Fuzzy Matching in Multiuser Environment

[BrightKn1ght]

Hey DT community,

we have a Dependencytrack instance running in your company and different departments are using it. Some are now wanting to scan with Fuzzy Matching while the others are complaining about too many False Positives. Therefore it would be nice to enable/disable the fuzzy seach on a per project setting instead of a general setting which affects all projects. Another idea would be to always enable Fuzzy Matching and flag the ones found by fuzzying, so that the UI could filter them out via some toggle switch.
Have you ever thought about implementing something in this direction?

[nscuro]

We could do something similar to what we support for BOM validation, which is tag-based. You define a tag in the settings, as well as whether presence of the tag symbolizes inclusion or exclusion in $feature. You then apply tags to your projects as needed.

Would that work for you?

[BrightKn1ght]

In principle this suggestion would work for us. Although I believe this approach is complicated to configure for the users. They need to create a tag and configure the behavior up on presence of the tag. This requires some UI for the configuration in the settings again. I think this approach will clutter the settings UI too much for a small feature, unless it is planned to make this UI very generic, which then will cause quite some effort. Additionally with the suggested approach it is not possible find out which findings are found by fuzzying.

I would suggest the following:

1. Adding a toggle button to the project creation dialog allowing to enable/disable the fuzzying on per project level.
2. Marking the vulnerabilities found by fuzzying with a flag, which allows filtering them later in the UI. Probably the code section where to flag them could be here and here

What are you thinking about this approach?