search

microsoft / sarif-azuredevops-extension

MIT License
9 stars 4 forks source link

Description of how filters (Unchange, New, ..) are working #27

Closed MTomBosch closed 2 months ago

MTomBosch commented 4 months ago

We started to use this extension and we like it so far.

Now we would like e.g. to see which new findings have been introduced and we have seen the "Baseline" filters on the view.

In case I am using the filter "New" against which baseline of findings the current findings are being compared?

What is the definition of baseline?

krscheetas commented 3 months ago

Also wondering about this.

EasyRhinoMSFT commented 3 months ago

Guten Tag! Thanks for your question. I'll investigate our current implementation and post my findings here.

MTomBosch commented 3 months ago

Maybe one more question related to filters. In the "Scans" tab of the work item there is the filter "Suppressed" visible but in the scans tab of the pipeline this filter is gone and by default all suppressed isses are filtered out. Is there any chance to add this filter to the scans tab of the pipeline?

EasyRhinoMSFT commented 2 months ago

@jeffersonking can you chime in please

jeffersonking commented 2 months ago

@MTomBosch What is the definition of baseline? The viewer is simply showing the baselineState property of the result. So it would depend on what is generating your SARIF files. IIRC, typically people will fetch the SARIF log from previous build, and use the SARIF multitool (with command match-results-forward) to generate a "diff" SARIF that has a meaningful baselineState for each result.

For the "Suppressed" filter, it is configured the same between work items and pipelines. Perhaps the underlying SARIF file is the issue?

MTomBosch commented 2 months ago

Thanks for the answer. I will try it out. In case of issues I will file a new issue.