You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
One of the main reasons why we never use the success metrics, is because there is no way to scope/limit the results to a particular (set of) Nexus IQ stage(s).
In our organization we use very different scan patterns for Source/Build/Stage-Release/Release, since the analysis focus of each stage is different. For (Stage-)Release we are only interested in "production" dependencies, whereas in earlier stages we are also interested in test/dev dependencies (for LCM).
So in our case, the "Source" stage is incredibly noisy with vulnerabilities, because it contains just about every library we use for absolutely everything.
For our success metrics, we are primarily interested in our "production" dependencies, but since we cannot filter by stage, the succes metrics always look terrible and can swing wildly over time.
We would very much appreciate a way to filter the "Source" stage reports from our success metrics.
The text was updated successfully, but these errors were encountered:
Hi @PayBas - I can certainly see a use case for that, unfortunately that's something that Sonatype Product Management would need to address (this is just an open source tool for viewing the metrics from the IQ product). There's a product improvement idea here which you could vote on, the more votes, the more traction an idea will get.
One of the main reasons why we never use the success metrics, is because there is no way to scope/limit the results to a particular (set of) Nexus IQ stage(s).
In our organization we use very different scan patterns for Source/Build/Stage-Release/Release, since the analysis focus of each stage is different. For (Stage-)Release we are only interested in "production" dependencies, whereas in earlier stages we are also interested in test/dev dependencies (for LCM).
So in our case, the "Source" stage is incredibly noisy with vulnerabilities, because it contains just about every library we use for absolutely everything.
For our success metrics, we are primarily interested in our "production" dependencies, but since we cannot filter by stage, the succes metrics always look terrible and can swing wildly over time.
We would very much appreciate a way to filter the "Source" stage reports from our success metrics.
The text was updated successfully, but these errors were encountered: