DOCSEARCHbyAlgolia
Submit Docs

DefectDojo Documentation

repository·master·Indexed 26 days ago

https://github.com/defectdojo/django-defectdojo

DefectDojo is an open-source DevSecOps, ASPM (application security posture management), and vulnerability management tool used for orchestrating security testing, vulnerability tracking, deduplication, remediation, and reporting. This documentation covers installation and configuration via Docker Compose and Helm, including Kubernetes local quickstarts with Minikube, high availability (HA) mode, persistent media storage, and external PostgreSQL integration.

Tokens
218K
Snippets
166
Records
1.4K
Agent score
88%

What's inside DefectDojo

  1. Overview of DefectDojo Pro features

    master

    DefectDojo Pro provides advanced capabilities for enterprise-level data management, automation, and integration. Key feature areas include:

    User Experience & Navigation

    • Pro UI: A faster, customizable interface with dark mode support.
    • Global Search: A typo-tolerant Postgres full-text search box in the topbar for finding Findings, Assets, Engagements, and more.
    • Assets/Organizations: Improved hierarchical visualization for large lists of repositories and business structures.

    Automation & Intelligence

    • Rules Engine: A no-code scripting engine to automate bulk actions and custom workflows for Findings and other objects.
    • Sensei (BETA): An AI-powered capability that connects via GitHub App to scan repositories, import findings, and open remediation pull requests.
    • Finding Priority: Automated pre-triage of Findings based on Priority and Risk to identify critical issues.

    Data Management & Import

    • Deduplication Tuning: Advanced settings for same-tool, cross-tool, and reimport deduplication.
    • Streamlined Import: Includes Background Imports for large reports and specialized methods like the Universal Importer, API Connectors, Universal Parser, and Smart Upload.
    • Connectors: Out-of-the-box automated pipelines for enterprise scanning tools.
    • Universal Parser (Beta): Converts custom .json or .csv reports into Findings by mapping data according to user preferences.

    Reporting

    • Pro Dashboards and Reporting: Instant metrics and insights dashboards. Graphics can be exported as SVG files, and dashboard data can be exported as tables.

  2. Overview of Sensei AI-powered scan-and-fix

    master

    Sensei is a DefectDojo Pro-only feature designed for AI-powered scan-and-fix capabilities for source code repositories. It allows users to:

    • Scan GitHub repositories and import results as findings.
    • Open pull requests that remediate findings using a large language model (LLM) via a preview-first approval workflow.
    • Initiate fixes from the findings table, from staged auto-fix candidates, or by using a /fix comment on a pull request.

  3. Overview of the Dashboards API resource groups

    master

    The Dashboards API is organized into three main resource groups under the /api/v2/dashboards/ path:

    ResourcePathDescription
    Layouts/dashboards/layouts/Saved dashboards and shared team templates. Supports CRUD operations, cloning, and setting defaults.
    Widget catalog/dashboards/widget_catalog/A read-only menu of available widget types and their configuration examples.
    Widget data/dashboards/widget_data/<action>/Endpoints used to render data for specific widgets (21 different actions available).

    Note: While the Vue UI uses /api/vue/dashboard_v2/, you should always automate against the stable /api/v2/dashboards/ paths.

  4. Overview of Sensei AI Scan-and-Fix

    master

    Sensei is a DefectDojo Pro-only feature (currently in BETA) that provides AI-powered scan-and-fix capabilities for source code repositories. It allows you to connect a repository, scan it, import findings, and use a large language model to remediate those findings by opening pull/merge requests directly from DefectDojo.

    Supported Providers:

    • GitHub (github.com and GitHub Enterprise Server) via GitHub App.
    • GitLab (gitlab.com and self-managed) via project/group access tokens.
    • Bitbucket (Cloud and Server/Data Center) via OAuth, API token, or access token.
    • Azure DevOps via Personal Access Token.

    Key Features:

    • Preview-first: Fix candidates are staged for review. No LLM costs or pull requests are incurred until you approve a fix.
    • Short-lived credentials: Uses GitHub Apps and short-lived installation tokens to avoid manual credential rotation.
    • Integrated Workflow: Scans and remediations are linked to DefectDojo assets (products), keeping findings and fixes alongside your existing data.

  5. Understand Finding Statuses in DefectDojo

    master

    DefectDojo uses Finding statuses to track the lifecycle of a vulnerability. While 'Open' and 'Closed' are not explicit status types, they act as catchalls for specific statuses:

    Open Findings include:

    • Active: A new finding discovered by a tool that hasn't been recorded in a past import. If a previously mitigated finding reappears in a scan, it reopens as Active.
    • Verified: A finding that has been manually confirmed to exist.

    Closed Findings include:

    • Inactive: The issue has no current impact or does not require immediate attention.
    • Under Review: The finding has been sent to team members for review (via Request Peer Review).
    • Risk Accepted: The team has evaluated the risk and agreed to delay fixing it. Risk Acceptances can include files, notes, and expiry dates.
    • Out Of Scope: The finding is not directly relevant to the specific Engagement or Test.
    • False Positive: The reported vulnerability does not actually exist. This status is maintained during reimports to reduce noise within the same tool.

