search

DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
https://dependencytrack.org/
Apache License 2.0
2.46k stars 536 forks source link

Make components page default show all components #3719

Open starfishfive opened 2 months ago

starfishfive commented 2 months ago

Current Behavior

Displays No matching records found

This is a dealbreaker to comply with CIS Control 16.4

Proposed Behavior

Show a list of all components.

Checklist

valentijnscholten commented 2 months ago

I agree that the search on the Components page is very limited and could use some improvements. But what exact use-case can you currently not perform good enough to comply with CIS Control 6.4? Dependency Track does exactly what is stated in the requirements:

Establish and manage an updated inventory of third-party components used in development, often referred to as a “bill of materials,” as well as components slated for future use. This inventory is to include any risks that each third-party component could pose. Evaluate the list at least monthly to identify any changes or updates to these components, and validate that the component is still supported.

starfishfive commented 2 months ago

@valentijnscholten I would like the posibility to go trough the complete list, to insure that each component has:

  1. Risk associated with component (Risk Score)
  2. Whether component is supported (Version/Latest Version) - Future enhancement add depecrated true/false column?

As stated by the CIS assessment specification of safeguard 16.4