diff --git a/docs/assets/images/import_scan_ui.png b/docs/assets/images/import_scan_ui.png index 851dfa95d34..ccf9a1b4aee 100644 Binary files a/docs/assets/images/import_scan_ui.png and b/docs/assets/images/import_scan_ui.png differ diff --git a/docs/assets/images/metrics_image1.png b/docs/assets/images/metrics_image1.png new file mode 100644 index 00000000000..6cc5b8f0119 Binary files /dev/null and b/docs/assets/images/metrics_image1.png differ diff --git a/docs/assets/images/metrics_image2.png b/docs/assets/images/metrics_image2.png new file mode 100644 index 00000000000..4216af8301f Binary files /dev/null and b/docs/assets/images/metrics_image2.png differ diff --git a/docs/assets/images/metrics_image3.png b/docs/assets/images/metrics_image3.png new file mode 100644 index 00000000000..31b902848a8 Binary files /dev/null and b/docs/assets/images/metrics_image3.png differ diff --git a/docs/assets/images/metrics_image4.gif b/docs/assets/images/metrics_image4.gif new file mode 100644 index 00000000000..b13835114f5 Binary files /dev/null and b/docs/assets/images/metrics_image4.gif differ diff --git a/docs/assets/images/metrics_image6.png b/docs/assets/images/metrics_image6.png new file mode 100644 index 00000000000..1e2bbfdcab6 Binary files /dev/null and b/docs/assets/images/metrics_image6.png differ diff --git a/docs/assets/js/custom.js b/docs/assets/js/custom.js index c5525d04e5e..f6cb612dd0c 100644 --- a/docs/assets/js/custom.js +++ b/docs/assets/js/custom.js @@ -1 +1,60 @@ -// Put your custom JS code here +// custom js + + +// version toggler +(() => { + "use strict"; + + console.log("[VersionToggle] custom.js loaded"); + + const setVersion = (version) => { + console.log("[VersionToggle] Setting version to:", version); + + document.querySelectorAll(".version-opensource, .version-pro").forEach(el => { + el.style.display = el.classList.contains(`version-${version}`) ? "" : "none"; + }); + + localStorage.setItem("version", version); + console.log("[VersionToggle] localStorage updated:", localStorage.getItem("version")); + + // Update dropdown + const selects = document.querySelectorAll("#version-select"); + selects.forEach(sel => { + sel.value = version; + sel.dataset.version = version; + sel.style.visibility = "visible"; + }); + + // unhide sidebar after version is applied + const sidebar = document.querySelector(".docs-sidebar"); + if (sidebar) { + sidebar.style.visibility = "visible"; + console.log("[VersionToggle] Sidebar revealed"); + } + }; + + const initVersionToggle = () => { + const storedVersion = localStorage.getItem("version") || "opensource"; + console.log("[VersionToggle] Stored version:", storedVersion); + setVersion(storedVersion); + }; + + // Delegated listener on body + document.body.addEventListener("change", (e) => { + if (e.target && e.target.id === "version-select") { + console.log("[VersionToggle] Dropdown changed to:", e.target.value); + setVersion(e.target.value); + } + }); + + // Run on DOM ready + window.addEventListener("DOMContentLoaded", initVersionToggle); + + // MutationObserver to detect dynamically replaced sidebar + const observer = new MutationObserver(() => { + // Re-run init to make sure menus match stored version + initVersionToggle(); + }); + observer.observe(document.body, { childList: true, subtree: true }); + +})(); diff --git a/docs/assets/scss/common/_custom.scss b/docs/assets/scss/common/_custom.scss index e3429be7722..d16f34214b7 100644 --- a/docs/assets/scss/common/_custom.scss +++ b/docs/assets/scss/common/_custom.scss @@ -43,4 +43,38 @@ .DocSearch-Modal { position: fixed !important; } +} + +.logo-darkmode { + display: none; +} + +[data-bs-theme="dark"] .logo-lightmode { + display: none; +} + +[data-bs-theme="dark"] .logo-darkmode { + display: inline-block; +} + +html { + font-size: 85%; /* scales all rem/em fonts */ +} + +/* Hide sidebar until version is resolved */ +.docs-sidebar { + visibility: hidden; +} + + +#version-select[data-version="opensource"] { + background-color: #003964b7; + border: 2px solid #003864; + color: white; +} + +#version-select[data-version="pro"] { + background-color: #a84e32b7; + border: 2px solid #a84e32; + color: white; } \ No newline at end of file diff --git a/docs/config/_default/menus/menus.en.toml b/docs/config/_default/menus/menus.en.toml index 2189b85513a..e26b3dd137f 100644 --- a/docs/config/_default/menus/menus.en.toml +++ b/docs/config/_default/menus/menus.en.toml @@ -1,28 +1,48 @@ [[main]] - name = "Docs Home" - url = "/en/about_defectdojo/about_docs/" + name = "Get started ⏷" + url = "/get_started/about/about_defectdojo" weight = 10 [[main]] - name = "Supported Tools" - url = "/supported_tools/" - weight = 11 + name = "Import data ⏷" + url = "/import_data/import_intro/comparison/" + weight = 12 [[main]] - name = "Pro Features" - url = "/en/about_defectdojo/pro_features" + name = "Triage Findings ⏷" + url = "/triage_findings/findings/intro_to_findings/" weight = 12 [[main]] - name = "Changelog" - url = "/en/changelog/changelog/" + name = "Model your assets ⏷" + url = "/asset_modelling/hierarchy/pro__assets_organizations/" weight = 13 [[main]] - name = "Support" - url = "/en/about_defectdojo/contact_defectdojo_support" + name = "Metrics & reports ⏷" + url = "/metrics_reports/dashboards/introduction_dashboard/" weight = 14 +[[main]] + name = "Admin ⏷" + url = "/admin/admin_intro/intro/" + weight = 16 + +[[main]] + name = "Issue tracking ⏷" + url = "/issue_tracking/intro/intro/" + weight = 15 + +[[main]] + name = "Automation ⏷" + url = "/automation/api/api-v2-docs/" + weight = 15 + +[[main]] + name = "Supported tools ⏷" + url = "/supported_tools/" + weight = 16 + [[social]] name = "YouTube" pre = '' diff --git a/docs/config/_default/params.toml b/docs/config/_default/params.toml index 876e6d44e2f..36331f1428b 100644 --- a/docs/config/_default/params.toml +++ b/docs/config/_default/params.toml @@ -44,9 +44,21 @@ mainSections = ["docs"] bootstrapJavascript = false # false (default) or true # Nav - sectionNav = ["docs", "en", "supported_tools"] # ["docs"] (default) or list of sections (e.g. ["docs", "guides"]) + sectionNav = [ + "docs", + "en", + "supported_tools", + "get_started", + "import_data", + "triage_findings", + "metrics_reports", + "admin", + "automation", + "asset_modelling", + "issue_tracking"] # ["docs"] (default) or list of sections (e.g. ["docs", "guides"]) + toTopButton = false # false (default) or true - breadcrumbTrail = true # false (default) or true + breadcrumbTrail = false # false (default) or true headlineHash = true # true (default) or false scrollSpy = true # true (default) or false diff --git a/docs/content/en/api/_index.md b/docs/content/admin/admin_intro/_index.md similarity index 88% rename from docs/content/en/api/_index.md rename to docs/content/admin/admin_intro/_index.md index c49a452ad0b..8452f739bba 100644 --- a/docs/content/en/api/_index.md +++ b/docs/content/admin/admin_intro/_index.md @@ -1,11 +1,11 @@ --- -title: "🤖 API Documentation" +title: "Intro" description: "" summary: "" date: 2023-09-07T16:06:50+02:00 lastmod: 2023-09-07T16:06:50+02:00 draft: false -weight: 98 +weight: 3 chapter: true seo: title: "" # custom title (optional) diff --git a/docs/content/admin/admin_intro/intro.md b/docs/content/admin/admin_intro/intro.md new file mode 100644 index 00000000000..eef83cdd763 --- /dev/null +++ b/docs/content/admin/admin_intro/intro.md @@ -0,0 +1,9 @@ +--- +title: "DefectDojo Admin Controls" +description: "Administrative controls for configuring, securing, and maintaining your DefectDojo instance." +weight: 0 +--- + +Admin actions in DefectDojo provide the controls needed to configure and maintain the platform across your organization. These actions are designed for administrators who are responsible for user management, system configuration, and ensuring DefectDojo operates securely and reliably at scale. + +Administrative actions allow you to manage core aspects of DefectDojo, including authentication methods, user access, global settings, and integrations. From initial setup to ongoing maintenance, these controls define how DefectDojo behaves and how users interact with it. \ No newline at end of file diff --git a/docs/content/en/customize_dojo/notifications/_index.md b/docs/content/admin/notifications/_index.md similarity index 93% rename from docs/content/en/customize_dojo/notifications/_index.md rename to docs/content/admin/notifications/_index.md index 218ba05ea85..3c6eb3a19d5 100644 --- a/docs/content/en/customize_dojo/notifications/_index.md +++ b/docs/content/admin/notifications/_index.md @@ -6,8 +6,6 @@ lastmod: 2023-09-07T16:06:50+02:00 draft: false weight: 7 chapter: true -sidebar: - collapsed: true seo: title: "" # custom title (optional) description: "" # custom description (recommended) diff --git a/docs/content/en/customize_dojo/notifications/about_notifications.md b/docs/content/admin/notifications/about_notifications.md similarity index 100% rename from docs/content/en/customize_dojo/notifications/about_notifications.md rename to docs/content/admin/notifications/about_notifications.md diff --git a/docs/content/en/customize_dojo/notifications/configure_personal_notifs.md b/docs/content/admin/notifications/configure_personal_notifs.md similarity index 100% rename from docs/content/en/customize_dojo/notifications/configure_personal_notifs.md rename to docs/content/admin/notifications/configure_personal_notifs.md diff --git a/docs/content/en/customize_dojo/notifications/configure_system_notifs.md b/docs/content/admin/notifications/configure_system_notifs.md similarity index 100% rename from docs/content/en/customize_dojo/notifications/configure_system_notifs.md rename to docs/content/admin/notifications/configure_system_notifs.md diff --git a/docs/content/en/customize_dojo/notifications/email_slack_teams.md b/docs/content/admin/notifications/email_slack_teams.md similarity index 100% rename from docs/content/en/customize_dojo/notifications/email_slack_teams.md rename to docs/content/admin/notifications/email_slack_teams.md diff --git a/docs/content/en/customize_dojo/user_management/_index.md b/docs/content/admin/user_management/_index.md similarity index 93% rename from docs/content/en/customize_dojo/user_management/_index.md rename to docs/content/admin/user_management/_index.md index d7ef4c307e1..e35cf318f4b 100644 --- a/docs/content/en/customize_dojo/user_management/_index.md +++ b/docs/content/admin/user_management/_index.md @@ -7,8 +7,6 @@ lastmod: 2023-09-07T16:06:50+02:00 draft: false weight: 5 chapter: true -sidebar: - collapsed: true seo: title: "" # custom title (optional) description: "" # custom description (recommended) diff --git a/docs/content/en/customize_dojo/user_management/about_perms_and_roles.md b/docs/content/admin/user_management/about_perms_and_roles.md similarity index 100% rename from docs/content/en/customize_dojo/user_management/about_perms_and_roles.md rename to docs/content/admin/user_management/about_perms_and_roles.md diff --git a/docs/content/en/customize_dojo/user_management/audit_logging.md b/docs/content/admin/user_management/audit_logging.md similarity index 100% rename from docs/content/en/customize_dojo/user_management/audit_logging.md rename to docs/content/admin/user_management/audit_logging.md diff --git a/docs/content/en/customize_dojo/user_management/configure_sso.md b/docs/content/admin/user_management/configure_sso.md similarity index 100% rename from docs/content/en/customize_dojo/user_management/configure_sso.md rename to docs/content/admin/user_management/configure_sso.md diff --git a/docs/content/en/customize_dojo/user_management/create_user_group.md b/docs/content/admin/user_management/create_user_group.md similarity index 100% rename from docs/content/en/customize_dojo/user_management/create_user_group.md rename to docs/content/admin/user_management/create_user_group.md diff --git a/docs/content/admin/user_management/pro_permissions_overhaul.md b/docs/content/admin/user_management/pro_permissions_overhaul.md new file mode 100644 index 00000000000..01baf4eb494 --- /dev/null +++ b/docs/content/admin/user_management/pro_permissions_overhaul.md @@ -0,0 +1,52 @@ +--- +title: "Set Permissions in Pro" +description: "Overhaul, pro feature" +weight: 3 +audience: pro +--- + +## Introduction to Permission Types + +Individual users have four different kinds of permission that they can be assigned: + +* Users can be assigned as **Members to Products or Product Types**. This allows them to view and interact with Data Types (Product Types, Products, Engagements, Tests and Findings) in DefectDojo depending on the role they are assigned on the specific Product. Users can have multiple Product or Product Type memberships, with different levels of access. +​ +* Users can also have **Configuration Permissions** assigned, which allow them to access configuration pages in DefectDojo. Configuration Permissions are not related to Products or Product Types. +​ +* Users can be assigned **Global Roles**, which give them a standardized level of access to all Products and Product Types. +​ +* Users can be set up as **Superusers**: administrator level roles which give them control and access to all DefectDojo data and configuration. + +You can also create Groups if you want to assign Product Membership, Configuration Permissions or Global Roles to a group of users at the same time. If you have a large number of users in DefectDojo, such as a dedicated testing team for a particular Product, Groups may be a more helpful feature. + +## Superusers \& Global Roles + +Part of your Role\-Based Access Control (RBAC) configuration may require you to create additional Superusers, or users with Global Roles. + +* Superusers (Admins) have no limitations in the system. They can change all settings, manage users and have read / write access to all data. They can also change access rules for all users in DefectDojo. Superusers will also receive notifications for all system issues and alerts. +* Users with Global Roles can view and interact with any Data Type (Product Types, Products, Engagements, Tests and Findings) in DefectDojo depending on their assigned Role. For more information about each Role and associated privileges, please refer to our Introduction to Roles article. +* Users can also have specific Configuration Permissions assigned, allowing them to access certain DefectDojo configuration pages. Users have no Configuration Permissions by default. + +By default, the first account created on a new DefectDojo instance will have Superuser permissions. That user will be able to edit permissions for all subsequent DefectDojo users. Only an existing Superuser can add another superuser, or add a Global Role to a user. + +Permissions in DefectDojo Pro have been simplified, to make it easier to assign object access. This feature can be accessed through the [Pro UI](/en/about_defectdojo/ui_pro_vs_os/). + +### Opening the Permissions window + +![image](images/pro_permissions.png) + +When looking at Product Type or Product, you can open the Permissions window to set permissions quickly. This menu can be found in a Table by clicking the horizontal dots **"⋮"**. IF looking at an individual **Product** or **Product Type** page, this menu can be found under the blue gear ‘⚙️’. + +## Setting Permissions through the permissions window + +![image](images/pro_permissions_2.png) + +1. At the top of this window, you can choose to manage permissions for an individual user or for a [user group](../create_user_group). +2. Here, you can select a user or group to add to the Product, and select the [Role](../about_perms_and_roles) that you want that user to have. +3. On the lower table, you can see a list of all users or groups who have access to this object. You can also quickly assign a new role for one of these users or groups from the drop-down menu. + +## Setting Configuration Permissions through the User view + +A user's configuration permissions can now be set in a more user-friendly approach. From the Users View, all configuration permissions are displayed in a dropdown, then grouped by the permission type. If the selection of configuration permissions is different from their current value, an “Update Configuration Permissions” button is displayed. When clicked, the user will be asked to confirm they would like to update the permissions for the selected group before an update is made. + +![image](images/pro_user_view.png) diff --git a/docs/content/en/customize_dojo/user_management/set_user_permissions.md b/docs/content/admin/user_management/set_user_permissions.md similarity index 98% rename from docs/content/en/customize_dojo/user_management/set_user_permissions.md rename to docs/content/admin/user_management/set_user_permissions.md index 4c81d381913..8566be90434 100644 --- a/docs/content/en/customize_dojo/user_management/set_user_permissions.md +++ b/docs/content/admin/user_management/set_user_permissions.md @@ -2,6 +2,7 @@ title: "Set a User's permissions" description: "How to grant Roles & Permissions to a user, as well as superuser status" weight: 2 +audience: opensource --- ## Introduction to Permission Types @@ -42,7 +43,7 @@ By default, the first account created on a new DefectDojo instance will have Sup 4. From the Edit User page: ​ -For Superuser Status, check off the ☑️Superuser Status box, located in the user's Default Information. +For Superuser Status, check off the ☑️ Superuser Status box, located in the user's Default Information. ​ To assign a Global Role, select one from the dropdown Global Role menu at the bottom of the page. ​ diff --git a/docs/content/en/customize_dojo/user_management/user_permission_chart.md b/docs/content/admin/user_management/user_permission_chart.md similarity index 100% rename from docs/content/en/customize_dojo/user_management/user_permission_chart.md rename to docs/content/admin/user_management/user_permission_chart.md diff --git a/docs/content/en/working_with_findings/_index.md b/docs/content/asset_modelling/_index.md similarity index 74% rename from docs/content/en/working_with_findings/_index.md rename to docs/content/asset_modelling/_index.md index cd8d34e560c..850ae7f8369 100644 --- a/docs/content/en/working_with_findings/_index.md +++ b/docs/content/asset_modelling/_index.md @@ -1,5 +1,5 @@ --- -title: "🚩 Work With Findings" +title: "Organize DefectDojo" date: 2021-02-02T20:46:29+01:00 draft: false type: docs diff --git a/docs/content/asset_modelling/engagements_tests/_index.md b/docs/content/asset_modelling/engagements_tests/_index.md new file mode 100644 index 00000000000..a61b559371c --- /dev/null +++ b/docs/content/asset_modelling/engagements_tests/_index.md @@ -0,0 +1,8 @@ +--- +title: "Engagements & Tests" +date: 2021-02-02T20:46:29+01:00 +draft: false +type: docs +weight: 1 +exclude_search: true +--- diff --git a/docs/content/en/working_with_findings/sla_configuration.md b/docs/content/asset_modelling/hierarchy/OS__sla_configuration.md similarity index 99% rename from docs/content/en/working_with_findings/sla_configuration.md rename to docs/content/asset_modelling/hierarchy/OS__sla_configuration.md index 3a9bc1e0781..fc8b07815fc 100644 --- a/docs/content/en/working_with_findings/sla_configuration.md +++ b/docs/content/asset_modelling/hierarchy/OS__sla_configuration.md @@ -2,6 +2,7 @@ title: "SLA Configuration" description: "Configure Service Level Agreements for different Products" weight: 2 +audience: opensource --- Each Product in DefectDojo can have its own Service Level Agreement (SLA) configuration, which represents the days your organization has to remediate or otherwise manage a Finding. diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/source-code-repositories.md b/docs/content/asset_modelling/hierarchy/OS__source-code-repositories.md similarity index 98% rename from docs/content/en/working_with_findings/organizing_engagements_tests/source-code-repositories.md rename to docs/content/asset_modelling/hierarchy/OS__source-code-repositories.md index c1d9766e456..dfd25c66c6b 100644 --- a/docs/content/en/working_with_findings/organizing_engagements_tests/source-code-repositories.md +++ b/docs/content/asset_modelling/hierarchy/OS__source-code-repositories.md @@ -1,8 +1,9 @@ --- title: "Link Findings to source code" -description: "Integration of repositories to navigate to the locaction of findings in the source code." +description: "Integration of repositories to navigate to the location of findings in the source code." draft: false weight: 5 +audience: opensource --- Certain tools (particularly SAST tools) will include the associated file name and line number in vulnerability data. If the repository of the source code is specified in the Engagement, DefectDojo will present the filepath as a link and the user can navigate directly to the location of the vulnerability. diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/pro_assets_organizations.md b/docs/content/asset_modelling/hierarchy/PRO__assets_organizations.md similarity index 99% rename from docs/content/en/working_with_findings/organizing_engagements_tests/pro_assets_organizations.md rename to docs/content/asset_modelling/hierarchy/PRO__assets_organizations.md index 877097c74d1..b33b5336a8a 100644 --- a/docs/content/en/working_with_findings/organizing_engagements_tests/pro_assets_organizations.md +++ b/docs/content/asset_modelling/hierarchy/PRO__assets_organizations.md @@ -1,6 +1,8 @@ --- -title: "⚠️ Assets and Organizations (Pro)" +title: "Assets and Organization structure" description: "DefectDojo Pro - Product Hierarchy Overhaul" +audience: pro +weight: 1 --- DefectDojo Pro is extending the Product/Product Type object classes to provide greater flexibility with the data model. diff --git a/docs/content/asset_modelling/hierarchy/PRO__priority_sla.md b/docs/content/asset_modelling/hierarchy/PRO__priority_sla.md new file mode 100644 index 00000000000..909829725f1 --- /dev/null +++ b/docs/content/asset_modelling/hierarchy/PRO__priority_sla.md @@ -0,0 +1,264 @@ +--- +title: "Assign Priority, Risk and SLAs" +description: "How DefectDojo ranks your Findings" +weight: 1 +audience: pro +--- + +![image](images/pro_finding_priority.png) + +Effective risk-based vulnerability management requires an approach that considers +both business context and technical exploitability. Using DefectDojo Pro’s Priority and Risk feature, users can automatically sort Findings into a meaningful context, ensuring +high-impact vulnerabilities can be addressed first. + +**Priority** is a calculated numerical rank applied to all Findings in your DefectDojo +instance. It allows you to quickly understand vulnerabilities in context, especially within +large organizations that are overseeing security needs for many Findings and/or +Products. + +**Risk** is a 4-level ranking system which factors in a Finding’s exploitability to a greater +degree. This is meant as a less granular, more ’executive-level’ version of Priority. + +![image](images/pro_risk_example.png) + +Priority and Risk values can be used with other filters to compare Findings in any context, such as: + +* within a single Product, Engagement or Test +* globally in all DefectDojo Products +* between a few specific Products + +Applying Finding Priority and Risk helps your team respond to the most relevant +vulnerabilities in your organization, and also provides a framework to assist in +compliance with regulatory standards. + + +Learn more about Priority and Risk with DefectDojo Inc's May 2025 Office Hours: + + + +## How Priority & Risk are calculated +The range of Priority values is from 0 to 1150. The higher the number, the more urgency +the Finding is to triage or remediate. + +Similar to Severity, Risk is scored from Low -> Medium -> Needs Action -> Urgent. **Risk** considers Priority fields and may be different from a tool's reported Severity as a result. + +![image](images/priority-overview.png) + +## Priority Fields: Product-Level + +Each Product in DefectDojo has metadata that tracks business criticality and risk +factors. This metadata is used to help calculate Priority and Risk for any associated +Findings. + +All of these metadata fields can be set on the **Edit Product** form for a given Product. + +![image](images/priority_edit_product.png) + +* **Criticality** can be set to any value of None, Very Low, Low, Medium, High, or Very +High. Criticality is a subjective field, so when assigning this field, consider how the +Product compares to other Products in your organization. +* **User Records** is a numerical estimation of user records in a database (or a system +that can access that database). +* **Revenue** is a numerical estimation of annual revenue for the Product. To calculate Priority, DefectDojo will calculate a percentage by comparing this Product's revenue to the sum of all Products within the Product Type. + +It is not possible to set a currency type in DefectDojo, so make sure that all of your Revenue +estimations have the same currency denomination. (“50000” could mean $50,000 +US Dollars or ¥50,000 Japanese Yen - the denomination does not matter as long as +all of your Products have revenue calculated in the same currency). +* **External Audience** is a true/false value - set this to True if this Product can be +accessed by an external audience. For example, customers, users, or anyone +outside of your organization. +* **Internet Accessible** is a true/false value. If this Product can connect to the open +internet, you should set this value to True. + +Priority is a ‘relative’ calculation, which is meant to compare different Products within +your DefectDojo instance. It is ultimately up to your organization to decide how these +filters are set. These values should be as accurate as possible, but the primary goal is +to highlight your key Products so that you can prioritize vulnerabilities according to your +organization’s policies, so these fields do not necessarily need to be set perfectly. + +## Priority Fields: Finding-Level + +Findings within a Product can have additional metadata which can further adjust the Finding’s Priority and Risk level: + +* Whether or not the Finding has an EPSS score, this is automatically added to Findings and kept up to date for Pro users +* How many Endpoints in the Product are affected by this Finding +* Whether or not a Finding is Under Review +* Whether the Finding is in the KEV (Known Exploited Vulnerabilities) database, which is checked by DefectDojo on a regular basis +* The tool-reported Severity of a Finding (Info, Low, Medium, High, Critical) + + +## Finding Risk Calculation + +![image](images/risk_table.png) + +The Risk column on a Findings table is another way to quickly prioritize Findings. Risk is calculated using a Finding's Priority level, but also factors in a Finding's exploitability to a greater degree. This is meant as a less granular, more 'executive-level' version of Priority. + +The four assignable Risk levels are: + +![image](images/pro_risk_levels.png) + +A Finding's EPSS / exploitability is much more emphasized in the Risk calculation. As a result, a Finding can have both a high priority and a low risk value. + +As with Finding Priority, the Risk calculation cannot currently be adjusted. + +## Priority Insights Dashboard + +Users can take an executive-level view of Priority and Risk in their environment using +the Priority Insights Dashboard (Metrics > Priority Insights in the sidebar) + +![image](images/priority_dashboard.png) + +This dashboard can be filtered to include specific Products or date ranges. As with +other Pro dashboards, this dashboard can be exported from DefectDojo as a PDF to +quickly produce a report. + +## Setting Priority & Risk for Regulatory Compliance + +This is a non-exhaustive list of regulatory standards that specifically require +vulnerability prioritization methods: + +* [SOX (Sarbanes-Oxley Act](https://www.sarbanes-oxley-act.com/)) compliance requires revenue-based prioritization for +systems impacting financial data. In DefectDojo, a system’s revenue can be entered +at the Product level. +* [PCI DSS](https://www.pcisecuritystandards.org/standards/pci-dss/) compliance requires prioritization based on risk ratings and criticality to +cardholder data environments. Business Criticality and External Audience can be +set at the Product level, while DefectDojo’s Finding-level EPSS sync supports PCI’s +risk-based approach. +* [NIST SP 800-40](https://csrc.nist.gov/pubs/sp/800/40/r4/final) is a preventative maintenance guide which specifically calls for +vulnerability prioritization based on business impact, product criticality and +internet accessibility factors. All of these can be set at DefectDojo’s Product level. +* [ISO 27001/27002](https://www.iso.org/standard/27001) Control A.12.6.1 compliance requires management of technical +vulnerabilities with Priority based on risk assessment. +* [GDPR Article 32](https://gdpr-info.eu/art-32-gdpr/) requires risk-based security measures - user records and external +audience flags at the Product level can help prioritize systems in your organization +that process personal data. +* [FISMA/FedRAMP](https://help.fedramp.gov/hc/en-us) compliance require continuous monitoring and risk-based vulnerability remediation. + +DefectDojo Pro's Priority and Risk calculations can be adjusted, allowing you to tailor DefectDojo Pro to match your internal standards for Finding Priority and Risk. + +## Prioritization Engines + +Similar to SLA configurations, Prioritization Engines allow you to set the rules governing how Priority and Risk are calculated. + +![image](images/priority_default.png) + +DefectDojo comes with a built-in Prioritization Engine, which is applied to all Products. However, you can edit this Prioritization Engine to change the weighting of **Finding** and **Product** multipliers, which will adjust how Finding Priority and Risk are assigned. + +### Finding Multipliers + +Eight contextual factors impact the Priority score of a Finding. Three of these are Finding-specific, and the other five are assigned based on the Product that holds the Finding. + +You can tune your Prioritization Engine by adjusting how these factors are applied to the final calculation. + +![image](images/priority_sliders.png) + +Select a factor by clicking the button, and adjust this slider allows you to control the percentage a particular factor is applied. As you adjust the slider, you'll see the Risk thresholds change as a result. + +#### Finding-Level Multipliers + +* **Severity** - a Finding's Severity level +* **Exploitability** - a Finding's KEV and/or EPSS score +* **Endpoints** - the amount of Endpoints associated with a Finding + +#### Product-Level Multipliers + +* **Business Criticality** - the related Product's Business Criticality (None, Very Low, Low, Medium, High, or Very +High) +* **User Records** - the related Product's User Records count +* **Revenue** - the related Product's revenue, relative to the total revenue of the Product Type +* **External Audience** - whether or not the related Product has an external audience +* **Internet Accessible** - whether or not the related Product is internet accessible + +### Risk Thresholds + +Based on the tuning of the Priority Engine, DefectDojo will automatically recommend Risk Thresholds. However, these thresholds can be adjusted as well and set to whatever values you deem appropriate. + +![image](images/risk_threshold.png) + +## Creating New Prioritization Engines + +You can use multiple Prioritization Engines, which can each be assigned to different Products. + +![image](images/priority_engine_new.png) + +Creating a new Prioritization Engine will open the Prioritization Engine form. Once this form is submitted, a new Prioritization Engine will be added to the table. + +## Assigning Prioritization Engines to Products + +Each Product can have a Prioritization Engine currently in use via the **Edit Product** form for a given Product. + +![image](images/priority_chooseengine.png) + +Note that when a Product's Prioritization Engine is changed, or a Prioritization Engine is updated, the Product's Prioritization Engine or the Prioritization Engine itself will be "Locked" until the prioritization calculation has completed. + +Each Product in DefectDojo can have its own Service Level Agreement (SLA) configuration, which represents the days your organization has to remediate or otherwise manage a Finding. + +SLA can be set based on either **[Finding Severity](/en/working_with_findings/organizing_engagements_tests/product_hierarchy/#findings)** or **[Finding Risk](/en/working_with_findings/finding_priority/)** (in DefectDojo Pro). + +![image](images/sla_multiple.png) + +SLAs apply a countdown of days to a Finding based on the day that the Finding was created in DefectDojo. If a Finding is not Closed within the countdown, the Finding will be labeled as in breach of SLA. + +## Working with SLAs + +You can use SLAs as a way to represent your organizations remediation policies. You can also use them as a way to prioritize the longest-active, most critical Findings in your DefectDojo instance. + +* You can sort or filter Finding tables by SLA days. +* SLA violations can be configured to trigger [Notifications](/en/customize_dojo/notifications/about_notifications/) to DefectDojo users assigned to the related Product. +* In **DefectDojo Pro**, SLA performance is also tracked on the [Executive Insights and Remediation](/en/customize_dojo/dashboards/pro_dashboards/) Metrics Dashboards. +* SLA compliance can also be used to create custom [Dashboard Tiles](/en/customize_dojo/dashboards/about_custom_dashboard_tiles/#sla-violation-tile) in **DefectDojo Pro**. + +### Mitigated Within SLA status + +If a Finding is successfully Mitigated by the SLA deadline, the Finding will record a ✅ green check mark in the Mitigated Within SLA column. + +![image](images/sla_mitigated_within.png) + +If a Finding was Mitigated, but not before the SLA was violated, the Finding will record a ❌ red X in the Mitigated Within SLA column. + +### Breaching SLAs + +When an SLA for a given Finding is violated (the Finding is not Closed within the SLA timeline) the ✅ green check will switch to a ❌ red X. The SLA will continue to be tracked with a negative number, to represent how many days the SLA has been breached by. + +![image](images/sla_breached.png) + +## Managing SLA Configurations (Pro) + +In DefectDojo Pro, one or more SLA Configurations are managed under the **Configuration > Service Level Agreements** part of the sidebar. You can create a **New Service Level Agreement** or work with existing SLA configurations from the **All Service Level Agreements** page. + +![image](images/pro_sla_risk.png) + +SLA Configurations can only be edited by Superusers or by a user with the corresponding [Configuration Permission](/en/customize_dojo/user_management/user_permission_chart/#configuration-permission-chart). + +### Configuring SLA + +SLA configurations contain the days assigned to each **Severity** or **Risk** value of DefectDojo. + +![image](images/pro_new_sla.png) + +Each Service Level Agreement can have a unique name, along with an optional description. + +**Restart SLA on Finding Reactivation**: if enabled, this option will start an SLA over when a Finding is Reopened. Otherwise, the SLA will be based on when the Finding was created. + +When editing an SLA, you can choose whether that SLA will use **Severity** or **Risk** as a benchmark for assigning Days To Remediate. This is done by selecting the related option from the **Service Level configuration Type** section of the form. + +From here, you can set the number of days allowed for each **Severity** or **Risk** level. You can also selectively enforce SLAs; by unchecking the **Enforce ___ Finding Days** you can ignore SLA calculation for those levels of Severity or Risk. + +## Apply an SLA Configuration to a Product (Pro) + +Newly created Products in DefectDojo will always apply the **Default SLA Configuration**, which can be set to different values if you wish. + +If you have SLA configurations, you can choose which of these is applied to your Product from the **Edit Product** form. + +![image](images/pro_sla_product.png) + +### SLA Recalculation + +Once a new SLA has been selected for a Product, all of the associated Findings' SLAs will need to be recalculated by DefectDojo. While this process is running, a Product's SLA cannot be changed. + +## Notes on SLAs + +* SLAs can be optionally restarted once a [Risk Accepted](/en/working_with_findings/findings_workflows/risk_acceptances/) Finding reactivates. This is set when creating the Risk Acceptance by setting the **Restart SLA Expired** field. +* Reimporting a Finding does not restart the SLA - SLAs are always calculated from when a Finding was first detected unless **Restart SLA on Finding Reactivation** is enabled. +* Risk Acceptance expiry or reactivation of a Closed Finding are the only ways to reset or recalculate an SLA for a Finding once it is created (without changing the Product's SLA configuration). diff --git a/docs/content/en/working_with_findings/finding_deduplication/_index.md b/docs/content/asset_modelling/hierarchy/_index.md similarity index 63% rename from docs/content/en/working_with_findings/finding_deduplication/_index.md rename to docs/content/asset_modelling/hierarchy/_index.md index 4a35b777b6a..8a33bb5eda6 100644 --- a/docs/content/en/working_with_findings/finding_deduplication/_index.md +++ b/docs/content/asset_modelling/hierarchy/_index.md @@ -1,10 +1,10 @@ --- -title: "Finding Deduplication" +title: "Asset Hierarchy" date: 2021-02-02T20:46:29+01:00 draft: false type: docs weight: 3 sidebar: - collapsed: true + collapsed: false exclude_search: true --- diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/product_health_grade.md b/docs/content/asset_modelling/hierarchy/product_health_grade.md similarity index 100% rename from docs/content/en/working_with_findings/organizing_engagements_tests/product_health_grade.md rename to docs/content/asset_modelling/hierarchy/product_health_grade.md diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/product_hierarchy.md b/docs/content/asset_modelling/hierarchy/product_hierarchy.md similarity index 99% rename from docs/content/en/working_with_findings/organizing_engagements_tests/product_hierarchy.md rename to docs/content/asset_modelling/hierarchy/product_hierarchy.md index 093ba1d90e0..77458d98df1 100644 --- a/docs/content/en/working_with_findings/organizing_engagements_tests/product_hierarchy.md +++ b/docs/content/asset_modelling/hierarchy/product_hierarchy.md @@ -2,6 +2,7 @@ title: "Product Hierarchy: Overview" description: "Understand Product Types, Products, Engagements, Tests and Findings" weight: 1 +audience: opensource --- DefectDojo uses five main data classes to organize your work: **Product Types, Products**, **Engagements**, **Tests**, and **Findings**. diff --git a/docs/content/asset_modelling/tags/_index.md b/docs/content/asset_modelling/tags/_index.md new file mode 100644 index 00000000000..9e85b155376 --- /dev/null +++ b/docs/content/asset_modelling/tags/_index.md @@ -0,0 +1,8 @@ +--- +title: "Tags" +date: 2021-02-02T20:46:29+01:00 +draft: false +type: docs +weight: 1 +exclude_search: true +--- diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/tagging_objects.md b/docs/content/asset_modelling/tags/tagging_objects.md similarity index 99% rename from docs/content/en/working_with_findings/organizing_engagements_tests/tagging_objects.md rename to docs/content/asset_modelling/tags/tagging_objects.md index d551f07de0b..2afc6d2b291 100644 --- a/docs/content/en/working_with_findings/organizing_engagements_tests/tagging_objects.md +++ b/docs/content/asset_modelling/tags/tagging_objects.md @@ -1,5 +1,5 @@ --- -title: "Tags" +title: "Tagging Objects" description: "Use Tags to create a new slice of your data model" draft: false weight: 2 diff --git a/docs/content/en/changelog/_index.md b/docs/content/automation/api/_index.md similarity index 93% rename from docs/content/en/changelog/_index.md rename to docs/content/automation/api/_index.md index e0913288e2e..c415210e8d4 100644 --- a/docs/content/en/changelog/_index.md +++ b/docs/content/automation/api/_index.md @@ -1,5 +1,5 @@ --- -title: "📝 Changelog" +title: "Automation" description: "" summary: "" date: 2023-09-07T16:06:50+02:00 diff --git a/docs/content/en/api/api-v2-docs.md b/docs/content/automation/api/api-v2-docs.md similarity index 100% rename from docs/content/en/api/api-v2-docs.md rename to docs/content/automation/api/api-v2-docs.md diff --git a/docs/content/en/customize_dojo/rules_engine.md b/docs/content/automation/api/rules_engine.md similarity index 99% rename from docs/content/en/customize_dojo/rules_engine.md rename to docs/content/automation/api/rules_engine.md index 22f156dd56c..258e43b542b 100644 --- a/docs/content/en/customize_dojo/rules_engine.md +++ b/docs/content/automation/api/rules_engine.md @@ -2,6 +2,7 @@ title: "Rules Engine Automation" description: "Working with Rules Engine Automation" weight: 1 +audience: pro --- Note: Rules Engine is a DefectDojo Pro-only feature. diff --git a/docs/content/en/open_source/upgrading/1.10.md b/docs/content/changelog/os_upgrading/1.10.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.10.md rename to docs/content/changelog/os_upgrading/1.10.md diff --git a/docs/content/en/open_source/upgrading/1.11.md b/docs/content/changelog/os_upgrading/1.11.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.11.md rename to docs/content/changelog/os_upgrading/1.11.md diff --git a/docs/content/en/open_source/upgrading/1.12.md b/docs/content/changelog/os_upgrading/1.12.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.12.md rename to docs/content/changelog/os_upgrading/1.12.md diff --git a/docs/content/en/open_source/upgrading/1.13.md b/docs/content/changelog/os_upgrading/1.13.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.13.md rename to docs/content/changelog/os_upgrading/1.13.md diff --git a/docs/content/en/open_source/upgrading/1.14.md b/docs/content/changelog/os_upgrading/1.14.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.14.md rename to docs/content/changelog/os_upgrading/1.14.md diff --git a/docs/content/en/open_source/upgrading/1.15.md b/docs/content/changelog/os_upgrading/1.15.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.15.md rename to docs/content/changelog/os_upgrading/1.15.md diff --git a/docs/content/en/open_source/upgrading/1.2.2.md b/docs/content/changelog/os_upgrading/1.2.2.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.2.2.md rename to docs/content/changelog/os_upgrading/1.2.2.md diff --git a/docs/content/en/open_source/upgrading/1.2.3.md b/docs/content/changelog/os_upgrading/1.2.3.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.2.3.md rename to docs/content/changelog/os_upgrading/1.2.3.md diff --git a/docs/content/en/open_source/upgrading/1.2.4.md b/docs/content/changelog/os_upgrading/1.2.4.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.2.4.md rename to docs/content/changelog/os_upgrading/1.2.4.md diff --git a/docs/content/en/open_source/upgrading/1.2.8.md b/docs/content/changelog/os_upgrading/1.2.8.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.2.8.md rename to docs/content/changelog/os_upgrading/1.2.8.md diff --git a/docs/content/en/open_source/upgrading/1.2.9.md b/docs/content/changelog/os_upgrading/1.2.9.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.2.9.md rename to docs/content/changelog/os_upgrading/1.2.9.md diff --git a/docs/content/en/open_source/upgrading/1.3.1.md b/docs/content/changelog/os_upgrading/1.3.1.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.3.1.md rename to docs/content/changelog/os_upgrading/1.3.1.md diff --git a/docs/content/en/open_source/upgrading/1.7.0.md b/docs/content/changelog/os_upgrading/1.7.0.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.7.0.md rename to docs/content/changelog/os_upgrading/1.7.0.md diff --git a/docs/content/en/open_source/upgrading/1.8.0.md b/docs/content/changelog/os_upgrading/1.8.0.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.8.0.md rename to docs/content/changelog/os_upgrading/1.8.0.md diff --git a/docs/content/en/open_source/upgrading/1.9.3.md b/docs/content/changelog/os_upgrading/1.9.3.md similarity index 100% rename from docs/content/en/open_source/upgrading/1.9.3.md rename to docs/content/changelog/os_upgrading/1.9.3.md diff --git a/docs/content/en/open_source/upgrading/2.0.md b/docs/content/changelog/os_upgrading/2.0.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.0.md rename to docs/content/changelog/os_upgrading/2.0.md diff --git a/docs/content/en/open_source/upgrading/2.10.md b/docs/content/changelog/os_upgrading/2.10.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.10.md rename to docs/content/changelog/os_upgrading/2.10.md diff --git a/docs/content/en/open_source/upgrading/2.12.md b/docs/content/changelog/os_upgrading/2.12.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.12.md rename to docs/content/changelog/os_upgrading/2.12.md diff --git a/docs/content/en/open_source/upgrading/2.13.md b/docs/content/changelog/os_upgrading/2.13.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.13.md rename to docs/content/changelog/os_upgrading/2.13.md diff --git a/docs/content/en/open_source/upgrading/2.15.md b/docs/content/changelog/os_upgrading/2.15.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.15.md rename to docs/content/changelog/os_upgrading/2.15.md diff --git a/docs/content/en/open_source/upgrading/2.16.md b/docs/content/changelog/os_upgrading/2.16.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.16.md rename to docs/content/changelog/os_upgrading/2.16.md diff --git a/docs/content/en/open_source/upgrading/2.17.md b/docs/content/changelog/os_upgrading/2.17.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.17.md rename to docs/content/changelog/os_upgrading/2.17.md diff --git a/docs/content/en/open_source/upgrading/2.18.md b/docs/content/changelog/os_upgrading/2.18.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.18.md rename to docs/content/changelog/os_upgrading/2.18.md diff --git a/docs/content/en/open_source/upgrading/2.19.md b/docs/content/changelog/os_upgrading/2.19.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.19.md rename to docs/content/changelog/os_upgrading/2.19.md diff --git a/docs/content/en/open_source/upgrading/2.2.md b/docs/content/changelog/os_upgrading/2.2.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.2.md rename to docs/content/changelog/os_upgrading/2.2.md diff --git a/docs/content/en/open_source/upgrading/2.20.md b/docs/content/changelog/os_upgrading/2.20.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.20.md rename to docs/content/changelog/os_upgrading/2.20.md diff --git a/docs/content/en/open_source/upgrading/2.21.md b/docs/content/changelog/os_upgrading/2.21.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.21.md rename to docs/content/changelog/os_upgrading/2.21.md diff --git a/docs/content/en/open_source/upgrading/2.22.md b/docs/content/changelog/os_upgrading/2.22.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.22.md rename to docs/content/changelog/os_upgrading/2.22.md diff --git a/docs/content/en/open_source/upgrading/2.23.md b/docs/content/changelog/os_upgrading/2.23.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.23.md rename to docs/content/changelog/os_upgrading/2.23.md diff --git a/docs/content/en/open_source/upgrading/2.24.md b/docs/content/changelog/os_upgrading/2.24.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.24.md rename to docs/content/changelog/os_upgrading/2.24.md diff --git a/docs/content/en/open_source/upgrading/2.25.md b/docs/content/changelog/os_upgrading/2.25.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.25.md rename to docs/content/changelog/os_upgrading/2.25.md diff --git a/docs/content/en/open_source/upgrading/2.26.md b/docs/content/changelog/os_upgrading/2.26.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.26.md rename to docs/content/changelog/os_upgrading/2.26.md diff --git a/docs/content/en/open_source/upgrading/2.27.md b/docs/content/changelog/os_upgrading/2.27.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.27.md rename to docs/content/changelog/os_upgrading/2.27.md diff --git a/docs/content/en/open_source/upgrading/2.28.md b/docs/content/changelog/os_upgrading/2.28.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.28.md rename to docs/content/changelog/os_upgrading/2.28.md diff --git a/docs/content/en/open_source/upgrading/2.29.md b/docs/content/changelog/os_upgrading/2.29.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.29.md rename to docs/content/changelog/os_upgrading/2.29.md diff --git a/docs/content/en/open_source/upgrading/2.3.md b/docs/content/changelog/os_upgrading/2.3.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.3.md rename to docs/content/changelog/os_upgrading/2.3.md diff --git a/docs/content/en/open_source/upgrading/2.30.md b/docs/content/changelog/os_upgrading/2.30.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.30.md rename to docs/content/changelog/os_upgrading/2.30.md diff --git a/docs/content/en/open_source/upgrading/2.31.md b/docs/content/changelog/os_upgrading/2.31.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.31.md rename to docs/content/changelog/os_upgrading/2.31.md diff --git a/docs/content/en/open_source/upgrading/2.32.md b/docs/content/changelog/os_upgrading/2.32.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.32.md rename to docs/content/changelog/os_upgrading/2.32.md diff --git a/docs/content/en/open_source/upgrading/2.33.md b/docs/content/changelog/os_upgrading/2.33.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.33.md rename to docs/content/changelog/os_upgrading/2.33.md diff --git a/docs/content/en/open_source/upgrading/2.34.md b/docs/content/changelog/os_upgrading/2.34.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.34.md rename to docs/content/changelog/os_upgrading/2.34.md diff --git a/docs/content/en/open_source/upgrading/2.35.md b/docs/content/changelog/os_upgrading/2.35.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.35.md rename to docs/content/changelog/os_upgrading/2.35.md diff --git a/docs/content/en/open_source/upgrading/2.36.md b/docs/content/changelog/os_upgrading/2.36.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.36.md rename to docs/content/changelog/os_upgrading/2.36.md diff --git a/docs/content/en/open_source/upgrading/2.37.md b/docs/content/changelog/os_upgrading/2.37.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.37.md rename to docs/content/changelog/os_upgrading/2.37.md diff --git a/docs/content/en/open_source/upgrading/2.38.md b/docs/content/changelog/os_upgrading/2.38.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.38.md rename to docs/content/changelog/os_upgrading/2.38.md diff --git a/docs/content/en/open_source/upgrading/2.39.md b/docs/content/changelog/os_upgrading/2.39.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.39.md rename to docs/content/changelog/os_upgrading/2.39.md diff --git a/docs/content/en/open_source/upgrading/2.4.md b/docs/content/changelog/os_upgrading/2.4.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.4.md rename to docs/content/changelog/os_upgrading/2.4.md diff --git a/docs/content/en/open_source/upgrading/2.40.md b/docs/content/changelog/os_upgrading/2.40.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.40.md rename to docs/content/changelog/os_upgrading/2.40.md diff --git a/docs/content/en/open_source/upgrading/2.41.md b/docs/content/changelog/os_upgrading/2.41.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.41.md rename to docs/content/changelog/os_upgrading/2.41.md diff --git a/docs/content/en/open_source/upgrading/2.42.md b/docs/content/changelog/os_upgrading/2.42.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.42.md rename to docs/content/changelog/os_upgrading/2.42.md diff --git a/docs/content/en/open_source/upgrading/2.43.md b/docs/content/changelog/os_upgrading/2.43.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.43.md rename to docs/content/changelog/os_upgrading/2.43.md diff --git a/docs/content/en/open_source/upgrading/2.44.1.md b/docs/content/changelog/os_upgrading/2.44.1.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.44.1.md rename to docs/content/changelog/os_upgrading/2.44.1.md diff --git a/docs/content/en/open_source/upgrading/2.44.md b/docs/content/changelog/os_upgrading/2.44.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.44.md rename to docs/content/changelog/os_upgrading/2.44.md diff --git a/docs/content/en/open_source/upgrading/2.45.md b/docs/content/changelog/os_upgrading/2.45.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.45.md rename to docs/content/changelog/os_upgrading/2.45.md diff --git a/docs/content/en/open_source/upgrading/2.46.md b/docs/content/changelog/os_upgrading/2.46.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.46.md rename to docs/content/changelog/os_upgrading/2.46.md diff --git a/docs/content/en/open_source/upgrading/2.47.md b/docs/content/changelog/os_upgrading/2.47.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.47.md rename to docs/content/changelog/os_upgrading/2.47.md diff --git a/docs/content/en/open_source/upgrading/2.48.2.md b/docs/content/changelog/os_upgrading/2.48.2.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.48.2.md rename to docs/content/changelog/os_upgrading/2.48.2.md diff --git a/docs/content/en/open_source/upgrading/2.48.md b/docs/content/changelog/os_upgrading/2.48.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.48.md rename to docs/content/changelog/os_upgrading/2.48.md diff --git a/docs/content/en/open_source/upgrading/2.49.md b/docs/content/changelog/os_upgrading/2.49.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.49.md rename to docs/content/changelog/os_upgrading/2.49.md diff --git a/docs/content/en/open_source/upgrading/2.5.md b/docs/content/changelog/os_upgrading/2.5.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.5.md rename to docs/content/changelog/os_upgrading/2.5.md diff --git a/docs/content/en/open_source/upgrading/2.50.md b/docs/content/changelog/os_upgrading/2.50.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.50.md rename to docs/content/changelog/os_upgrading/2.50.md diff --git a/docs/content/en/open_source/upgrading/2.51.md b/docs/content/changelog/os_upgrading/2.51.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.51.md rename to docs/content/changelog/os_upgrading/2.51.md diff --git a/docs/content/en/open_source/upgrading/2.52.md b/docs/content/changelog/os_upgrading/2.52.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.52.md rename to docs/content/changelog/os_upgrading/2.52.md diff --git a/docs/content/en/open_source/upgrading/2.53.md b/docs/content/changelog/os_upgrading/2.53.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.53.md rename to docs/content/changelog/os_upgrading/2.53.md diff --git a/docs/content/en/open_source/upgrading/2.54.md b/docs/content/changelog/os_upgrading/2.54.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.54.md rename to docs/content/changelog/os_upgrading/2.54.md diff --git a/docs/content/en/open_source/upgrading/2.6.md b/docs/content/changelog/os_upgrading/2.6.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.6.md rename to docs/content/changelog/os_upgrading/2.6.md diff --git a/docs/content/en/open_source/upgrading/2.7.md b/docs/content/changelog/os_upgrading/2.7.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.7.md rename to docs/content/changelog/os_upgrading/2.7.md diff --git a/docs/content/en/open_source/upgrading/2.8.md b/docs/content/changelog/os_upgrading/2.8.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.8.md rename to docs/content/changelog/os_upgrading/2.8.md diff --git a/docs/content/en/open_source/upgrading/2.9.md b/docs/content/changelog/os_upgrading/2.9.