    Note: DefectDojo only compares findings within the same tool to determine if a finding is a False Positive; a different tool finding a similar issue will not be treated as a False Positive.

  6. Understand Dashboard differences between Open Source and Pro editions

    master

    DefectDojo provides different dashboard capabilities depending on the edition used:

    Open Source Edition

    • Main Dashboard: A single, fixed dashboard shared by all users.
    • Configuration: A superuser can toggle a fixed set of charts on or off.
    • Limitations: No support for multiple named dashboards, custom widgets, or dashboard automation via API.

    DefectDojo Pro Edition

    • Customizable Dashboards: Each user can create, configure, and arrange individual widgets.
    • Multiple Layouts: Users can build and switch between any number of named layouts.
    • Collaboration: Users can publish layouts to their team, clone templates, and set a default layout.
    • Automation: Full support for managing dashboards via the REST API or LLM automation (including discovering the widget catalog, creating layouts, and rendering widget data).

  7. Compare DefectDojo Open-Source vs Pro features

    master

    DefectDojo is available in two editions: Open-Source and Pro.

    • DefectDojo Open-Source is a free vulnerability management platform suitable for smaller teams. It includes core importing (200+ tools), standard deduplication, a full REST API, local authentication with basic RBAC, basic dashboards, and Jira integration.
    • DefectDojo Pro is an enterprise-oriented version that includes everything in Open-Source but adds advanced features like SSO (SAML/OAuth), MFA, advanced RBAC, a Rules Engine for automation, advanced/customizable dashboards, and optimized import workflows (Background imports, Smart Upload, Universal Parser, CLI uploads). It also features built-in API Connectors, integrations with Azure DevOps, GitHub, GitLab, and ServiceNow, and AI-assisted workflows.

  8. Choose a scan upload method

    master

    DefectDojo provides several ways to ingest vulnerability reports and create Findings. The choice depends on your automation requirements and whether you are using the Open Source (OS) or Pro edition.

    Standard Methods (Available in OS)

    • UI Import: Manual upload of reports through the user interface. Note that in the OS version, you must create the Product Hierarchy (Product Types, Products, Engagements, or Tests) before performing a UI import.
    • API: Automated data ingestion using API endpoints like /import or /reimport. This is the primary method for programmatic integration.

    Pro Methods (DefectDojo Pro only)

    • Connectors: 'Out of the box' automated integrations for specific tools (e.g., Akamai API Security, AWS Security Hub, Snyk, Wiz, etc.).
    • Smart Upload: Specialized importers for infrastructure scans (e.g., Nexpose, NMap, OpenVas, Qualys, Tenable) via the /smart_upload_import API endpoint.
    • Universal Importer / DefectDojo CLI: Command line tools that leverage the DefectDojo API for specialized imports.

  9. Understand Discover and Sync Operations

    master

    API Connectors perform two recurring operations to automate data ingestion:

    • Discover: Learns the connected tool's organizational structure and creates Records in DefectDojo for any unmapped data (Vendor-Equivalent-Products or VEPs).
    • Sync: Imports new Findings from the tool into DefectDojo based on your existing mappings. It performs a Reimport by comparing the current state of scan data against the incoming report.

  10. Understand the DefectDojo Pro Custom Report Data Model

    master

    Custom reports in DefectDojo Pro are built using four related REST resources under /api/v2/. Understanding the hierarchy is essential for building templates:

    1. Report Themes: Define the visual style (colors, fonts, images).
    2. Report Blocks: Reusable content units. These contain the actual data logic, including filters.
    3. Report Templates: An ordered collection of Blocks associated with a single Theme.
    4. Generated Reports: The final product created by running a Template, resulting in a downloadable PDF or HTML file.

  11. Compare DefectDojo Open-Source and Pro Editions

    master

    DefectDojo is available in two editions:

    Open-Source Edition

    Best for teams managing smaller volumes of findings. Includes:

    • Import/Reimport for 200+ supported tools
    • REST API
    • Deduplication features
    • Jira integration
    • Limited UI, metrics, and reporting

    Pro Edition

    Designed for enterprise use with additional features:

    • Connectors: Out-of-the-box API integrations (e.g., Checkmarx One, BurpSuite, Semgrep)
    • Configurable Import Methods: Universal Parser and Smart Upload
    • CLI Tools: For rapid system integration
    • Advanced Integrations: ServiceNow, Azure DevOps, GitHub, and GitLab
    • Improved Metrics: For executive reporting
    • Priority and Risk: System-wide urgency identification
    • Premium Support

  12. Understand Questionnaire types in DefectDojo

    master

    DefectDojo uses Questionnaires to collect information from stakeholders. There are two primary deployment types for Questionnaire templates:

    General Questionnaires

    Used for broader distribution (internal and external).

    • Lifecycle: Template → Published → Accept Responses → Expire → (Optional) Conversion to Engagement.
    • Key Features: Requires publication and an expiration date; permits anonymous responses; responses are only visible after expiration; can be shared externally.

    Linked Questionnaires

    Used for specific work contexts.

    • Lifecycle: Template → Linked to Engagement → Accept Responses → Remains active while Engagement is active.
    • Key Features: Does not require publication; linked to an Engagement; does not permit anonymous responses; responses are visible immediately; only shareable internally.