage * [ ] This feature should be released behind a feature flag? ### Testing * [ ] Requires new E2E test coverage ([docs](https://docs.gitlab.com/development/testing_guide/end_to_end/)) * [ ] Requires extended manual / UAT phase * [ ] Performance testing needed ([testing](https://docs.gitlab.com/ci/testing/load_performance_testing/)) ## Outstanding Questions <table> <tr> <th>Question</th> <th>Assignee</th> <th>Priority</th> <th>Blocking?</th> </tr> <tr> <th></th> <th></th> <th></th> <td></td> </tr> </table>