EPSS Data Displayed Everywhere (#9621)

* On Findings list, separate EPSS scores and percentiles into separate columns for sorting. Specify the sort function for datatables to use. * On Test view Findings list, show EPSS scores and percentiles. * Show EPSS score/percentile on similar Findings listing * Show EPSS info on Finding listing on Endpoint view * Add a template tag for formatting EPSS values; use that when displaying EPSS-related values * Show EPSS score/percentile on product tag/type count metrics views * Show EPPS info on vulnerabilities section of simple search * Remove repeated "%" sign from EPSS outputs * Add EPSS data to report builder findings list and html report * Show EPSS data on product endpoint report * Show EPSS data on product report request findings table * Show EPSS data on product report * Show EPSS data on product type report * Remove unneeded % suffix from test findings list * Show EPSS data on view risk acceptance findings list * Show EPSS data in Test report * Add EPSS data to finding report * Show EPSS data on engagement report * Show EPSS data on asciidoc report * Show EPSS data on asciidoc report: endpoints * Show EPSS data on endpoint pdf report * Show EPSS data on custom report endpoint list * Spacing on asciidoc report * Show EPSS data on custom asciidoc reports * Fix custom report endpoint list to remove unneeded nested <td> * Show EPSS data on metrics page
DefectDojo · Feb 27, 2024 · cd30f42 · cd30f42
1 parent ec4abc5
commit cd30f42
Show file tree

Hide file tree

Showing 26 changed files with 210 additions and 32 deletions.
diff --git a/dojo/reports/views.py b/dojo/reports/views.py
@@ -288,7 +288,7 @@ def product_endpoint_report(request, pid):
                            'verified_findings': verified_findings,
                            'engagement': None,
                            'test': None,
-                           'endpoints': endpoints,
+                           'endpoints': endpoints.qs,
                            'endpoint': None,
                            'findings': None,
                            'include_finding_notes': include_finding_notes,

diff --git a/dojo/templates/dojo/asciidoc_report.html b/dojo/templates/dojo/asciidoc_report.html
@@ -222,12 +222,13 @@ <h3 id="test_notes">== Test Notes ==</h3>
     {% if engagement.risk_acceptance.count %}
         <h3 id="risk_acceptance">== ?Risk Accepted Findings ==</h3>
         |===<br>
-        |Name |Date |Severity<br>
+        |Name |Date |Severity |EPSS Score / Percentile<br>
         {% for risk in engagement.risk_acceptance.all %}
             {% for finding in risk.accepted_findings.all %}
                 |{{ finding.title }}<br>
                 |{{ finding.date }}<br>
                 |{{ finding.severity }}<br>
+                |{{ finding.epss_score|format_epss }} / {{ finding.epss_percentile|format_epss }}<br>
             {% endfor %}
         {% endfor %}
         |===<br>
@@ -279,6 +280,12 @@ <h4>==== Finding {{ find.id }}: {{ find.title | nice_title }} {% if find.mitigat
 {{ find.severity }} ({{ find.numerical_severity }})
 </span>
         </p>
+        <br>
+        <p><b>==== EPSS Score / Percentile: ====</b>
+            <br>
+            {{ find.epss_score|format_epss }} / {{ find.epss_percentile|format_epss }}
+        </p>
+        <br>
         <p><b>==== Description / Exploit: ====</b>
             <br>
             {{ find.description|linebreaksbr }}
@@ -432,6 +439,12 @@ <h5>==== Finding {{ find.id }}: {{ find.title | nice_title }} {% if find.mitigat
 {{ find.severity }} ({{ find.numerical_severity }})
 </span>
                 </p>
+                <br>
+                <p><b>==== EPSS Score / Percentile: ====</b>
+                    <br>
+                    {{ find.epss_score|format_epss }} / {{ find.epss_percentile|format_epss }}
+                </p>
+                <br>
                 <p><b>==== Description / Exploit: ====</b>
                     <br>
                     {{ find.description|linebreaksbr }}

diff --git a/dojo/templates/dojo/custom_asciidoc_report_endpoints.html b/dojo/templates/dojo/custom_asciidoc_report_endpoints.html
@@ -31,6 +31,7 @@ <h5>==== Finding {{ find.id }}: {{ find.title | nice_title }} {% if find.mitigat
                 <br>
                 {{ find.status }}
             </p>
+            <br>
             <p><b>==== CVSSv3: ====</b>
             <br>
                 {{ find.cvssv3|linebreaksbr }}
@@ -47,6 +48,12 @@ <h5>==== Finding {{ find.id }}: {{ find.title | nice_title }} {% if find.mitigat
 {{ find.severity }} ({{ find.numerical_severity }})
 </span>
             </p>
+            <br>
+            <p><b>==== EPSS Score / Percentile: ====</b>
+                <br>
+                {{ find.epss_score|format_epss }} / {{ find.epss_percentile|format_epss }}
+            </p>
+            <br>
             <p><b>==== Description / Exploit: ====</b>
                 <br>
                 {{ find.description|linebreaksbr }}

diff --git a/dojo/templates/dojo/custom_asciidoc_report_findings.html b/dojo/templates/dojo/custom_asciidoc_report_findings.html
@@ -48,6 +48,12 @@ <h4>==== {{ find.title | nice_title }} {% if find.mitigated %}
 {{ find.severity }} ({{ find.numerical_severity }})
 </span>
     </p>
+    <br>
+    <p><b>==== EPSS Score / Percentile: ====</b>
+        <br>
+        {{ find.epss_score|format_epss }} / {{ find.epss_percentile|format_epss }}
+    </p>
+    <br>
     <p><b>==== Description / Exploit: ====</b>
         <br>
         {{ find.description|linebreaksbr }}

diff --git a/dojo/templates/dojo/custom_html_report_endpoint_list.html b/dojo/templates/dojo/custom_html_report_endpoint_list.html
@@ -49,6 +49,7 @@ <h5>
                     <table id="heading" class="table-striped table table-condensed table-hover centered">
                         <tr>
                             <th>Severity</th>
+                            <th>EPSS Score / Percentile</th>
                             <th>Status</th>
                             {% if finding.risk_acceptance_set.all %}
                                 <th>Acceptance</th>
@@ -75,6 +76,11 @@ <h5>
                                 {% endif %}
                             </span>
                             </td>
+                            <td>
+                                {{ finding.epss_score|format_epss }}
+                                /
+                                {{ finding.epss_percentile|format_epss }}
+                            </td>
                             <td>{{ finding.status }}</td>
                             {% if finding.risk_acceptance_set.all %}
                                 <td>

diff --git a/dojo/templates/dojo/custom_html_report_finding_list.html b/dojo/templates/dojo/custom_html_report_finding_list.html
@@ -34,6 +34,7 @@ <h5>
                  <table id="heading" class="table-striped table table-condensed table-hover centered">
                     <tr>
                         <th>Severity</th>
+                        <th>EPSS Score / Percentile</th>
                         <th>Status</th>
                         {% if finding.risk_acceptance_set.all %}
                             <th>Acceptance</th>
@@ -66,6 +67,9 @@ <h5>
                                 {% endif %}
                             </span>
                         </td>
+                        <td>
+                            {{ finding.epss_score|format_epss }} / {{ finding.epss_percentile|format_epss }}
+                        </td>
                         <td>{{ finding.status }}</td>
                         {% if finding.risk_acceptance_set.all %}
                             <td>

diff --git a/dojo/templates/dojo/endpoint_pdf_report.html b/dojo/templates/dojo/endpoint_pdf_report.html
@@ -112,6 +112,7 @@ <h5>
                             <table id="notes" class="table-striped table table-condensed table-hover centered">
                                 <tr>
                                     <th>Severity</th>
+                                    <th>EPSS Score / Percentile</th>
                                     <th>Status</th>
                                     {% if finding.risk_acceptance_set.all %}
                                         <th>Acceptance</th>
@@ -137,6 +138,11 @@ <h5>
                                         {% endif %}
                                     </span>
                                     </td>
+                                    <td>
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                     <td>{{ finding.status }}</td>
                                     {% if finding.risk_acceptance_set.all %}
                                         <td>

diff --git a/dojo/templates/dojo/engagement_pdf_report.html b/dojo/templates/dojo/engagement_pdf_report.html
@@ -194,13 +194,21 @@ <h3 id="risk_acceptance">Risk Accepted Findings</h3>
                             <th style="text-align: center;padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">
                                 Severity
                             </th>
+                            <th style="text-align: center;padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">
+                                EPSS Score / Percentile
+                            </th>
                         </tr>
                         {% for risk in engagement.risk_acceptance.all %}
                             {% for finding in risk.accepted_findings.all %}
                                 <tr>
                                     <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">{{ finding.title }}</td>
                                     <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">{{ finding.date }}</td>
                                     <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">{{ finding.severity }}</td>
+                                    <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                 </tr>
                             {% endfor %}
                         {% endfor %}
@@ -236,6 +244,7 @@ <h5>
                             <table id="notes" class="table-striped table table-condensed table-hover centered">
                                 <tr>
                                     <th>Severity</th>
+                                    <th>EPSS Score / Percentile</th>
                                     <th>Status</th>
                                     {% if finding.risk_acceptance_set.all %}
                                         <th>Acceptance</th>
@@ -262,6 +271,11 @@ <h5>
                                         {% endif %}
                                     </span>
                                     </td>
+                                    <td>
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                     <td>{{ finding.status }}</td>
                                     {% if finding.risk_acceptance_set.all %}
                                         <td>

