### Release notes TBD ### Progress - [x] Design issue: https://gitlab.com/gitlab-org/gitlab/-/issues/234193 - [x] Decompose into MVC(s) (~"workflow::planning breakdown" outcome) - [ ] MVC 1 - Implement on Project Security Dashboard (tentative) - [ ] MVC 2 - Implement on Group Security Dashboard (tentative) - [ ] MVC 3 - Implement on Security Center Dashboard (tentative) ### Problem to solve Today we show trend data about vulnerabilities by severity, which is great for helping users understand how their project(s) are performing historically. Next, to further enhance the dashboard experience, we should show users vulnerabilities by age. This will allow teams to identify vulnerabilities that may be slipping past their SLAs. ### User experience goal **When** I am managing vulnerabilities for my organization, **I want** to quickly identify remediations that are slipping, **so I can** take escalation action and avoid missing an SLA or worse, have my organization breached. ### Proposal Add a [stacked column chart](https://gitlab-org.gitlab.io/gitlab-ui/?path=/story/charts-stacked-column-chart--with-zoom-and-scroll) that allows users to visualize the age-range of a vulnerability based on conventional time buckets. Refer to the [Design Issue for mockups](https://gitlab.com/gitlab-org/gitlab/-/issues/234193). ### Further details The proposed order is to start by adding this chart to the Project Security Dashboard, then the Group, and finally the Security Center. The intent is that by doing Project first, we will establish a good pattern to follow. At the same time, we will be dealing with a lot more data on the Group and Security Center versions. We need to think through potential performance/scalability challenges of aggregating data from many projects (and projects inside sub-groups). ### Requirements Specific chart behaviors: * Users can toggle between a stacked column and [tiled column chart](https://gitlab-org.gitlab.io/gitlab-ui/?path=/story/charts-stacked-column-chart--tiled) (see mocks) * Users can click on the values in the legend to toggle on/off displaying data for a given severity (similar to how vulnerability trends chart works on Project Security Dashboard). Chart data will refresh in real time. ##### Metrics To help determine if users are engaging with this new component, ideally we can capture any direct interactions. Specifically, record when: * a user changes between chart types (stacked column, tiled column) * a user clicks to toggle on/off displaying data for a particular severity ##### Additional requirements * This chart is available and performant for both gitlab.com and self-managed customers * This chart is on by default (no configuration or FF required to see it on the Security Dashboard once released) ### Permissions and Security Permissions for accessing and viewing this dashboard component are the same as the exiting Dashboards and components. **NOTE:** Make sure that [Auditor users](https://docs.gitlab.com/ee/administration/auditor_users.html) are able to utilize this new component across all dashboard levels. Pay particular attention to the Security Center Dashboard. Auditor users should be able to see this graph reflect all projects to which they have added to their Security Center view. ### Documentation Add details and screenshots (as relevant) under the respective Group, Project, and Security Center sections for Security Dashboards: https://docs.gitlab.com/ee/user/application_security/security_dashboard/ ### Availability & Testing ### What is the type of buyer? ~"GitLab Ultimate" ### Links / references <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION --> *This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.* <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION -->