aboutcode-org
CRAVEX: Alerting/notification
Create a system to provide a alert/notification when new, not-yet-processed vulnerabilities are uncovered
Refer to issue https://github.com/nexB/dejacode/issues/94 for discussion of the vulnerability lookup process.
We can make use of the existing DejaCode Notifications feature to support this one.
Additionally (or alternatively) we could consider providing an ability to create a workflow request automatically to alert the appropriate users and to track the progress of the analysis and resolution.
@DennisClark let's start with this for now
We can make use of the existing DejaCode Notifications feature to support this one.
@tdruez We can possibly consider triggering a notification based on an update (change) to the Vulnerability Risk field.
I think the new notification should be based on the Package for security reasons, although the message could say something like there is a vulnerability risk change in a package used by one or more of your products.
Notifications implemented in https://github.com/aboutcode-org/dejacode/pull/220/ Documentation availablele at https://dejacode.readthedocs.io/en/latest/reference-vulnerability-management.html#notifications
