Per-Project SLA Config

[37b]

This PR includes functionality to set the SLA per Product (if wanted). I am looking for others to test this out and provide feedback.

During migration the current SLA settings are copied moved into a new Default SLA Configuration that is used for all Products that otherwise do not specify a custom SLA.

Additional SLA Configurations can be created and applied to Products individually.

[accesslint]

There are accessibility issues in these changes.

[Maffooch]

@37b The integration tests are failing for adding a product. I imagine selenium is barfing on the extra element because it likely uses xpath to identify elements.

[37b]

@37b The integration tests are failing for adding a product. I imagine selenium is barfing on the extra element because it likely uses xpath to identify elements.

Saw that. Looking at a fix when I get back from holiday.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[devGregA]

@37b targeting next release for getting this merged. Thank you for your PR!

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[dsever]

For me it has more sense to assign, adapted SLA per product type than single product.

[37b]

@dsever I thought about that at first but it's less flexible. We have different SLAs for different risk profiles which don't closely align with product type (in our org).

With this approach the SLA could be named to match the product type so at least to casual users they are aligned for your use case while under the hood they are separate.

[JoshBrodieTM]

For me it has more sense to assign, adapted SLA per product type than single product.

I'm highly anticipating SLA per product. We've taken the suggestion in documentation of having Product Types be Business Units. In each business unit, any given product will have a criticality rating. I'm looking to iterate over our products and set the SLA per product based on the criticality rating. Changing the rating per Product Type would require regrouping products into Product Types by criticality. Definitely agree with the above that SLA per Product allows the same SLA to be set across a Product Type without preventing this use case.

[dsever]

For me it has more sense to assign, adapted SLA per product type than single product.

I'm highly anticipating SLA per product. We've taken the suggestion in documentation of having Product Types be Business Units. In each business unit, any given product will have a criticality rating. I'm looking to iterate over our products and set the SLA per product based on the criticality rating. Changing the rating per Product Type would require regrouping products into Product Types by criticality. Definitely agree with the above that SLA per Product allows the same SLA to be set across a Product Type without preventing this use case.

From my point of view non of this is adaptable enough to solve SLA problem in general, I was thinking something like this https://owasp.slack.com/archives/C014H3ZV9U6/p1655809862156139 we have already created backlog for this in the company and would like to have it as PoC, to have kind of advance SLA logic.

[37b]

For me it has more sense to assign, adapted SLA per product type than single product.

I'm highly anticipating SLA per product. We've taken the suggestion in documentation of having Product Types be Business Units. In each business unit, any given product will have a criticality rating. I'm looking to iterate over our products and set the SLA per product based on the criticality rating. Changing the rating per Product Type would require regrouping products into Product Types by criticality. Definitely agree with the above that SLA per Product allows the same SLA to be set across a Product Type without preventing this use case.

From my point of view non of this is adaptable enough to solve SLA problem in general, I was thinking something like this https://owasp.slack.com/archives/C014H3ZV9U6/p1655809862156139 we have already created backlog for this in the company and would like to have it as PoC, to have kind of advance SLA logic.

@dsever Are you saying you want the SLA to change on the fly based on other criteria set on the product? That kind of approach can be done via scripts/API using the basic per-product SLA implementation. It could possibly also be added as a feature flag for those who want more complex logic built into the tool. The idea was to keep it simple and see what works/doesn't work so it can be iterated upon.

[dsever]

For me it has more sense to assign, adapted SLA per product type than single product.

I'm highly anticipating SLA per product. We've taken the suggestion in documentation of having Product Types be Business Units. In each business unit, any given product will have a criticality rating. I'm looking to iterate over our products and set the SLA per product based on the criticality rating. Changing the rating per Product Type would require regrouping products into Product Types by criticality. Definitely agree with the above that SLA per Product allows the same SLA to be set across a Product Type without preventing this use case.

From my point of view non of this is adaptable enough to solve SLA problem in general, I was thinking something like this https://owasp.slack.com/archives/C014H3ZV9U6/p1655809862156139 we have already created backlog for this in the company and would like to have it as PoC, to have kind of advance SLA logic.

@dsever Are you saying you want the SLA to change on the fly based on other criteria set on the product? That kind of approach can be done via scripts/API using the basic per-product SLA implementation.

Then brain\logic is outside of the platform, script needs to pick product/product type metadata and make an decision what to apply, this is not so convenient. I'm just describing our use case, and why we want to enable more programmable advance SLA definitions.

[Maffooch]

I think this is good from a first iteration pov. The logic of changing SLA conf based on criticality and other vars within the product will likely mean something slightly different to everybody. Maybe it would be good to keep it a manual change for now, and then based on community use and standards, we could set some sane defaults.

[StefanFl]

IMO this PR makes DefectDojo better. I would like to see the SLA configuration per Product Type, but this should be easy to add in another PR. Having it even more configurable like @dsever proposed would be the next step.

[StefanFl]

@Maffooch @dsever Any objections about merging this PR?

[Maffooch]

No objections from me! Will merge this after release.