diff --git a/dojo/templates/dojo/finding_pdf_report.html b/dojo/templates/dojo/finding_pdf_report.html
@@ -88,6 +88,7 @@ <h5>
                             <table id="notes" class="table-striped table table-condensed table-hover centered">
                                 <tr>
                                     <th>Severity</th>
+                                    <th>EPSS Score / Percentile</th>
                                     <th>Status</th>
                                     {% if finding.risk_acceptance_set.all %}
                                         <th>Acceptance</th>
@@ -113,6 +114,11 @@ <h5>
                                         {% endif %}
                                     </span>
                                     </td>
+                                    <td>
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                     <td>{{ finding.status }}</td>
                                     {% if finding.risk_acceptance_set.all %}
                                         <td>

diff --git a/dojo/templates/dojo/finding_related_list.html b/dojo/templates/dojo/finding_related_list.html
@@ -4,7 +4,7 @@
     {% include "dojo/paging_snippet.html" with page=finding_list prefix=prefix page_size=True %}
 </div>
 <table id="{{prefix}}_findings_table" class="table table-striped table-hover centered no-bottom-margin">
-    <tr>
+    <thead>
         <th>Relationship</th>
         <th>Severity</th>
         <th>Title</th>
@@ -15,12 +15,14 @@
         <th>Product</th>
         <th>CWE</th>
         <th>Vulnerability Id</th>
+        <th>EPSS Score</th>
+        <th>EPSS Percentile</th>
         <th>File</th>
         {% if system_settings.enable_jira %}
             <th>JIRA</th>
         {% endif %}
         <th>Action</th>
-    </tr>
+    </thead>
 
     {% if finding_first_related %}
         {% include "dojo/finding_related_row.html" with similar_finding=finding_first_related finding_context=finding %}

diff --git a/dojo/templates/dojo/finding_related_row.html b/dojo/templates/dojo/finding_related_row.html
@@ -49,6 +49,8 @@
         {% endif %}
     </td>
     <td>{{ similar_finding.cve }}</td>
+    <td>{{ similar_finding.epss_score|format_epss }}</td>
+    <td>{{ similar_finding.epss_percentile|format_epss }}</td>
     {% if similar_finding.file_path %}
         <td title="{{similar_finding.file_path}}{% if similar_finding.line > 0 %} (Line {{ similar_finding.line }}){% endif %}">
             {{ similar_finding.file_path|truncatechars_html:20 }}{% if similar_finding.line > 0 %} (Line {{ similar_finding.line }}){% endif %}

diff --git a/dojo/templates/dojo/findings_list_snippet.html b/dojo/templates/dojo/findings_list_snippet.html
@@ -2,7 +2,6 @@
 {% load display_tags %}
 {% load authorization_tags %}
 {% load get_endpoint_status %}
-{% load multiply %}
 {% load static %}
 {% load i18n %}
 {% block findings_list %}
@@ -324,7 +323,10 @@ <h3 class="has-filters">
                                         {% trans "Vulnerability Id" %}
                                     </th>
                                     <th>
-                                        {% trans "EPSS Score" %} / {% trans "Percentile" %}
+                                        {% trans "EPSS Score" %}
+                                    </th>
+                                    <th>
+                                        {% trans "EPSS Percentile" %}
                                     </th>
                                     <th class="nowrap">
                                         {% if filter_name == 'Closed' %}
@@ -598,17 +600,10 @@ <h3 class="has-filters">
                                             {% endwith %}
                                         </td>
                                         <td class="nowrap">
-                                            {% if finding.epss_score is not None %}
-                                                {{ finding.epss_score|multiply:100|floatformat:"2" }}%
-                                            {% else %}
-                                                N.A.
-                                            {% endif %}
-                                            /
-                                            {% if finding.epss_percentile is not None %}
-                                                {{ finding.epss_percentile|multiply:100|floatformat:"2" }}%
-                                            {% else %}
-                                                N.A.
-                                            {% endif %}
+                                            {{ finding.epss_score|format_epss }}
+                                        </td>
+                                        <td class="nowrap">
+                                            {{ finding.epss_percentile|format_epss }}
                                         </td>
                                         <td class="nowrap">
                                             {% if filter_name == 'Closed' %}
@@ -727,6 +722,12 @@ <h3 class="has-filters">
     <script type="application/javascript" src="{% static "chosen-js/chosen.jquery.min.js" %}"></script>
     <script type="application/javascript">
         {% block datatables_columns %}
+            var percentSort = function(data, type, row, meta) {
+                if(type === 'sort') {
+                    return (data && data.endsWith("%")) ? parseFloat(data.slice(0, -1)) : -1.00;
+                }
+                return data;
+            }
             var datatables_columns = [
                 {% if not product_tab or product_tab and product_tab.product|has_object_permission:"Finding_Edit" %}
                     { "data": "checkbox" },
@@ -738,7 +739,8 @@ <h3 class="has-filters">
                     }},
                     { "data": "cwe" },
                     { "data": "cve" },
-                    { "data": "epss"},
+                    { "data": "epss_score", "type": "num", "render": percentSort },
+                    { "data": "epss_percentile", "type": "num", "render": percentSort },
                     { "data": "found_date" },
                     { "data": "finding_age" },
                 {% if system_settings.enable_finding_sla %}