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.9.md rename to docs/content/changelog/os_upgrading/2.9.md diff --git a/docs/content/en/open_source/upgrading/_index.md b/docs/content/changelog/os_upgrading/_index.md similarity index 100% rename from docs/content/en/open_source/upgrading/_index.md rename to docs/content/changelog/os_upgrading/_index.md diff --git a/docs/content/en/open_source/upgrading/upgrading_guide.md b/docs/content/changelog/os_upgrading/upgrading_guide.md similarity index 100% rename from docs/content/en/open_source/upgrading/upgrading_guide.md rename to docs/content/changelog/os_upgrading/upgrading_guide.md diff --git a/docs/content/en/changelog/changelog.md b/docs/content/changelog/pro_changelog.md similarity index 100% rename from docs/content/en/changelog/changelog.md rename to docs/content/changelog/pro_changelog.md diff --git a/docs/content/en/about_defectdojo/_index.md b/docs/content/en/about_defectdojo/_index.md deleted file mode 100644 index aa822dcdbe4..00000000000 --- a/docs/content/en/about_defectdojo/_index.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: "About DefectDojo" -date: 2021-02-02T20:46:29+01:00 -draft: false -type: docs -weight: 1 - -cascade: -- type: "blog" - # set to false to include a blog section in the section nav along with docs - toc_root: true - _target: - path: "/blog/**" -- type: "docs" - _target: - path: "/**" -exclude_search: true ---- diff --git a/docs/content/en/connecting_your_tools/parsers/file/openreports.md b/docs/content/en/connecting_your_tools/parsers/file/openreports.md deleted file mode 100644 index c3ec62d9a42..00000000000 --- a/docs/content/en/connecting_your_tools/parsers/file/openreports.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -title: "OpenReports" -toc_hide: true ---- - -Import vulnerability scan reports formatted as [OpenReports](https://github.com/openreports/reports-api). - -OpenReports is a Kubernetes-native reporting framework that aggregates vulnerability scan results and compliance checks from various security tools into a unified format. It provides a standardized API for collecting and reporting security findings across your Kubernetes infrastructure. - -### File Types - -DefectDojo parser accepts a .json file. - -### Exporting Reports from Kubernetes - -To export OpenReports from your Kubernetes cluster, use kubectl: - -```bash -kubectl get reports -A -ojson > reports.json -``` - -This command retrieves all Report objects from all namespaces and saves them in JSON format. You can then import the `reports.json` file into DefectDojo. - -To export reports from a specific namespace: - -```bash -kubectl get reports -n -ojson > reports.json -``` - -### Report Formats - -The parser supports multiple input formats: - -- Single Report object -- Array of Report objects -- Kubernetes List object containing Report items - -### Sample Scan Data - -Sample OpenReports scans can be found in the [unittests/scans/openreports directory](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/openreports). - -### Supported Fields - -The parser extracts the following information from OpenReports JSON: - -- **Metadata**: Report name, namespace, UID for stable deduplication -- **Scope**: Kubernetes resource information (kind, name, namespace) -- **Results**: Individual security findings with: - - Message and description - - Policy ID (e.g., CVE identifiers) - - Severity (critical, high, medium, low, info) - - Category (e.g., "vulnerability scan", "compliance check") - - Source scanner information - - Package details (name, installed version, fixed version) - - References and URLs - -### Severity Mapping - -OpenReports severity levels are mapped to DefectDojo as follows: - -| OpenReports Severity | DefectDojo Severity | -|----------------------|---------------------| -| critical | Critical | -| high | High | -| medium | Medium | -| low | Low | -| info | Info | - -### Result Status Mapping - -The `result` field in OpenReports is mapped to DefectDojo finding status: - -| OpenReports Result | Active | Verified | Description | -|--------------------|--------|----------|------------------------------------------------| -| fail | True | True | Finding requires attention | -| warn | True | True | Warning-level finding | -| pass | False | False | Check passed, no vulnerability found | -| skip | False | False | Check was skipped | - -### Features - -**CVE Tracking**: Findings with CVE policy IDs are automatically tagged with vulnerability identifiers. - -**Fix Availability**: The parser automatically sets the `fix_available` flag when a fixed version is provided. - -**Service Mapping**: Findings are mapped to services based on Kubernetes scope (namespace/kind/name). - -**Stable Deduplication**: Uses report UID from metadata for consistent deduplication across reimports. - -**Tagging**: Findings are automatically tagged with category, source scanner, and Kubernetes resource kind. - -### Example JSON Format - -```json -{ - "apiVersion": "openreports.io/v1alpha1", - "kind": "Report", - "metadata": { - "name": "deployment-test-app-630fc", - "namespace": "test", - "uid": "b1fcca57-2efd-44d3-89e9-949e29b61936" - }, - "scope": { - "kind": "Deployment", - "name": "test-app" - }, - "results": [ - { - "category": "vulnerability scan", - "message": "openssl: Out-of-bounds read in HTTP client", - "policy": "CVE-2025-9232", - "properties": { - "fixedVersion": "3.5.4-r0", - "installedVersion": "3.5.2-r1", - "pkgName": "libcrypto3", - "primaryURL": "https://avd.aquasec.com/nvd/cve-2025-9232" - }, - "result": "warn", - "severity": "low", - "source": "image-scanner" - } - ] -} -``` - -### Default Deduplication Hashcode Fields - -By default, DefectDojo identifies duplicate Findings using these [hashcode fields](https://docs.defectdojo.com/en/working_with_findings/finding_deduplication/about_deduplication/): - -- unique_id_from_tool (format: `report_uid:policy:package_name`) -- title -- severity -- vulnerability ids (for CVE findings) -- description - -The parser uses the report UID from metadata to create a stable `unique_id_from_tool` that persists across reimports. diff --git a/docs/content/en/customize_dojo/_index.md b/docs/content/en/customize_dojo/_index.md deleted file mode 100644 index d2799af41e9..00000000000 --- a/docs/content/en/customize_dojo/_index.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: "👥 Management & Customization" -description: "Dashboards, User Access" -summary: "" -date: 2023-09-07T16:06:50+02:00 -lastmod: 2023-09-07T16:06:50+02:00 -draft: false -weight: 5 -chapter: true -seo: - title: "" # custom title (optional) - description: "" # custom description (recommended) - canonical: "" # custom canonical URL (optional) - robots: "" # custom robot tags (optional) -exclude_search: true ---- \ No newline at end of file diff --git a/docs/content/en/customize_dojo/dashboards/pro_dashboards.md b/docs/content/en/customize_dojo/dashboards/pro_dashboards.md deleted file mode 100644 index ff712ead903..00000000000 --- a/docs/content/en/customize_dojo/dashboards/pro_dashboards.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Metrics Dashboards (Pro)" -description: "How to use DefectDojo's Pro Metrics" -weight: 3 ---- - -The DefectDojo Pro UI has many Metrics dashboards which are kept up to date in real-time. Each Dashboard can render a PDF report to share data with key stakeholders. - -These dashboards include: - -* **Executive Insights**, which displays the current state of your Products and Product Types. -* **Program Insights**, which displays the effectiveness of your security team and the cost savings associated with separating duplicates and false positives from actionable Findings -* **Remediation Insights**, which displays your effectiveness at remediating Findings. -* **Tool Insights**, which displays the effectiveness of your tool suite (and Connectors pipelines) at detecting and reporting vulnerabilities. - -## Executive Insights - -![image](images/pro_dashboards_1.png) - -This dashboard allows you to select any Product Type or Product from the filter list and get a status report on the number of Findings present. If no filters are selected, this dashboard will display the status of all Product Types and Products. - -![image](images/pro_dashboards_2.png) - -Graphs are provided to illustrate SLA compliance, active Findings over time, and other metrics relevant to the selected Product/Product Types and timeframe. - -## Program Insights - -![image](images/pro_dashboards_3.png) - -This dashboard shows a report of your team's security program, including quarterly breakdowns on testing, as well as noise reduction through the application of deduplication and reimport features. - -## Remediation Insights - -![image](images/pro_dashboards_4.png) - -This dashboard tracks your remediation performance, charting time to remediation as well as Risk Acceptance over time. "Highly Exploitable Findings" uses [EPSS scores](/en/working_with_findings/intro_to_findings/#monitor-current-vulnerabilities-using-cves-and-epss-scores-pro-feature) to estimate the likelihood of a Finding's exploit. DefectDojo Pro comes with a daily-updated EPSS database to which assigns those scores and percentiles to each of your Findings. - -## Tool Insights - -![image](images/pro_dashboards_5.png) - -This dashboard tracks the performance of each security tool used in DefectDojo, based on the count and severity of Findings that it reports. - -## Switching To The Pro UI - -These Dashboards are available under **Metrics** in the Pro UI. -To access the Pro UI, open the User Options menu from the top-right hand corner. You can also switch back to the Classic UI from the same menu. - -![image](images/beta-classic-uis.png) \ No newline at end of file diff --git a/docs/content/en/customize_dojo/user_management/pro_permissions_overhaul.md b/docs/content/en/customize_dojo/user_management/pro_permissions_overhaul.md deleted file mode 100644 index acb025cfb40..00000000000 --- a/docs/content/en/customize_dojo/user_management/pro_permissions_overhaul.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: "🟧 Set Permissions in Pro" -description: "Overhaul, pro feature" -weight: 3 ---- - -Permissions in DefectDojo Pro have been simplified, to make it easier to assign object access. This feature can be accessed through the [Pro UI](/en/about_defectdojo/ui_pro_vs_os/). - -### Opening the Permissions window - -![image](images/pro_permissions.png) - -When looking at Product Type or Product, you can open the Permissions window to set permissions quickly. This menu can be found in a Table by clicking the horizontal dots **"⋮"**. IF looking at an individual **Product** or **Product Type** page, this menu can be found under the blue gear ‘⚙️’. - -## Setting Permissions through the permissions window - -![image](images/pro_permissions_2.png) - -1. At the top of this window, you can choose to manage permissions for an individual user or for a [user group](../create_user_group). -2. Here, you can select a user or group to add to the Product, and select the [Role](../about_perms_and_roles) that you want that user to have. -3. On the lower table, you can see a list of all users or groups who have access to this object. You can also quickly assign a new role for one of these users or groups from the drop-down menu. - -## Setting Configuration Permissions through the User view - -A user's configuration permissions can now be set in a more user-friendly approach. From the Users View, all configuration permissions are displayed in a dropdown, then grouped by the permission type. If the selection of configuration permissions is different from their current value, an “Update Configuration Permissions” button is displayed. When clicked, the user will be asked to confirm they would like to update the permissions for the selected group before an update is made. - -![image](images/pro_user_view.png) diff --git a/docs/content/en/open_source/installation/_index.md b/docs/content/en/open_source/installation/_index.md deleted file mode 100644 index 363026c464c..00000000000 --- a/docs/content/en/open_source/installation/_index.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: "Open-Source Installation & Configuration" -description: "How to install and configure DefectDojo" -weight: 1 -chapter: true ---- diff --git a/docs/content/en/open_source/installation/demo.md b/docs/content/en/open_source/installation/demo.md deleted file mode 100644 index b98404ea6a2..00000000000 --- a/docs/content/en/open_source/installation/demo.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: "Online Demo" -description: "There is DefectDojo demo site running the latest officially released version" -draft: false -weight: 6 ---- - -## Demo - -Try out the demo sever at [demo.defectdojo.org](https://demo.defectdojo.org) - -Log in with `admin / 1Defectdojo@demo#appsec`. Please note that the demo is publicly accessable and regularly reset. Do not put sensitive data in the demo. diff --git a/docs/content/en/working_with_findings/finding_deduplication/about_deduplication.md b/docs/content/en/working_with_findings/finding_deduplication/about_deduplication.md deleted file mode 100644 index b947afc335d..00000000000 --- a/docs/content/en/working_with_findings/finding_deduplication/about_deduplication.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "About Deduplication" -description: "Deduplication fundamentals and key concepts" -weight: 1 ---- - -DefectDojo is designed to ingest bulk reports from tools, creating one or more Findings based on the content of the report. When using DefectDojo, you’ll most likely be ingesting reports from the same tool on a regular basis, which means that duplicate Findings are highly likely. - -This is where Deduplication comes in, a Smart feature which you can set up to automatically manage duplicate Findings. - -## How DefectDojo handles duplicates - -1. First, you import **Test 1\.** Your report contains a vulnerability which is recorded as Finding A. -2. **Later, you import Test 2 which contains the same vulnerability. This will be recorded as Finding B, and Finding B will be marked as a duplicate of Finding A.** -3. Later still, you import **Test 3** which also contains that vulnerability. This will be recorded as Finding C, which will be marked as a duplicate of Finding A. - -By creating and marking Duplicates in this way, DefectDojo ensures that all the work for the ‘original’ vulnerability is centralized on the original Finding page, without creating separate contexts, or giving your team the impression that there are multiple separate vulnerabilities which need to be addressed. - -By default, these Tests would need to be nested under the same Product for Deduplication to be applied. If you wish, you can further limit the Deduplication scope to a single Engagement. - -![Deduplication on product and engagement level](images/deduplication.png) - -Duplicate Findings are set as Inactive by default. This does not mean the Duplicate Finding itself is Inactive. Rather, this is so that your team only has a single active Finding to work on and remediate, with the implication being that once the original Finding is Mitigated, the Duplicates will also be Mitigated. - -## Deduplication vs Reimport - -Deduplication and Reimport are similar processes but they have a key difference: - -* When you Reimport to a Test, the Reimport process looks at incoming Findings, **filters and** **discards any matches**. Those matches will never be created as Findings or Finding Duplicates. -* Deduplication is applied 'passively' on Findings that have already been created. It will identify duplicates in scope and **label them**, but it will not delete or discard the Finding unless 'Delete Deduplicate Findings' is enabled. -* The 'reimport' action of discarding a Finding always happens before deduplication; DefectDojo **cannot deduplicate Findings that are never created** as a result of Reimport's filtering. - -## When are duplicates appropriate? - -Duplicates are useful when you’re dealing with shared, but discrete Testing contexts. For example, if your Product is uploading Test results for two different repositories, which need to be compared, it’s useful to know which vulnerabilities are shared across those repositories. - -However, if DefectDojo is creating excess duplicates, this can also be a sign that you need to adjust your pipelines or import processes. - -## What do my duplicates indicate? - -* **The same vulnerability, but found in a different context:** this is the appropriate way to use Duplicate Findings. If you have many components which are affected by the same vulnerability, you would likely want to know which components are affected to understand the scope of the problem. -​ -* **The same vulnerability, found in the same context**: better options exist for this case. If the Duplicate Finding does not give you any new context on the vulnerability, or if you find yourself frequently ignoring or deleting your duplicate Findings, this is a sign that your process can be improved. For example, Reimport allows you to effectively manage incoming reports from a CI/CD pipeline. Rather than create a completely new Finding object for each duplicate, Reimport will make a note of the incoming duplicate without creating the Duplicate Finding at all. diff --git a/docs/content/en/working_with_findings/finding_deduplication/deduplication_algorithms.md b/docs/content/en/working_with_findings/finding_deduplication/deduplication_algorithms.md deleted file mode 100644 index 5b5d56ca85d..00000000000 --- a/docs/content/en/working_with_findings/finding_deduplication/deduplication_algorithms.