docs(asset-hierarchy): relationship types, and direct vs indirect vulnerabilities - #15672
Merged
Merged
Conversation
…nerabilities The page said `parent` is the only supported label. Two more ship now, and which one you pick changes what aggregates: contains rolls up, derived_from deliberately does not, because a base image Findings are not the derived asset own exposure. Also documents the direct/indirect counts on the hierarchy nodes and the asset page, including the two properties people will ask about: a finding reachable by several paths is counted once, and nothing is stored -- the counts follow the graph as it stands, and no finding is ever copied onto another asset.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation for the Pro asset-hierarchy edge-semantics work, shipping in the same batch and on the same release line as the Pro change.
Two things on the Asset Hierarchy page needed updating.
Relationship types. The page stated that
parentis the only supported label. Two more now ship:contains(composition — and unlikeparent, the same Asset can be contained by several others) andderived_from(lineage, as a container image is built from a base image). Added a short table giving each type's meaning and whether it aggregates upward, since that is the part with consequences: it drives both the indirect counts and the "Include child assets" option on metrics.derived_fromdeliberately does not aggregate — a base image's Findings are not the derived Asset's own exposure, and attributing them to every Asset built from it multiplies the same Finding across the estate.Direct and indirect vulnerabilities. Hierarchy nodes and the Asset page now show the two counts, so there is a new section covering what each means, the two properties people will ask about (a Finding reachable by several paths is counted once, and nothing is stored — the counts follow the graph as it currently stands, so re-parenting changes them immediately and no Finding is ever copied onto another Asset), the permission behaviour (Assets you cannot view contribute nothing and show no counts rather than a zero), and how "direct" lines up with the Open Finding Severity total already on the Asset page.
Also extended two existing bullets in Notes rather than repeating the material: acyclicity is enforced per relationship type and in the database, and indirect attribution is computed on read.
No new page and no restatement of the hierarchy concepts already covered above these sections.