Filter out rejected findings to not sync with DefectDojo

[manuel-sommer]

Current Behavior:

Findings are synced from DependencyTrack to DefectDojo. Then, findings can be rejected. DependencyTrack does not update or close rejected findings in DefectDojo. (e.g. CVE-2021-20095 or CVE-2018-1000643)
To outline the exact problem:

1. A CVE is synced from DependencyTrack to DefectDojo (e.g. severity High)
2. This CVE is rejected and DependencyTrack notes the severity for the finding as "unassigned"
3. This CVE is synced again from DependencyTrack to DefectDojo. Now the finding is not closed / patched to be an "info" finding as the upload to Defectdojo does not consider a new severity. Thus, DependencyTrack has to patch the finding if the severity changes.

Proposed Behavior:

Rejected vulnerabilities should be automatically closed in DefectDojo.

[kepten]

I think a better solution would be if rejected vulnerabilities would not be sent to DefectDojo at all. That should close them in DD if close_old_findings is set to True during import which is how the current DD integration works.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.