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: "Deduplication Algorithms" -description: "How DefectDojo identifies duplicates: Unique ID, Hash Code, Unique ID or Hash Code, Legacy" -weight: 3 ---- - -## Overview - -DefectDojo supports four deduplication algorithms that can be selected per parser (test type): - -- **Unique ID From Tool**: Uses the scanner-provided unique identifier. -- **Hash Code**: Uses a configured set of fields to compute a hash. -- **Unique ID From Tool or Hash Code**: Prefer the tool’s unique ID; fall back to hash when no matching unique ID is found. -- **Legacy**: Historical algorithm with multiple conditions; only available in the Open Source version. - -Algorithm selection per parser is controlled by `DEDUPLICATION_ALGORITHM_PER_PARSER` (see the [Open-Source tuning page](/en/working_with_findings/finding_deduplication/deduplication_tuning_os/) for configuration details). - -## How endpoints are assessed per algorithm - -Endpoints can influence deduplication in different ways depending on the algorithm and configuration. - -### Unique ID From Tool - -- Deduplication uses `unique_id_from_tool` (or `vuln_id_from_tool`). -- **Endpoints are ignored** for duplicate matching. -- A finding’s hash may still be calculated for other features, but it does not affect deduplication under this algorithm. - -### Hash Code - -- Deduplication uses a hash computed from fields specified by `HASHCODE_FIELDS_PER_SCANNER` for the given parser. -- The hash also includes fields from `HASH_CODE_FIELDS_ALWAYS` (see Service field section below). -- Endpoints can affect deduplication in two ways: - - If the scanner’s hash fields include `endpoints`, they are part of the hash and must match accordingly. -- If the scanner’s hash fields do not include `endpoints`, optional endpoint-based matching can be enabled via `DEDUPE_ALGO_ENDPOINT_FIELDS` (OS setting). When configured: - - Set it to an empty list `[]` to ignore endpoints entirely. - - Set it to a list of endpoint attributes (e.g. `["host", "port"]`). If at least one endpoint pair between the two findings matches on all listed attributes, deduplication can occur. - -### Unique ID From Tool or Hash Code -A finding is a duplicate with another if they have the same unique_id_from_tool OR the same hash_code. - -The endpoints also have to match for the findings to be considered duplicates, see the Hash Code algorithm above. - -### Legacy (OS only) - -- Deduplication considers multiple attributes including endpoints. -- Behavior differs for static vs dynamic findings: - - **Static findings**: The new finding must contain all endpoints of the original. Extra endpoints on the new finding are allowed. - - **Dynamic findings**: Endpoints must strictly match (commonly by host and port); differing endpoints prevent deduplication. -- If there are no endpoints and both `file_path` and `line` are empty, deduplication typically does not occur. - -## Background processing - -- Dedupe is triggered on import/reimport and during certain updates run via Celery in the background. - -## Service field and its impact - -- By default, `HASH_CODE_FIELDS_ALWAYS = ["service"]`, meaning the `service` associated with a finding is appended to the hash for all scanners. -- Practical implications: - - Two otherwise identical findings with different `service` values will produce different hashes and will not deduplicate under Hash-based paths. - - During import/reimport, the `Service` field entered in the UI can override the parser-provided service. Changing it can change the hash and therefore affect deduplication outcomes. - - If you want service to have no impact on deduplication, configure `HASH_CODE_FIELDS_ALWAYS` accordingly (see the OS tuning page). Removing `service` from the always-included list will stop it from affecting hashes. - -See also: the [Open Source tuning guide](/en/working_with_findings/finding_deduplication/deduplication_tuning_os/) for configuration details and examples. diff --git a/docs/content/en/working_with_findings/finding_deduplication/delete_deduplicates.md b/docs/content/en/working_with_findings/finding_deduplication/delete_deduplicates.md deleted file mode 100644 index 8a4cbed898b..00000000000 --- a/docs/content/en/working_with_findings/finding_deduplication/delete_deduplicates.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: "Delete Deduplicate Findings" -description: "Remove excess duplicate Findings from DefectDojo" -weight: 3 ---- - -If you have an excessive amount of duplicate Findings which you want to delete, you can set **Delete Deduplicate Findings** as an option in the **System Settings**. - -**Delete Deduplicate Findings**, combined with the **Maximum Duplicates** field allows DefectDojo to limit the amount of Duplicate Findings stored. When this field is enabled, DefectDojo will only keep a certain number of Duplicate Findings. - -## Which duplicates will be deleted? - -The original Finding will never be deleted automatically from DefectDojo, but once the threshold for Maximum Duplicates is crossed, DefectDojo will automatically delete the oldest Duplicate Finding. - -For example, let’s say that you had your Maximum Duplicates field set to ‘1’. - -1. First, you import **Test 1\.** Your report contains a vulnerability which is recorded as Finding A. -2. **Later, you import Test 2 contains the same vulnerability. This will be recorded as Finding B, and Finding B will be marked as a duplicate of Finding A.** -3. Later still, you import **Test 3** which also contains that vulnerability. This will be recorded as Finding C, which will be marked as a duplicate of Finding A. At this time, Finding B will be deleted from DefectDojo as the threshold for maximum duplicates has been crossed. - -## Applying this setting - -Applying **Delete Deduplicate Findings** will begin a deletion process immediately. This setting can be applied on the **System Settings** page. See Enabling Deduplication for more information. diff --git a/docs/content/en/working_with_findings/finding_priority.md b/docs/content/en/working_with_findings/finding_priority.md deleted file mode 100644 index caff9c56bae..00000000000 --- a/docs/content/en/working_with_findings/finding_priority.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: "⏱️ Finding Priority and Risk (Pro)" -description: "How DefectDojo ranks your Findings" -weight: 1 ---- - -![image](images/pro_finding_priority.png) - -Effective risk-based vulnerability management requires an approach that considers -both business context and technical exploitability. Using DefectDojo Pro’s Priority and Risk feature, users can automatically sort Findings into a meaningful context, ensuring -high-impact vulnerabilities can be addressed first. - -**Priority** is a calculated numerical rank applied to all Findings in your DefectDojo -instance. It allows you to quickly understand vulnerabilities in context, especially within -large organizations that are overseeing security needs for many Findings and/or -Products. - -**Risk** is a 4-level ranking system which factors in a Finding’s exploitability to a greater -degree. This is meant as a less granular, more ’executive-level’ version of Priority. - -![image](images/pro_risk_example.png) - -Priority and Risk values can be used with other filters to compare Findings in any context, such as: - -* within a single Product, Engagement or Test -* globally in all DefectDojo Products -* between a few specific Products - -Applying Finding Priority and Risk helps your team respond to the most relevant -vulnerabilities in your organization, and also provides a framework to assist in -compliance with regulatory standards. - - -Learn more about Priority and Risk with DefectDojo Inc's May 2025 Office Hours: - - - -## How Priority & Risk are calculated -The range of Priority values is from 0 to 1150. The higher the number, the more urgency -the Finding is to triage or remediate. - -Similar to Severity, Risk is scored from Low -> Medium -> Needs Action -> Urgent. **Risk** considers Priority fields and may be different from a tool's reported Severity as a result. - -![image](images/priority-overview.png) - -## Priority Fields: Product-Level - -Each Product in DefectDojo has metadata that tracks business criticality and risk -factors. This metadata is used to help calculate Priority and Risk for any associated -Findings. - -All of these metadata fields can be set on the **Edit Product** form for a given Product. - -![image](images/priority_edit_product.png) - -* **Criticality** can be set to any value of None, Very Low, Low, Medium, High, or Very -High. Criticality is a subjective field, so when assigning this field, consider how the -Product compares to other Products in your organization. -* **User Records** is a numerical estimation of user records in a database (or a system -that can access that database). -* **Revenue** is a numerical estimation of annual revenue for the Product. To calculate Priority, DefectDojo will calculate a percentage by comparing this Product's revenue to the sum of all Products within the Product Type. - -It is not possible to set a currency type in DefectDojo, so make sure that all of your Revenue -estimations have the same currency denomination. (“50000” could mean $50,000 -US Dollars or ¥50,000 Japanese Yen - the denomination does not matter as long as -all of your Products have revenue calculated in the same currency). -* **External Audience** is a true/false value - set this to True if this Product can be -accessed by an external audience. For example, customers, users, or anyone -outside of your organization. -* **Internet Accessible** is a true/false value. If this Product can connect to the open -internet, you should set this value to True. - -Priority is a ‘relative’ calculation, which is meant to compare different Products within -your DefectDojo instance. It is ultimately up to your organization to decide how these -filters are set. These values should be as accurate as possible, but the primary goal is -to highlight your key Products so that you can prioritize vulnerabilities according to your -organization’s policies, so these fields do not necessarily need to be set perfectly. - -## Priority Fields: Finding-Level - -Findings within a Product can have additional metadata which can further adjust the Finding’s Priority and Risk level: - -* Whether or not the Finding has an EPSS score, this is automatically added to Findings and kept up to date for Pro users -* How many Endpoints in the Product are affected by this Finding -* Whether or not a Finding is Under Review -* Whether the Finding is in the KEV (Known Exploited Vulnerabilities) database, which is checked by DefectDojo on a regular basis -* The tool-reported Severity of a Finding (Info, Low, Medium, High, Critical) - - -## Finding Risk Calculation - -![image](images/risk_table.png) - -The Risk column on a Findings table is another way to quickly prioritize Findings. Risk is calculated using a Finding's Priority level, but also factors in a Finding's exploitability to a greater degree. This is meant as a less granular, more 'executive-level' version of Priority. - -The four assignable Risk levels are: - -![image](images/pro_risk_levels.png) - -A Finding's EPSS / exploitability is much more emphasized in the Risk calculation. As a result, a Finding can have both a high priority and a low risk value. - -As with Finding Priority, the Risk calculation cannot currently be adjusted. - -## Priority Insights Dashboard - -Users can take an executive-level view of Priority and Risk in their environment using -the Priority Insights Dashboard (Metrics > Priority Insights in the sidebar) - -![image](images/priority_dashboard.png) - -This dashboard can be filtered to include specific Products or date ranges. As with -other Pro dashboards, this dashboard can be exported from DefectDojo as a PDF to -quickly produce a report. - -## Setting Priority & Risk for Regulatory Compliance - -This is a non-exhaustive list of regulatory standards that specifically require -vulnerability prioritization methods: - -* [SOX (Sarbanes-Oxley Act](https://www.sarbanes-oxley-act.com/)) compliance requires revenue-based prioritization for -systems impacting financial data. In DefectDojo, a system’s revenue can be entered -at the Product level. -* [PCI DSS](https://www.pcisecuritystandards.org/standards/pci-dss/) compliance requires prioritization based on risk ratings and criticality to -cardholder data environments. Business Criticality and External Audience can be -set at the Product level, while DefectDojo’s Finding-level EPSS sync supports PCI’s -risk-based approach. -* [NIST SP 800-40](https://csrc.nist.gov/pubs/sp/800/40/r4/final) is a preventative maintenance guide which specifically calls for -vulnerability prioritization based on business impact, product criticality and -internet accessibility factors. All of these can be set at DefectDojo’s Product level. -* [ISO 27001/27002](https://www.iso.org/standard/27001) Control A.12.6.1 compliance requires management of technical -vulnerabilities with Priority based on risk assessment. -* [GDPR Article 32](https://gdpr-info.eu/art-32-gdpr/) requires risk-based security measures - user records and external -audience flags at the Product level can help prioritize systems in your organization -that process personal data. -* [FISMA/FedRAMP](https://help.fedramp.gov/hc/en-us) compliance require continuous monitoring and risk-based vulnerability remediation. \ No newline at end of file diff --git a/docs/content/en/working_with_findings/priority_adjustments.md b/docs/content/en/working_with_findings/priority_adjustments.md deleted file mode 100644 index 2ea030b61c2..00000000000 --- a/docs/content/en/working_with_findings/priority_adjustments.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: "Adjusting Priority and Risk (Pro)" -description: "Change weighting of Priority and Risk calculations" -weight: 2 ---- - -DefectDojo Pro's Priority and Risk calculations can be adjusted, allowing you to tailor DefectDojo Pro to match your internal standards for Finding Priority and Risk. - -## Prioritization Engines - -Similar to SLA configurations, Prioritization Engines allow you to set the rules governing how Priority and Risk are calculated. - -![image](images/priority_default.png) - -DefectDojo comes with a built-in Prioritization Engine, which is applied to all Products. However, you can edit this Prioritization Engine to change the weighting of **Finding** and **Product** multipliers, which will adjust how Finding Priority and Risk are assigned. - -### Finding Multipliers - -Eight contextual factors impact the Priority score of a Finding. Three of these are Finding-specific, and the other five are assigned based on the Product that holds the Finding. - -You can tune your Prioritization Engine by adjusting how these factors are applied to the final calculation. - -![image](images/priority_sliders.png) - -Select a factor by clicking the button, and adjust this slider allows you to control the percentage a particular factor is applied. As you adjust the slider, you'll see the Risk thresholds change as a result. - -#### Finding-Level Multipliers - -* **Severity** - a Finding's Severity level -* **Exploitability** - a Finding's KEV and/or EPSS score -* **Endpoints** - the amount of Endpoints associated with a Finding - -#### Product-Level Multipliers - -* **Business Criticality** - the related Product's Business Criticality (None, Very Low, Low, Medium, High, or Very -High) -* **User Records** - the related Product's User Records count -* **Revenue** - the related Product's revenue, relative to the total revenue of the Product Type -* **External Audience** - whether or not the related Product has an external audience -* **Internet Accessible** - whether or not the related Product is internet accessible - -### Risk Thresholds - -Based on the tuning of the Priority Engine, DefectDojo will automatically recommend Risk Thresholds. However, these thresholds can be adjusted as well and set to whatever values you deem appropriate. - -![image](images/risk_threshold.png) - -## Creating New Prioritization Engines - -You can use multiple Prioritization Engines, which can each be assigned to different Products. - -![image](images/priority_engine_new.png) - -Creating a new Prioritization Engine will open the Prioritization Engine form. Once this form is submitted, a new Prioritization Engine will be added to the table. - -## Assigning Prioritization Engines to Products - -Each Product can have a Prioritization Engine currently in use via the **Edit Product** form for a given Product. - -![image](images/priority_chooseengine.png) - -Note that when a Product's Prioritization Engine is changed, or a Prioritization Engine is updated, the Product's Prioritization Engine or the Prioritization Engine itself will be "Locked" until the prioritization calculation has completed. \ No newline at end of file diff --git a/docs/content/en/_index.md b/docs/content/get_started/_index.md similarity index 93% rename from docs/content/en/_index.md rename to docs/content/get_started/_index.md index e288c34b9a2..d2f4ac74f16 100644 --- a/docs/content/en/_index.md +++ b/docs/content/get_started/_index.md @@ -1,5 +1,5 @@ --- -title: "Index" +title: "Get Started" date: 2021-02-02T20:46:29+01:00 draft: false type: docs diff --git a/docs/content/en/about_defectdojo/new_user_checklist.md b/docs/content/get_started/about/OS__new_user_checklist.md similarity index 60% rename from docs/content/en/about_defectdojo/new_user_checklist.md rename to docs/content/get_started/about/OS__new_user_checklist.md index d2e93499da9..1634b2c69b4 100644 --- a/docs/content/en/about_defectdojo/new_user_checklist.md +++ b/docs/content/get_started/about/OS__new_user_checklist.md @@ -3,20 +3,12 @@ title: "☑️ New User Checklist" description: "Get Started With DefectDojo" draft: "false" weight: 3 -chapter: true +audience: opensource --- -Here's a quick reference you can use to ensure successful implementation, from a blank canvas to a fully functional app. +Here's a quick reference you can use to ensure successful implementation, from a blank canvas to a fully functional app. This article assumes you have **DefectDojo Community Edition** installed and running in your environment. -The essence of DefectDojo is to import security data, organize it, and present it to the folks who need to know. Here are ways to achieve those things in DefectDojo Pro and Open-Source: - -### DefectDojo Pro - -1. Start by [importing a file](/en/connecting_your_tools/import_scan_files/import_scan_ui) using the UI. This is generally the quickest way to see how your data fits into the DefectDojo model. - -2. Now that you have data in DefectDojo, learn more about how to organize it with the [Product Hierarchy Overview](/en/working_with_findings/organizing_engagements_tests/product_hierarchy). The Product Hierarchy creates a working inventory of your apps, which helps you divide your data into logical categories, apply access control rules, sort Findings by [Priority and Risk](/en/working_with_findings/finding_priority/) or to segment your reports to the correct team. - -3. Check out your [Metrics pages](/en/customize_dojo/dashboards/pro_dashboards/) which can be used to quickly share Finding reports with key stakeholders. +The essence of DefectDojo is to import security data, organize it, and present it to the folks who need to know. Here are ways to achieve those things in DefectDojo Open-Source: ### DefectDojo Open-Source @@ -30,13 +22,6 @@ This is the essence of DefectDojo - import security data, organize it, and prese All of these features can be automated, and because DefectDojo can handle over 200 tools (at time of writing) you should be all set to create a functional security inventory of your entire organizational output. -## Other guides - -### Pro Features -- If your organization uses ServiceNow, AzureDevops, GitHub or GitLab for issue tracking, check out our [documentation](/en/share_your_findings/integrations/) on those integrations. -- Customize your [main Dashboard](/en/customize_dojo/dashboards/introduction_dashboard/) with filtered