diff --git a/dojo/templates/dojo/metrics.html b/dojo/templates/dojo/metrics.html
@@ -335,6 +335,7 @@ <h3>{% trans "Metric Counts" %}</h3>
                                                 <th class="nowrap">{% trans "Team" %}</th>
                                                 <th class="">{% trans "Product" %}</th>
                                                 <th>{% trans "Severity" %}</th>
+                                                <th>{% trans "EPSS Score / Percentile" %}</th>
                                                 <th>{% trans "Description" %}</th>
                                                 <th class="nowrap">{% trans "Days<br/>Open" %}</th>
                                                 <th class="nowrap">{% trans "Status" %}</th>
@@ -350,6 +351,11 @@ <h3>{% trans "Metric Counts" %}</h3>
                                         </span>
                                                     </td>
                                                     <td>{{ finding.severity_display }}</td>
+                                                    <td>
+                                                        {{ finding.epss_score|format_epss }}
+                                                        /
+                                                        {{ finding.epss_percentile|format_epss }}
+                                                    </td>
                                                     <td><a href="{% url 'view_finding' finding.id %}"
                                                            title="{{ finding.title }}">{{ finding.title|truncatechars_html:20 }}</a>
                                                     </td>

diff --git a/dojo/templates/dojo/product_endpoint_pdf_report.html b/dojo/templates/dojo/product_endpoint_pdf_report.html
@@ -160,6 +160,7 @@ <h5>
                                 <table id="notes" class="table-striped table table-condensed table-hover centered">
                                     <tr>
                                         <th>Severity</th>
+                                        <th>EPSS Score / Percentile</th>
                                         <th>Status</th>
                                         {% if finding.risk_acceptance_set.all %}
                                             <th>Acceptance</th>
@@ -177,13 +178,18 @@ <h5>
                                     </tr>
                                     <tr>
                                         <td>
-                                    <span class="label severity severity-{{ finding.severity }}">
-                                        {% if finding.severity %}
-                                            {{ finding.severity }}
-                                        {% else %}
-                                            Unknown
-                                        {% endif %}
-                                    </span>
+                                            <span class="label severity severity-{{ finding.severity }}">
+                                                {% if finding.severity %}
+                                                    {{ finding.severity }}
+                                                {% else %}
+                                                    Unknown
+                                                {% endif %}
+                                            </span>
+                                        </td>
+                                        <td>
+                                            {{ finding.epss_score|format_epss }}
+                                            /
+                                            {{ finding.epss_percentile|format_epss }}
                                         </td>
                                         <td>{{ finding.status }}</td>
                                         {% if finding.risk_acceptance_set.all %}

diff --git a/dojo/templates/dojo/product_pdf_report.html b/dojo/templates/dojo/product_pdf_report.html
@@ -216,6 +216,7 @@ <h5>
                             <table id="notes" class="table-striped table table-condensed table-hover centered">
                                 <tr>
                                     <th>Severity</th>
+                                    <th>EPSS Score / Percentile</th>
                                     <th>Status</th>
                                     {% if finding.risk_acceptance_set.all %}
                                         <th>Acceptance</th>
@@ -242,6 +243,11 @@ <h5>
                                         {% endif %}
                                     </span>
                                     </td>
+                                    <td>
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                     <td>{{ finding.status }}</td>
                                     {% if finding.risk_acceptance_set.all %}
                                         <td>