search

DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
https://dependencytrack.org/
Apache License 2.0
2.68k stars 577 forks source link

Ability to scope components/vulnerabilties #927

Open ScottChapman opened 3 years ago

ScottChapman commented 3 years ago

When used by multiple teams, it is important to be able to understand what applies to the set of projects they are responsible for. So, being able to establish "scope" results in other views (i.e. component and vulnerability views) to a subset of projects (which might be established by ACL or search or something else)

There are clearly different ways of achieving this so I'll try to be implementation agnostic. But the basic idea is that there are only a subset of the projects I am interested in, so I'd like to only have to look through results that apply to those projects.

stevespringett commented 3 years ago

Restricting access to projects based on ACL is planned #140. It's one of my highest priority items and will likely take an entire release to get right.

Also, you can use tags already to group projects together so that you're only seeing the projects you care about. That is not the default view however, nor is it restricted.

ScottChapman commented 3 years ago

Right, I saw #140 That probably does help, except for people participating in more than one team I suppose.

I see how you can filter projects by a tag (that helps). Maybe a solution is to provide a search option for components that let you filter by projects containing a specific tag; so if you scope the search of projects by a tag, then that would similarly scope the components/vulnerabilities to those projects,