Upload / Reimport of reports should consider and update severity

[manuel-sommer]

Is your feature request related to a problem? Please describe
Some tools update the severity of findings. Here some examples:

• DependencyTrack tracks CVEs. Due to false positive reportings, CVEs are closed as rejected e.g. https://nvd.nist.gov/vuln/detail/CVE-2021-20095. Then, DependencyTrack updates the severity of these vulnerabilities to "unassigned". This is basically a "Informational" finding in DefectDojo. However, the new severity is not updated when DependencyTrack syncs the finding to DefectDojo and the finding remains open.
• DrHeader supports the way to set custom severities. If this changes, the severity is not updated in DefctDojo Addition of severity functionality to the core.py Santandersecurityresearch/DrHeader#170

Describe the solution you'd like
The severity is updated for all findings when they are uploaded (upload or reimport). This includes an SLA adjustment.

[manuel-sommer]

#7728

[valentijnscholten]

@manuel-sommer Do you have a proposal on how this should work? There are at least 20 parsers that have the severity field in their hash_code configuration. I think this is not needed anyway, but to make reimport update the severity field the seveirty field has to be remove from any hash_code configuration/calculation. It must be removed from allowed fields for hash_code configuration.

[manuel-sommer]

What we could do is: update the hash_code config for a parser and recalculate the hash_code for this parser in a db_migration. As a preanalysis, we could evaluate which parsers could affect this feature as they have too less available fields to be unique and need the severity field.
We could also do an if-statement in the reimport: if field severity not available in settings, then update in a reimport.

[manuel-sommer]

@valentijnscholten, shall I make a PR for an import if field severity is not available in settings? or what is your opinion?

[devaroop]

I am having the same issue with AWS Security Hub and AWS Inspector2 Scan types where severity is not being updated on reimport of json reports.

Please help with a fix