How can I write JQL for vulnerabilities without work items

[Amy Tebbe]

I'm using GitHub Advanced Security integration with jira and have followed these instructions to see my vulnerabilities.  That works perfectly.  I can see them in Security -> Vulnerabilities. I linked one vulnerability to a work item for testing purposes.

I'd like to create a dashboard with a pie chart of all vulnerabilities sliced by severity.  I can't seem to write the JQL to show only vulnerabilities without work items.  Is there a way to do this?

I've tried several variations on the JQL but I seem to only get results on the vulnerabilities linked to a work item.  

Ex: 

This query returns only vulns linked to a work item:

vulnerability[totalCount] > 0



The 3 queries below return nothing:

vulnerability[provider] = "github.com"

vulnerability[provider] = "GitHub Advanced Security"

vulnerability[provider] = "Dependabot"

Thank you in advance for any help you can offer. 

[Bill Sheboy]

Hi @Amy Tebbe 

JQL is a query language to find work items meeting some criteria.  It cannot find the opposite: the absence of information.

If there is a REST API endpoint to get all possible vulnerabilities, you could iterate them to find any without associated work items.  And, if such an endpoint exists, there may be a marketplace addon / app gadget to show such information on dashboards.

Kind regards,
Bill