Hdf2ckl severity

[kemley76]

Fix to #5842.

[ejaronne]

The hdf2ckl export works properly, however, the Details tab should be:

Severity:
(tag.severity value)

Impact:
(Impact value)

[georgedias]

Please see my inline comments

[kemley76]

I have made more changes regarding this issue. This includes:

• adding a severity tag upon importing a Checklist file
• using a control's severity tag to compute its severity rather than defaulting to use only the impact value
• compute the amount of "impact bubbles" in the results view with the impact rather than the severity
• be able to sort the controls by impact when clicking the impact column header
• be able to show falsy values in the details (like when there is impact of 0)

Done in previous commit, but not listed out

• use severity tag (if available) when exporting form HDF to CKL

This shows the sorting and bubble usage. The bubbles indicate impact, the text indicates severity.

[Amndeep7]

Currently the behavior is severity if it's there, otherwise fallback to impact.

What happens if there is a security override coming from a ckl? What should the behavior be then? I think the behavior should be the override if it's there, then the severity, then fallback to impact.

What should we do about the severity override justification? Should that be shown in the details tab?

Questions for @ejaronne

[kemley76]

The original issue was caused by two things:

1. When a control has a severity tag, Heimdall didn't care and computed the severity it displays with the impact, which can differ from this tag
2. When exporting from hdf to checklist, the severity in the resulting checklist was computed with the hdf's impact and disregarded any severity tags.
   These have been addressed

Additional fixes that were addressed that may be beyond the scope of the original issue, but still needed to be addressed:

Compute a control's severity based on

1. Any severity override (checklist vuln tag or hdf control tag)
2. Any severity tag (checklist tag or hdf control tag)
3. Impact

Display severity override information in results table

Display severity override information in details view

It was also noticed that these changes affected the center "Severity Counts" ring graph. Before the "severities" in the graph were computed directly from the impact. Now, if there is a severity tag or severity override, that will be shown in the graph instead. When importing checklists, it is now impossible to see severity: none in this graph since severity: none does not exist in the checklist world.

[kemley76]

One last behavioral change was made here:
Upon exporting form hdf to checklist, severity tags none and critical now map to low and high respectively.
This has the side effect that exporting from hdf to ckl and then back to hdf could result in different severity levels if they were originally none or critical.

[kemley76]

The impact and severity columns have now been separated and are being displayed with color coded chips.

Handled

[mergify]

This pull request has a conflict. Could you fix it @kemley76?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
2 Accepted issues

Measures
1 Security Hotspot
0.0% Coverage on New Code
1.5% Duplication on New Code

See analysis details on SonarCloud

[georgedias]

ready to merge