tiles to view your environment at a glance. -- Learn how to rapidly import data and mirror your team's existing security environment with [Connectors](/en/connecting_your_tools/connectors/about_connectors/). - ### Open-Source Features - Does your organization use Jira? Learn how to use our [Jira integration](/en/share_your_findings/jira_guide/) to create Jira tickets from the data you ingest. - Are you expecting to share DefectDojo with many users in your organization? Check out our guides to [user management](/en/customize_dojo/user_management/about_perms_and_roles/) and set up role-based access control (RBAC). diff --git a/docs/content/get_started/about/PRO__new_user_checklist.md b/docs/content/get_started/about/PRO__new_user_checklist.md new file mode 100644 index 00000000000..1573ffe1738 --- /dev/null +++ b/docs/content/get_started/about/PRO__new_user_checklist.md @@ -0,0 +1,26 @@ +--- +title: "☑️ New User Checklist" +description: "Get Started With DefectDojo" +draft: "false" +weight: 3 +audience: pro +--- + +The essence of DefectDojo is to import security data, organize it, and present it to the folks who need to know. Here's a quick reference you can use to ensure successful implementation, from a blank canvas to a fully functional app. + +### Discover DefectDojo + +1. Start by [importing a file](/en/connecting_your_tools/import_scan_files/import_scan_ui) using the UI. This is generally the quickest way to see how your data fits into the DefectDojo model. + +2. Now that you have data in DefectDojo, learn more about how to organize it with the [Product Hierarchy Overview](/en/working_with_findings/organizing_engagements_tests/product_hierarchy). The Product Hierarchy creates a working inventory of your apps, which helps you divide your data into logical categories, apply access control rules, sort Findings by [Priority and Risk](/en/working_with_findings/finding_priority/) or to segment your reports to the correct team. + +3. Check out your [Metrics pages](/en/customize_dojo/dashboards/pro_dashboards/) which can be used to quickly share Finding reports with key stakeholders. + +This is the essence of DefectDojo - import security data, organize it, and present it to the folks who need to know. + +All of these features can be automated, and because DefectDojo can handle over 200 tools (at time of writing) you should be all set to create a functional security inventory of your entire organizational output. + +### Pro Features +- If your organization uses Jira, ServiceNow, AzureDevops, GitHub or GitLab for issue tracking, check out our [documentation](/en/share_your_findings/integrations/) on those integrations. +- Customize your [main Dashboard](/en/customize_dojo/dashboards/introduction_dashboard/) with filtered tiles to view your environment at a glance. +- Learn how to rapidly import data and mirror your team's existing security environment with [Connectors](/en/connecting_your_tools/connectors/about_connectors/). diff --git a/docs/content/get_started/about/_index.md b/docs/content/get_started/about/_index.md new file mode 100644 index 00000000000..c6e4d60e318 --- /dev/null +++ b/docs/content/get_started/about/_index.md @@ -0,0 +1,5 @@ +--- +title: "About DefectDojo" +date: 2021-02-02T20:46:29+01:00 +weight: 1 +--- diff --git a/docs/content/en/about_defectdojo/about_docs.md b/docs/content/get_started/about/about_defectdojo.md similarity index 99% rename from docs/content/en/about_defectdojo/about_docs.md rename to docs/content/get_started/about/about_defectdojo.md index ddc1baf94d2..22f050c0ec9 100644 --- a/docs/content/en/about_defectdojo/about_docs.md +++ b/docs/content/get_started/about/about_defectdojo.md @@ -1,5 +1,5 @@ --- -title: "About Our Documentation" +title: "About DefectDojo" date: 2021-02-02T20:46:29+01:00 draft: false type: docs diff --git a/docs/content/get_started/about/defectdojo_versions.md b/docs/content/get_started/about/defectdojo_versions.md new file mode 100644 index 00000000000..550dfa1eba0 --- /dev/null +++ b/docs/content/get_started/about/defectdojo_versions.md @@ -0,0 +1,30 @@ +--- +title: "Feature comparison" +date: 2021-02-02T20:46:29+01:00 +draft: false +type: docs +weight: 1 +--- + +**DefectDojo Open-Source** is a powerful, free vulnerability management platform with core importing, deduplication, basic dashboards, API access, and essential reporting — ideal for smaller teams or those wanting to self-host and extend the tool using community resources. + +**DefectDojo Pro** builds on that foundation with enterprise-oriented features such as advanced dashboards and reporting, automation and scripting via rules engine, connectors to many security tools, optimized import workflows, unified SOC & AppSec support, improved UI/UX, AI integration, enhanced security (SSO/MFA), and premium support options. + +| Feature / Capability | DefectDojo Open-Source | DefectDojo Pro | +|---------------------|------------------------|----------------| +| Core vulnerability management | ✔️ Import, track, and manage findings from 200+ security tools | ✔️ Everything in open-source, optimized for scale | +| Finding deduplication | ✔️ Standard deduplication | ✔️ Advanced, configurable deduplication | +| REST API | ✔️ Full REST API | ✔️ Full REST API | +| Authentication & access control | ✔️ Local auth and basic RBAC | ✔️ SSO (SAML/OAuth), MFA, advanced RBAC | +| User interface | ✔️ Community UI | ✔️ Modern Pro UI with performance improvements | +| Dashboards & reporting | ✔️ Basic dashboards and reports | ✔️ Advanced, customizable dashboards and executive reporting | +| Automation & workflows | ❌ Not included | ✔️ Rules Engine and automated workflows | +| Import enhancements | ❌ Standard imports only | ✔️ Background imports, Smart Upload, Universal Parser, CLI uploads | +| Tool integrations | ❌ Manual/API-driven | ✔️ Built-in **API Connectors** for popular AppSec and cloud tools | +| Jira integration | ✔️ Included | ✔️ Included | +| Project management integrations | ❌ Not included | ✔️ integrate with **Azure Devops**, **GitHub**, **GitLab** and **ServiceNow** | +| Finding enhancements | ❌ Not included | ✔️ Automatic KEV, EPSS scoring and Ransomware tracking | +| SOC & AppSec unification | ❌ AppSec-focused only | ✔️ Unified AppSec and SOC findings | +| AI & next-generation features | ❌ Not included | ✔️ AI-assisted workflows, reporting and MCP support | +| Support | Community support (GitHub, Slack, forums) | Commercial support with SLAs | +| Hosting options | Self-hosted | Self-hosted or cloud-hosted | \ No newline at end of file diff --git a/docs/content/get_started/about/demo.md b/docs/content/get_started/about/demo.md new file mode 100644 index 00000000000..4f945ff5905 --- /dev/null +++ b/docs/content/get_started/about/demo.md @@ -0,0 +1,20 @@ +--- +title: "Online Demo" +description: "There is DefectDojo demo site running the latest officially released version" +draft: false +weight: 6 +--- + +Two online demos are available for DefectDojo. Both come pre-loaded with data and are fully functional, running the latest version of DefectDojo. + +Demo servers are reset on a daily basis, and are publicly accessible; do not put sensitive data in the demo. + +### 🔸 DefectDojo Pro Demo +DefectDojo Pro can be tested at [pro.demo.defectdojo.org](https://pro.demo.defectdojo.org) + +Log in with `admin / 1Defectdojo@demo#appsec`. + +### 🔹 DefectDojo Community Edition Demo +Our community edition can be tested at [demo.defectdojo.org](https://demo.defectdojo.org) + +Log in with `admin / 1Defectdojo@demo#appsec`. diff --git a/docs/content/en/about_defectdojo/faq.md b/docs/content/get_started/about/faq.md similarity index 100% rename from docs/content/en/about_defectdojo/faq.md rename to docs/content/get_started/about/faq.md diff --git a/docs/content/get_started/common_use_cases/_index.md b/docs/content/get_started/common_use_cases/_index.md new file mode 100644 index 00000000000..d5fc6b6ba1e --- /dev/null +++ b/docs/content/get_started/common_use_cases/_index.md @@ -0,0 +1,5 @@ +--- +title: "Common Use Cases" +date: 2021-02-02T20:46:29+01:00 +weight: 8 +--- diff --git a/docs/content/en/about_defectdojo/examples_of_use.md b/docs/content/get_started/common_use_cases/common_use_cases.md similarity index 99% rename from docs/content/en/about_defectdojo/examples_of_use.md rename to docs/content/get_started/common_use_cases/common_use_cases.md index 450d28304b7..09f522af353 100644 --- a/docs/content/en/about_defectdojo/examples_of_use.md +++ b/docs/content/get_started/common_use_cases/common_use_cases.md @@ -1,5 +1,5 @@ --- -title: "💡 Common Use Cases" +title: "Common Use Cases" description: "Use Cases and examples" draft: "false" weight: 2 @@ -15,7 +15,6 @@ DefectDojo is designed to handle any security implementation, no matter your sec ### Large Enterprise: RBAC and Engagements - ‘BigCorp’ is a large multinational enterprise, with a Chief Information Security Officer (CISO) and a centralized IT security group that includes AppSec. Security at BigCorp is highly centralized. Certain things are delegated out to Business Information Security Officers (BISO). diff --git a/docs/content/get_started/open_source/_index.md b/docs/content/get_started/open_source/_index.md new file mode 100644 index 00000000000..c2a35d75419 --- /dev/null +++ b/docs/content/get_started/open_source/_index.md @@ -0,0 +1,6 @@ +--- +title: "🔹 DefectDojo Community Edition" +date: 2021-02-02T20:46:29+01:00 +weight: 3 +audience: opensource +--- diff --git a/docs/content/en/open_source/installation/architecture.md b/docs/content/get_started/open_source/architecture.md similarity index 96% rename from docs/content/en/open_source/installation/architecture.md rename to docs/content/get_started/open_source/architecture.md index d3085609844..e34e29d089c 100644 --- a/docs/content/en/open_source/installation/architecture.md +++ b/docs/content/get_started/open_source/architecture.md @@ -1,8 +1,9 @@ --- -title: "Architecture (Open-Source)" +title: "System Architecture" description: "The DefectDojo platform consists of several components that work together closely." draft: false weight: 1 +audience: opensource --- ![image](images/dd-architecture.png) diff --git a/docs/content/en/open_source/installation/configuration.md b/docs/content/get_started/open_source/configuration.md similarity index 98% rename from docs/content/en/open_source/installation/configuration.md rename to docs/content/get_started/open_source/configuration.md index a06d3fe02be..e97709392e4 100644 --- a/docs/content/en/open_source/installation/configuration.md +++ b/docs/content/get_started/open_source/configuration.md @@ -1,8 +1,9 @@ --- -title: "Configuration (Open Source)" +title: "Configuration" description: "DefectDojo is highly configurable." draft: false -weight: 3 +weight: 2 +audience: opensource --- ## dojo/settings/settings.dist.py diff --git a/docs/content/en/open_source/installation/installation.md b/docs/content/get_started/open_source/installation.md similarity index 93% rename from docs/content/en/open_source/installation/installation.md rename to docs/content/get_started/open_source/installation.md index 76345a3801d..105ac4f119a 100644 --- a/docs/content/en/open_source/installation/installation.md +++ b/docs/content/get_started/open_source/installation.md @@ -1,8 +1,9 @@ --- -title: "Installation (Open-Source)" +title: "Installation" description: "DefectDojo supports various installation options." draft: false -weight: 2 +weight: 1 +audience: opensource --- ## **Recommended Options** diff --git a/docs/content/en/open_source/installation/running-in-production.md b/docs/content/get_started/open_source/running-in-production.md similarity index 98% rename from docs/content/en/open_source/installation/running-in-production.md rename to docs/content/get_started/open_source/running-in-production.md index 30404e74046..ef96670d11b 100644 --- a/docs/content/en/open_source/installation/running-in-production.md +++ b/docs/content/get_started/open_source/running-in-production.md @@ -1,8 +1,9 @@ --- -title: "Running in Production (Open Source)" +title: "Running in Production" description: "For use in Production environments, performance tweaks and backups are recommended." draft: false weight: 4 +audience: opensource --- ## Production Use (with Docker compose) diff --git a/docs/content/get_started/pro/cloud/_index.md b/docs/content/get_started/pro/cloud/_index.md new file mode 100644 index 00000000000..8cc4620d4a0 --- /dev/null +++ b/docs/content/get_started/pro/cloud/_index.md @@ -0,0 +1,7 @@ +--- +title: "🔸 DefectDojo Pro (Cloud)" +date: 2021-02-02T20:46:29+01:00 +weight: 3 +collapsed: true +audience: pro +--- diff --git a/docs/content/en/cloud_management/additional-cloud-instance.md b/docs/content/get_started/pro/cloud/additional-cloud-instance.md similarity index 99% rename from docs/content/en/cloud_management/additional-cloud-instance.md rename to docs/content/get_started/pro/cloud/additional-cloud-instance.md index df9d5785564..806fc9cb9b2 100644 --- a/docs/content/en/cloud_management/additional-cloud-instance.md +++ b/docs/content/get_started/pro/cloud/additional-cloud-instance.md @@ -1,7 +1,8 @@ --- title: "Set up an additional Cloud instance" description: "Add a test, dev, or other DefectDojo instance to your account" -weight: 2 +weight: 3 +audience: pro --- The process for adding a second Cloud instance is more or less the same as adding your first instance. This guide assumes you've already set up your initial DefectDojo server, and have an agreement with our Sales team to add another instance. diff --git a/docs/content/en/cloud_management/connectivity-troubleshooting.md b/docs/content/get_started/pro/cloud/connectivity-troubleshooting.md similarity index 99% rename from docs/content/en/cloud_management/connectivity-troubleshooting.md rename to docs/content/get_started/pro/cloud/connectivity-troubleshooting.md index 03d423785e4..ed38ce94939 100644 --- a/docs/content/en/cloud_management/connectivity-troubleshooting.md +++ b/docs/content/get_started/pro/cloud/connectivity-troubleshooting.md @@ -2,6 +2,7 @@ title: "Connectivity Troubleshooting" description: "Reconnect to your DefectDojo Instance" weight: 2 +audience: pro --- If you have difficulty accessing your DefectDojo instance, here are some steps you can follow to get reconnected: diff --git a/docs/content/en/cloud_management/using-cloud-manager.md b/docs/content/get_started/pro/cloud/using-cloud-manager.md similarity index 99% rename from docs/content/en/cloud_management/using-cloud-manager.md rename to docs/content/get_started/pro/cloud/using-cloud-manager.md index 575505bba50..f8451a2c240 100644 --- a/docs/content/en/cloud_management/using-cloud-manager.md +++ b/docs/content/get_started/pro/cloud/using-cloud-manager.md @@ -2,6 +2,8 @@ title: "Using the Cloud Manager" description: "Manage your subscription and account settings" weight: 1 +collapsed: true +audience: pro --- Logging into DefectDojo's Cloud Manager allows you to configure your account settings and manage your subscription with DefectDojo Cloud. diff --git a/docs/content/get_started/pro/onprem/_index.md b/docs/content/get_started/pro/onprem/_index.md new file mode 100644 index 00000000000..bd18768e7f3 --- /dev/null +++ b/docs/content/get_started/pro/onprem/_index.md @@ -0,0 +1,6 @@ +--- +title: "🔸 DefectDojo Pro (On-Premise)" +date: 2021-02-02T20:46:29+01:00 +weight: 3 +audience: pro +--- \ No newline at end of file diff --git a/docs/content/get_started/pro/onprem/installation_options.md b/docs/content/get_started/pro/onprem/installation_options.md new file mode 100644 index 00000000000..cc4ae95cde1 --- /dev/null +++ b/docs/content/get_started/pro/onprem/installation_options.md @@ -0,0 +1,10 @@ +--- +title: "Self-Hosting DefectDojo Pro" +date: 2021-02-02T20:46:29+01:00 +weight: 4 +audience: pro +--- + +DefectDojo Pro can be fully self-hosted in your own environment, giving you complete control over your infrastructure, data, and security posture. This deployment option is ideal for organizations with strict compliance, data residency, or internal security requirements, while still delivering all the advanced capabilities of DefectDojo Pro. + +For more information about self-hosting DefectDojo Pro, contact us at [hello@defectdojo.com](mailto:hello@defectdojo.com). diff --git a/docs/content/en/about_defectdojo/pro_features.md b/docs/content/get_started/pro/pro_features.md similarity index 99% rename from docs/content/en/about_defectdojo/pro_features.md rename to docs/content/get_started/pro/pro_features.md index 46eaccb9f0d..e354047112f 100644 --- a/docs/content/en/about_defectdojo/pro_features.md +++ b/docs/content/get_started/pro/pro_features.md @@ -5,6 +5,7 @@ draft: "false" weight: 4 chapter: true exclude_search: true +audience: pro --- Here is a list of DefectDojo Pro’s many additional features, along with links to documentation to see them in action: diff --git a/docs/content/en/about_defectdojo/ui_pro_vs_os.md b/docs/content/get_started/pro/ui_pro_vs_os.md similarity index 99% rename from docs/content/en/about_defectdojo/ui_pro_vs_os.md rename to docs/content/get_started/pro/ui_pro_vs_os.md index 99378ee987b..c3814b7cfb7 100644 --- a/docs/content/en/about_defectdojo/ui_pro_vs_os.md +++ b/docs/content/get_started/pro/ui_pro_vs_os.md @@ -4,6 +4,7 @@ description: "Working with different UIs in DefectDojo" draft: "false" weight: 5 pro-feature: true +audience: pro --- In late 2023, DefectDojo Inc. released a new UI for DefectDojo Pro, which is now the default UI for this edition. diff --git a/docs/content/en/about_defectdojo/request_a_trial.md b/docs/content/help/contact_sales.md similarity index 99% rename from docs/content/en/about_defectdojo/request_a_trial.md rename to docs/content/help/contact_sales.md index 18cc2094a93..310b262528e 100644 --- a/docs/content/en/about_defectdojo/request_a_trial.md +++ b/docs/content/help/contact_sales.md @@ -1,5 +1,5 @@ --- -title: "Request a DefectDojo Pro Trial" +title: "Contact Sales" description: "How to request and work with a trial of DefectDojo Cloud" draft: "false" weight: 6 diff --git a/docs/content/en/about_defectdojo/contact_defectdojo_support.md b/docs/content/help/contact_support.md similarity index 98% rename from docs/content/en/about_defectdojo/contact_defectdojo_support.md rename to docs/content/help/contact_support.md index 521c2c47c4a..02d8d8c8d9d 100644 --- a/docs/content/en/about_defectdojo/contact_defectdojo_support.md +++ b/docs/content/help/contact_support.md @@ -1,5 +1,5 @@ --- -title: "Get Support" +title: "Contact Support" description: "For Pro users: support@defectdojo.com + other options" draft: "false" pro-feature: true diff --git a/docs/content/help/glossary.md b/docs/content/help/glossary.md new file mode 100644 index 00000000000..45198c57f43 --- /dev/null +++ b/docs/content/help/glossary.md @@ -0,0 +1,75 @@ +--- +title: "Glossary" +weight: 1 +--- + +Below is a simple glossary to help understand DefectDojo's various capabilities, along with an indication of whether each defined feature is present/applicable in the Pro version of DefectDojo, the OS version, or both. + +## Product Hierarchy (Both) +The structural model used to organize security data within DefectDojo, consisting of Organizations → Assets → Engagements → Tests → Findings. +## Organization (Both) +A top-level hierarchical object that serves as the parent object of Assets in DefectDojo Pro. It provides a shared context for governance, access control, and reporting across all child Assets. +## Asset (Both) +A first-class object representing a deployable or logical system entity (e.g., application, host, environment) within Organizations. Assets support parent-child relationships and richer business metadata in the Pro version, but do not support parent-child relationships in the OS version. +### Asset Hierarchy (Pro) +A parent-child relationship model between Assets that enables inheritance of context and aggregation of Findings. +## Engagement (Both) +A scoped security activity representing a testing window, pipeline, or assessment context. +## Test (Both) +A single execution of a scanner or manual assessment within an Engagement. Tests store execution metadata and act as the ingestion point for Findings. +## Service (Both) +An optional sub-object used to attribute Findings to a specific component or interface within an Asset. Services are most useful in OS DefectDojo, as their functionality is replicated and enhanced by Asset Hierarchy in the Pro version. +## Finding (Both) +The most granular vulnerability object in DefectDojo's Product Hierarchy that represents a discrete security issue. +### Finding Status (Both) +The current lifecycle state of a Finding (e.g., Active, Verified, Inactive/Mitigated, Under Review, Risk Accepted, False Positive, Out Of Scope). Finding Status determines inclusion in metrics and dashboards. +### Finding Priority/Risk (Pro) +A calculated or derived value that represents remediation urgency by combining severity with contextual factors such as asset criticality or exploitability. Priority is distinct from raw severity and is used for risk-based decision-making. +### Finding Groups (Both) +A mechanism for grouping related Findings across Organizations, Assets, or tools. Finding Groups enable consolidated analysis and higher-level reporting. +## Endpoint (Both) +A network-reachable location (URL, IP, port) associated with a Finding. Endpoints provide technical exploit context. +## Import (Both) +The process of ingesting scan results or manual findings into DefectDojo, typically by uploading a file or submitting data via the API. During import, DefectDojo parses, normalizes, deduplicates, and associates findings with the appropriate Asset, Engagement, Test, and related objects. +## Reimport (Both) +The action of ingesting new scan results into an existing Test. Reimporting updates Finding states based on presence or absence in new data. +## Deduplication (Both) +The process of correlating incoming Findings with existing ones using hashes and matching logic, enabling historical tracking across scan executions. +## False Positive (Both) +A Finding state indicating the issue is invalid or non-exploitable. False positives are retained for auditability but excluded from risk calculations. +## Risk Acceptance (Both) +A workflow state indicating an acknowledged but unresolved Finding. Accepted risks remain visible but are excluded from SLA enforcement. +## Metadata (Both) +Key data attached to Tests or Findings, such as branch name or build ID, commonly supplied via CI/CD pipelines. +## CI/CD Integration (Both) +Automated ingestion of scan results during build or deployment workflows. Integrations typically rely on the API and importer framework. +## API (Both) +A RESTful interface used to programmatically manage DefectDojo objects. The API is the primary mechanism for automation and pipeline integration. +## Webhook (Pro) +An outbound HTTP callback triggered by specific events (e.g., Finding creation). Webhooks enable real-time integration with external systems. +## SLA Configuration (Pro) +Policy definitions that assign remediation deadlines based on severity or risk attributes. SLAs enable enforcement and performance measurement. +## User Role (Both) +A permission set defining allowed actions within DefectDojo. Roles enforce access control across Assets and Engagements. +## Universal Importer (Pro) +A flexible ingestion mechanism that allows scan data to be imported without a tool-specific importer. It relies on normalized field mapping rather than predefined scanner schemas. +## DefectDojo-CLI (Pro) +A command-line interface used to interact with DefectDojo programmatically. The CLI is commonly used in CI/CD pipelines to automate scan uploads and object management. +## API Connectors (Pro) +Prebuilt, managed integrations that connect DefectDojo with external platforms (e.g., ticketing, messaging, or DevOps tools). API Connectors reduce the need for custom scripting. +## Universal Parser (Pro) +A generalized parsing engine used by the Universal Importer to interpret incoming scan data. It applies consistent normalization and deduplication logic across unsupported formats. +## Smart Upload (Pro) +An intelligent ingestion workflow that automatically determines how scan results should be mapped to Assets or Engagements, reducing manual configuration during import. +## Executive Insights (Pro) +High-level, business-oriented analytics designed for leadership audiences, focusing on trends, exposure, and program health rather than individual Findings. +## Priority Insights (Pro) +Analytical views that surface the most critical risks based on priority scoring rather than severity alone, supporting risk-based remediation planning. +## Program Insights (Pro) +Metrics and visualizations that evaluate the effectiveness and maturity of a security program over time. Program Insights emphasize trends, coverage, and operational performance. +## Tool Insights (Pro) +Analytics focused on scanner performance, coverage, and contribution to Findings, helping teams optimize tool usage and reduce noise. +## Rules Engine (Pro) +A policy-driven automation system that applies conditional logic to Findings during ingestion or lifecycle events, automating severity changes, assignments, or workflows. +## Integrations (Both) +Connections between DefectDojo and external tools or platforms for data ingestion, notification, or workflow automation. Pro includes deeper, managed integrations beyond basic importers and API usage. diff --git a/docs/content/en/connecting_your_tools/_index.md b/docs/content/import_data/_index.md similarity index 100% rename from docs/content/en/connecting_your_tools/_index.md rename to docs/content/import_data/_index.md diff --git a/docs/content/en/cloud_management/_index.md b/docs/content/import_data/import_intro/_index.md similarity index 73% rename from docs/content/en/cloud_management/_index.md rename to docs/content/import_data/import_intro/_index.md index 6c620388cfc..1e3dadb4c45 100644 --- a/docs/content/en/cloud_management/_index.md +++ b/docs/content/import_data/import_intro/_index.md @@ -1,11 +1,11 @@ --- -title: "☁️ DefectDojo Cloud" -description: "Manage Your DefectDojo subscription" +title: "Introduction" +description: "Use DefectDojo's Import / Reimport to ingest data and build a pipeline" summary: "" date: 2023-09-07T16:06:50+02:00 lastmod: 2023-09-07T16:06:50+02:00 draft: false -weight: 6 +weight: 1 chapter: true seo: title: "" # custom title (optional) diff --git a/docs/content/en/connecting_your_tools/import_intro.md b/docs/content/import_data/import_intro/comparison.md similarity index 100% rename from docs/content/en/connecting_your_tools/import_intro.md rename to docs/content/import_data/import_intro/comparison.md diff --git a/docs/content/en/connecting_your_tools/import_scan_files/using_reimport.md b/docs/content/import_data/import_intro/import_vs_reimport.md similarity index 97% rename from docs/content/en/connecting_your_tools/import_scan_files/using_reimport.md rename to docs/content/import_data/import_intro/import_vs_reimport.md index c702099f7bc..5cabfe56775 100644 --- a/docs/content/en/connecting_your_tools/import_scan_files/using_reimport.md +++ b/docs/content/import_data/import_intro/import_vs_reimport.md @@ -1,6 +1,6 @@ --- -title: "Add new Findings to a Test via Reimport" -description: "" +title: "Import vs Reimport" +description: "Learn how to import data manually, through the API, or via a connector" weight: 2 --- diff --git a/docs/content/import_data/import_scan_files/OS__create_findings_manually.md b/docs/content/import_data/import_scan_files/OS__create_findings_manually.md new file mode 100644 index 00000000000..e69de29bb2d diff --git a/docs/content/import_data/import_scan_files/OS__import_scan_ui.md b/docs/content/import_data/import_scan_files/OS__import_scan_ui.md new file mode 100644 index 00000000000..b3f07b6d5ab --- /dev/null +++ b/docs/content/import_data/import_scan_files/OS__import_scan_ui.md @@ -0,0 +1,71 @@ +--- +title: "Import Scan form" +description: "" +weight: 1 +audience: opensource +--- + +Once you have your Product Hierarchy set up with at least one Product Type, Product, Test and Engagement, you can import a scan file to DefectDojo and create Findings. + +It’s easy to reorganize your Product Hierarchy in DefectDojo, so it’s ok if you’re not sure how to set things up yet. + +For now, it’s good to know that **Engagements** can store data from multiple tools, which can be useful if you’re running different tools concurrently as part of a single testing effort. + +## Accessing the Import Scan Form (Classic UI / Open Source) + +In DefectDojo OS, you can access this form from two locations: + +* The Tests section of an Engagement: + ![image](images/import_scan_os.png) +* The Findings section of the navigation bar on a Product: + ![image](images/import_scan_os_2.png) + +## Completing the Import Scan Form + +![image](images/import_scan_ui.png) +The Import Scan form will create a new Test nested under an Engagement, which will contain a unique Finding for each vulnerability contained within your scan file. + +The Test will be created with a name that matches the Scan Type: e.g. a Tenable scan will be titled ‘Tenable Scan’. + +### Form Options + +* **Scan File:** by clicking on the Choose button, you can select a file from your computer to upload. +* **Scan Date (optional):** if you want to select a single Scan Date to be applied to all Findings that result from this import, you can select the date in this field. +If you do not select a Scan Date, Findings created from this report will use the date specified by the tool. SLAs for each Finding will be calculated based on their date. +* **Scan Type:** select the tool used to create this data. +* **Environment:** select an Environment that corresponds to the data you’re uploading. +* **Tags:** if you want to use tags to further organize your Test data, you can add Tags using this form. Type in the name of the tag you want to create, and press Enter on your keyboard to add it to the list of tags. + +### Optional Fields + +* **Minimum Severity**: If you only want to create Findings for a particular Severity level and above, you can select the minimum Severity level here. All vulnerabilities with lower severity than this field will be ignored. +* **Active**: if you want to set all of the incoming Findings to either Active or Inactive, you can specify that here. Otherwise, DefectDojo will use the tool’s vulnerability data to determine whether the Finding is Active or Inactive. This option is relevant if you need your team to manually triage and verify Findings from a particular tool. +* **Verified**: as with Active you can set the new set of Findings to either Verified or Unverified by default. This depends on your workflow preferences. For example, if your team prefers to assume Findings are verified unless proven otherwise, you can set this field to True. +* **Version, Branch Tag, Commit Hash, Build ID, Service** can all be specified if you want to include these details in the Test. +* **Source Code Management URI** can also be specified. This form option must be a valid URI. +* **Group By:** if you want to create Finding Groups out of this File, you can specify the grouping method here. + +### Triage-less scanners: Do Not Reactivate field + +Some scanners might not include triage information in their reports (e.g. tfsec). They simply scan code or dependencies, flag issues, and return everything, regardless of whether a vulnerability has already been triaged or not. + +To handle this case, DefectDojo also includes a "Do not reactivate" checkbox in uploading reports (also in the reimport API), so you can use DefectDojo as the source of truth for triage, instead of reactivating your triaged Findings on each import / reimport. + +### Using the Scan Completion Date (API: `scan_date`) field + +DefectDojo offers a plethora of supported scanner reports, but not all of them contain the +information most important to a user. The `scan_date` field is a flexible smart feature that +allows users to set the completion date of the a given scan report, and have it propagate +down to all the findings imported. This field is **not** mandatory, but the default value for +this field is the date of import (whenever the request is processed and a successful response is returned). + +Here are the following use cases for using this field: + +1. The report **does not** set the date, and `scan_date` is **not** set at import + - Finding date will be the default value of `scan_date` +2. The report **sets** the date, and the `scan_date` is **not** set at import + - Finding date will be whatever the report sets +3. The report **does not** set the date, and the `scan_date` is **set** at import + - Finding date will be whatever the user set for `scan_date` +4. The report **sets** the date, and the `scan_date` is **set** at import + - Finding date will be whatever the user set for `scan_date` diff --git a/docs/content/import_data/import_scan_files/PRO__create_findings_manually.md b/docs/content/import_data/import_scan_files/PRO__create_findings_manually.md new file mode 100644 index 00000000000..e69de29bb2d diff --git a/docs/content/en/connecting_your_tools/import_scan_files/import_scan_ui.md b/docs/content/import_data/import_scan_files/PRO__import_scan_ui.md similarity index 93% rename from docs/content/en/connecting_your_tools/import_scan_files/import_scan_ui.md rename to docs/content/import_data/import_scan_files/PRO__import_scan_ui.md index dac6195a6d3..741f850c6fa 100644 --- a/docs/content/en/connecting_your_tools/import_scan_files/import_scan_ui.md +++ b/docs/content/import_data/import_scan_files/PRO__import_scan_ui.md @@ -1,7 +1,8 @@ --- -title: "Import Scan Form" +title: "Add Findings form" description: "" weight: 1 +audience: pro --- If you have a brand new DefectDojo instance, the Import Scan Form is a logical first step to learn the software and set up your environment. From this form, you upload a scan file from a supported tool, which will create Findings to represent those vulnerabilities. While filling out the form, you can decide whether to: @@ -17,22 +18,12 @@ For now, it’s good to know that **Engagements** can store data from multiple t The Import Scan form can be accessed from multiple locations: -1. Via the **Import \> Add Findings** menu option on the sidebar +1. Via the **Import > Add Findings** menu option on the sidebar 2. From a **Product’s** **‘⋮’ (horizontal dots) Menu**, from a **Products Table** 3. From the **⚙️Gear Menu** on a **Product Page** -## Accessing the Import Scan Form (Classic UI / Open Source) - -In DefectDojo OS, you can access this form from two locations: - -* The Tests section of an Engagement: - ![image](images/import_scan_os.png) -* The Findings section of the navigation bar on a Product: - ![image](images/import_scan_os_2.png) - ## Completing the Import Scan Form -![image](images/import_scan_ui.png) The Import Scan form will create a new Test nested under an Engagement, which will contain a unique Finding for each vulnerability contained within your scan file. The Test will be created with a name that matches the Scan Type: e.g. a Tenable scan will be titled ‘Tenable Scan’. @@ -48,7 +39,7 @@ If you do not select a Scan Date, Findings created from this report will use the * **Tags:** if you want to use tags to further organize your Test data, you can add Tags using this form. Type in the name of the tag you want to create, and press Enter on your keyboard to add it to the list of tags. * **Process Findings Asynchronously**: this field is enabled by default, but it can be disabled if you wish. See explanation below. -### Process Findings Asynchronously (Pro) +### Process Findings Asynchronously When this field is enabled, DefectDojo will use a background process to populate your Test file with Findings. This allows you to continue working with DefectDojo while Findings are being created from your scan file. @@ -58,6 +49,11 @@ This option is especially relevant when using the API to import data. If uploadi ### Optional Fields +To open Optional Fields, click the button labelled **"Optional Fields +"** above the **Submit** button + +![image](images/import_scan_ui.png) + +#### Optional Fields descriptions * **Minimum Severity**: If you only want to create Findings for a particular Severity level and above, you can select the minimum Severity level here. All vulnerabilities with lower severity than this field will be ignored. * **Active**: if you want to set all of the incoming Findings to either Active or Inactive, you can specify that here. Otherwise, DefectDojo will use the tool’s vulnerability data to determine whether the Finding is Active or Inactive. This option is relevant if you need your team to manually triage and verify Findings from a particular tool. * **Verified**: as with Active you can set the new set of Findings to either Verified or Unverified by default. This depends on your workflow preferences. For example, if your team prefers to assume Findings are verified unless proven otherwise, you can set this field to True. diff --git a/docs/content/en/connecting_your_tools/import_scan_files/_index.md b/docs/content/import_data/import_scan_files/_index.md similarity index 88% rename from docs/content/en/connecting_your_tools/import_scan_files/_index.md rename to docs/content/import_data/import_scan_files/_index.md index b8ddf6a0847..bff91782153 100644 --- a/docs/content/en/connecting_your_tools/import_scan_files/_index.md +++ b/docs/content/import_data/import_scan_files/_index.md @@ -1,5 +1,5 @@ --- -title: "How To Import Data" +title: "Importing Data" description: "Use DefectDojo's Import / Reimport to ingest data and build a pipeline" summary: "" date: 2023-09-07T16:06:50+02:00 @@ -7,8 +7,6 @@ lastmod: 2023-09-07T16:06:50+02:00 draft: false weight: 3 chapter: true -sidebar: - collapsed: true seo: title: "" # custom title (optional) description: "" # custom description (recommended) diff --git a/docs/content/en/connecting_your_tools/import_scan_files/api_pipeline_modelling.md b/docs/content/import_data/import_scan_files/api_pipeline_modelling.md similarity index 87% rename from docs/content/en/connecting_your_tools/import_scan_files/api_pipeline_modelling.md rename to docs/content/import_data/import_scan_files/api_pipeline_modelling.md index 750d29f0464..dd8e01ed410 100644 --- a/docs/content/en/connecting_your_tools/import_scan_files/api_pipeline_modelling.md +++ b/docs/content/import_data/import_scan_files/api_pipeline_modelling.md @@ -1,5 +1,5 @@ --- -title: "Create an automated import pipeline via API" +title: "Import from API" description: "" --- @@ -10,14 +10,6 @@ DefectDojo’s API allows for robust pipeline solutions, which automatically ing These pipelines can be created by directly calling our API **/reimport** endpoint with an attached scan file in a way that closely resembles our **Import Scan Form**. -#### Universal Importer: out of the box automation - -DefectDojo Inc. maintains a **Universal Importer** which can be set up with existing CI/CD pipelines, triggered via GitHub actions, or run in any other automated context. - -This external tool is a useful way to build a pipeline directly from the command line: a much faster solution than writing your own code. - -See our guide to [external tools](../../external_tools) to learn more. External tools are available for **DefectDojo Pro** users only. - ## DefectDojo’s API DefectDojo’s API is documented in\-app using the OpenAPI framework. You can access this documentation from the User Menu in the top right\-hand corner, under **‘API v2 OpenAPI3’**. diff --git a/docs/content/en/connecting_your_tools/connectors/_index.md b/docs/content/import_data/pro/connectors/_index.md similarity index 85% rename from docs/content/en/connecting_your_tools/connectors/_index.md rename to docs/content/import_data/pro/connectors/_index.md index 47c05dfcfaf..c77f1f3a4eb 100644 --- a/docs/content/en/connecting_your_tools/connectors/_index.md +++ b/docs/content/import_data/pro/connectors/_index.md @@ -1,5 +1,5 @@ --- -title: "Connectors (Pro)" +title: "Connectors" description: "Seamlessly connect DefectDojo to your security tools suite" summary: "" date: 2023-09-07T16:06:50+02:00 @@ -7,13 +7,11 @@ lastmod: 2023-09-07T16:06:50+02:00 draft: false weight: 4 chapter: true -sidebar: - collapsed: true seo: title: "" # custom title (optional) description: "" # custom description (recommended) canonical: "" # custom canonical URL (optional) robots: "" # custom robot tags (optional) -pro-feature: true +audience: pro exclude_search: true --- diff --git a/docs/content/en/connecting_your_tools/connectors/about_connectors.md b/docs/content/import_data/pro/connectors/about_connectors.md similarity index 100% rename from docs/content/en/connecting_your_tools/connectors/about_connectors.md rename to docs/content/import_data/pro/connectors/about_connectors.md diff --git a/docs/content/en/connecting_your_tools/connectors/add_edit_connectors.md b/docs/content/import_data/pro/connectors/add_edit_connectors.md similarity index 100% rename from docs/content/en/connecting_your_tools/connectors/add_edit_connectors.md rename to docs/content/import_data/pro/connectors/add_edit_connectors.md diff --git a/docs/content/en/connecting_your_tools/connectors/connectors_tool_reference.md b/docs/content/import_data/pro/connectors/connectors_tool_reference.md similarity index 100% rename from docs/content/en/connecting_your_tools/connectors/connectors_tool_reference.md rename to docs/content/import_data/pro/connectors/connectors_tool_reference.md diff --git a/docs/content/en/connecting_your_tools/connectors/manage_operations.md b/docs/content/import_data/pro/connectors/manage_operations.md similarity index 100% rename from docs/content/en/connecting_your_tools/connectors/manage_operations.md rename to docs/content/import_data/pro/connectors/manage_operations.md diff --git a/docs/content/en/connecting_your_tools/connectors/manage_records.md b/docs/content/import_data/pro/connectors/manage_records.md similarity index 100% rename from docs/content/en/connecting_your_tools/connectors/manage_records.md rename to docs/content/import_data/pro/connectors/manage_records.md diff --git a/docs/content/en/share_your_findings/_index.md b/docs/content/import_data/pro/specialized_import/_index.md similarity index 73% rename from docs/content/en/share_your_findings/_index.md rename to docs/content/import_data/pro/specialized_import/_index.md index 5443a7dd0b7..8813d06eaf2 100644 --- a/docs/content/en/share_your_findings/_index.md +++ b/docs/content/import_data/pro/specialized_import/_index.md @@ -1,6 +1,6 @@ --- -title: "📤 Share Your Findings" -description: "Create Reports or Push To Jira" +title: "Specialized Import" +description: "Seamlessly connect DefectDojo to your security tools suite" summary: "" date: 2023-09-07T16:06:50+02:00 lastmod: 2023-09-07T16:06:50+02:00 @@ -12,5 +12,6 @@ seo: description: "" # custom description (recommended) canonical: "" # custom canonical URL (optional) robots: "" # custom robot tags (optional) +audience: pro exclude_search: true ---- \ No newline at end of file +--- diff --git a/docs/content/en/connecting_your_tools/external_tools.md b/docs/content/import_data/pro/specialized_import/external_tools.md similarity index 99% rename from docs/content/en/connecting_your_tools/external_tools.md rename to docs/content/import_data/pro/specialized_import/external_tools.md index 18f39813091..625d12e5070 100644 --- a/docs/content/en/connecting_your_tools/external_tools.md +++ b/docs/content/import_data/pro/specialized_import/external_tools.md @@ -1,8 +1,9 @@ --- -title: "External Tools: Universal Importer & DefectDojo-CLI (Pro)" +title: "Universal Importer & DefectDojo-CLI" description: "Import files to DefectDojo from the command line" draft: false weight: 2 +audience: pro --- Note: The following external tools are DefectDojo Pro-only features. These binaries will not work unless they are connected to an instance with a DefectDojo Pro license. diff --git a/docs/content/en/connecting_your_tools/import_scan_files/smart_upload.md b/docs/content/import_data/pro/specialized_import/smart_upload.md similarity index 98% rename from docs/content/en/connecting_your_tools/import_scan_files/smart_upload.md rename to docs/content/import_data/pro/specialized_import/smart_upload.md index 191f757be65..97e6201ccb2 100644 --- a/docs/content/en/connecting_your_tools/import_scan_files/smart_upload.md +++ b/docs/content/import_data/pro/specialized_import/smart_upload.md @@ -1,7 +1,8 @@ --- -title: "Smart Upload for infrastructure scans (Pro)" +title: "Infrastructure scans / Smart Upload" description: "Automatically route incoming Findings to the correct Product" weight: 3 +audience: pro --- Note: Smart Upload is only available in DefectDojo Pro. diff --git a/docs/content/en/connecting_your_tools/universal_parser.md b/docs/content/import_data/pro/specialized_import/universal_parser.md similarity index 99% rename from docs/content/en/connecting_your_tools/universal_parser.md rename to docs/content/import_data/pro/specialized_import/universal_parser.md index 476f088d716..24043d5de20 100644 --- a/docs/content/en/connecting_your_tools/universal_parser.md +++ b/docs/content/import_data/pro/specialized_import/universal_parser.md @@ -3,7 +3,7 @@ title: "🌐 Universal Parser (Pro)" description: "" draft: "false" weight: 1 -pro-feature: true +audience: pro --- Note: The Universal Parser is only available in DefectDojo Pro. diff --git a/docs/content/issue_tracking/_index.md b/docs/content/issue_tracking/_index.md new file mode 100644 index 00000000000..72c1c5ce15e --- /dev/null +++ b/docs/content/issue_tracking/_index.md @@ -0,0 +1,16 @@ +--- +title: "Issue Tracking" +description: "" +summary: "" +date: 2023-09-07T16:06:50+02:00 +lastmod: 2023-09-07T16:06:50+02:00 +draft: false +weight: 3 +chapter: true +seo: + title: "" # custom title (optional) + description: "" # custom description (recommended) + canonical: "" # custom canonical URL (optional) + robots: "" # custom robot tags (optional) +exclude_search: true +--- \ No newline at end of file diff --git a/docs/content/issue_tracking/intro/_index.md b/docs/content/issue_tracking/intro/_index.md new file mode 100644 index 00000000000..8452f739bba --- /dev/null +++ b/docs/content/issue_tracking/intro/_index.md @@ -0,0 +1,16 @@ +--- +title: "Intro" +description: "" +summary: "" +date: 2023-09-07T16:06:50+02:00 +lastmod: 2023-09-07T16:06:50+02:00 +draft: false +weight: 3 +chapter: true +seo: + title: "" # custom title (optional) + description: "" # custom description (recommended) + canonical: "" # custom canonical URL (optional) + robots: "" # custom robot tags (optional) +exclude_search: true +--- \ No newline at end of file diff --git a/docs/content/issue_tracking/intro/intro.md b/docs/content/issue_tracking/intro/intro.md new file mode 100644 index 00000000000..f307850524d --- /dev/null +++ b/docs/content/issue_tracking/intro/intro.md @@ -0,0 +1,26 @@ +--- +title: "Issue Tracking Integration" +description: "Sync DefectDojo findings with your issue tracking system to streamline remediation and accountability." +weight: 1 +--- + +## Overview + +The DefectDojo issue tracking integrations connect your vulnerability management workflows with your existing issue tracking system. By automatically creating and updating issues from security findings, DefectDojo helps ensure vulnerabilities are visible, owned, and addressed within the same tools your development and operations teams already use. + +| Edition | Supported Issue Tracking Integrations | +|--------------|---------------------------------------| +| Community Edition | * Jira | +| Pro | * Jira
* Azure DevOps
* GitHub
* GitLab Boards
* ServiceNow | + + +When enabled, DefectDojo can create issues automatically, or selectively from Products or Engagement. As Findings are updated in DefectDojo—resolved, mitigated, or reactivated—the corresponding issues can be kept in sync, ensuring both systems reflect the current state of risk. + +## What Gets Tracked + +Each issue can include key vulnerability details such as severity, description, evidence, and remediation guidance. Links between DefectDojo and the issue tracking system provide traceability from discovery through resolution, supporting reporting, audits, and continuous improvement. + +## Why Issue Tracking Integrations Matter + +Security findings are most effective when they are actionable. Integrating DefectDojo with an issue tracking system bridges the gap between detection and remediation by embedding security work directly into established engineering workflows. This reduces context switching, improves accountability, and helps teams remediate issues faster. + diff --git a/docs/content/issue_tracking/jira/_index.md b/docs/content/issue_tracking/jira/_index.md new file mode 100644 index 00000000000..1d5c21c3546 --- /dev/null +++ b/docs/content/issue_tracking/jira/_index.md @@ -0,0 +1,16 @@ +--- +title: "Jira" +description: "" +summary: "" +date: 2023-09-07T16:06:50+02:00 +lastmod: 2023-09-07T16:06:50+02:00 +draft: false +weight: 3 +chapter: true +seo: + title: "" # custom title (optional) + description: "" # custom description (recommended) + canonical: "" # custom canonical URL (optional) + robots: "" # custom robot tags (optional) +exclude_search: true +--- \ No newline at end of file diff --git a/docs/content/en/share_your_findings/jira_guide.md b/docs/content/issue_tracking/jira/jira_guide.md similarity index 100% rename from docs/content/en/share_your_findings/jira_guide.md rename to docs/content/issue_tracking/jira/jira_guide.md diff --git a/docs/content/en/share_your_findings/troubleshooting_jira.md b/docs/content/issue_tracking/jira/troubleshooting_jira.md similarity index 100% rename from docs/content/en/share_your_findings/troubleshooting_jira.md rename to docs/content/issue_tracking/jira/troubleshooting_jira.md diff --git a/docs/content/issue_tracking/pro_integration/_index.md b/docs/content/issue_tracking/pro_integration/_index.md new file mode 100644 index 00000000000..9a96558647c --- /dev/null +++ b/docs/content/issue_tracking/pro_integration/_index.md @@ -0,0 +1,17 @@ +--- +title: "Pro Integrations" +description: "" +summary: "" +date: 2023-09-07T16:06:50+02:00 +lastmod: 2023-09-07T16:06:50+02:00 +draft: false +weight: 3 +chapter: true +seo: + title: "" # custom title (optional) + description: "" # custom description (recommended) + canonical: "" # custom canonical URL (optional) + robots: "" # custom robot tags (optional) +exclude_search: true +audience: pro +--- \ No newline at end of file diff --git a/docs/content/en/share_your_findings/integrations.md b/docs/content/issue_tracking/pro_integration/integrations.md similarity index 99% rename from docs/content/en/share_your_findings/integrations.md rename to docs/content/issue_tracking/pro_integration/integrations.md index e2dd663a9f4..7f9af1cfca7 100644 --- a/docs/content/en/share_your_findings/integrations.md +++ b/docs/content/issue_tracking/pro_integration/integrations.md @@ -1,6 +1,7 @@ --- -title: "Integrations Guide (Pro)" +title: "Pro Integrations" weight: 1 +audience: pro --- DefectDojo Pro's Integrations let you push your Findings and Finding Groups to ticket tracking systems to easily integrate security remediation with your teams existing development workflow. diff --git a/docs/content/en/share_your_findings/integrations_toolreference.md b/docs/content/issue_tracking/pro_integration/integrations_toolreference.md similarity index 99% rename from docs/content/en/share_your_findings/integrations_toolreference.md rename to docs/content/issue_tracking/pro_integration/integrations_toolreference.md index e8c36e4b51c..da74c650acd 100644 --- a/docs/content/en/share_your_findings/integrations_toolreference.md +++ b/docs/content/issue_tracking/pro_integration/integrations_toolreference.md @@ -2,6 +2,7 @@ title: "Integrators Tool Reference" description: "Detailed setup guides for Integrators" weight: 1 +audience: pro --- Here are specific instructions detailing how to set up a DefectDojo Integration with a third party Issue Tracker. diff --git a/docs/content/en/share_your_findings/pro_reports/_index.md b/docs/content/metrics_reports/_index.md similarity index 94% rename from docs/content/en/share_your_findings/pro_reports/_index.md rename to docs/content/metrics_reports/_index.md index f5ee70a661f..e480c09a66f 100755 --- a/docs/content/en/share_your_findings/pro_reports/_index.md +++ b/docs/content/metrics_reports/_index.md @@ -1,5 +1,5 @@ --- -title: "Create A Report" +title: "Metrics & Reports" description: "Create Custom Reports and Export Data" summary: "" date: 2023-09-07T16:06:50+02:00 diff --git a/docs/content/en/ai/_index.md b/docs/content/metrics_reports/ai/_index.md similarity index 97% rename from docs/content/en/ai/_index.md rename to docs/content/metrics_reports/ai/_index.md index 20ea8d9581e..f189404790b 100644 --- a/docs/content/en/ai/_index.md +++ b/docs/content/metrics_reports/ai/_index.md @@ -5,7 +5,7 @@ summary: "" date: 2023-09-07T16:06:50+02:00 lastmod: 2023-09-07T16:06:50+02:00 draft: false -weight: 2 +weight: 3 chapter: true seo: title: "" # custom title (optional) diff --git a/docs/content/en/ai/mcp_server_pro.md b/docs/content/metrics_reports/ai/mcp_server_pro.md similarity index 100% rename from docs/content/en/ai/mcp_server_pro.md rename to docs/content/metrics_reports/ai/mcp_server_pro.md diff --git a/docs/content/en/customize_dojo/dashboards/Introduction_dashboard.md b/docs/content/metrics_reports/dashboards/Introduction_dashboard.md similarity index 100% rename from docs/content/en/customize_dojo/dashboards/Introduction_dashboard.md rename to docs/content/metrics_reports/dashboards/Introduction_dashboard.md diff --git a/docs/content/en/customize_dojo/dashboards/_index.md b/docs/content/metrics_reports/dashboards/_index.md similarity index 90% rename from docs/content/en/customize_dojo/dashboards/_index.md rename to docs/content/metrics_reports/dashboards/_index.md index 6506f0ca7c4..d46ef3261a9 100644 --- a/docs/content/en/customize_dojo/dashboards/_index.md +++ b/docs/content/metrics_reports/dashboards/_index.md @@ -4,10 +4,8 @@ summary: "" date: 2023-09-07T16:06:50+02:00 lastmod: 2023-09-07T16:06:50+02:00 draft: false -weight: 7 +weight: 1 chapter: true -sidebar: - collapsed: true seo: title: "" # custom title (optional) description: "" # custom description (recommended) diff --git a/docs/content/en/customize_dojo/dashboards/about_custom_dashboard_tiles.md b/docs/content/metrics_reports/dashboards/about_custom_dashboard_tiles.md similarity index 100% rename from docs/content/en/customize_dojo/dashboards/about_custom_dashboard_tiles.md rename to docs/content/metrics_reports/dashboards/about_custom_dashboard_tiles.md diff --git a/docs/content/metrics_reports/pro_metrics/PRO__executive_insights.md b/docs/content/metrics_reports/pro_metrics/PRO__executive_insights.md new file mode 100644 index 00000000000..2c7a80cd77a --- /dev/null +++ b/docs/content/metrics_reports/pro_metrics/PRO__executive_insights.md @@ -0,0 +1,18 @@ +--- +title: "Executive Insights" +description: "How to Leverage Metrics in DefectDojo Pro" +audience: pro +weight: 3 +--- + +The **Executive Insights** metrics page provides an aggregated view of application security risk across your organization. As it is design for executive-level consumption, this dashboard focuses exclusively on Organizations and Assets, emphasizing trends and outcomes rather than individual Findings. + +![image](images/pro_dashboards_1.png) + +Within Executive Insights, Users may select a timeframe, Organization, Asset, or Tag from the filter list, which will populate an adjoining table with the resulting Findings. It will also change the results in various charts and graphs below. + +If no filters are selected, the table will display the status of all Organizations, Assets, and Tags. + +The first table provides a birdseye view of your overall security posture. There are also two separate tables for your Organizations and Assets. + +Figures will populate within each table depending on the filters applied. Clicking any hyperlinked figure within a cell will open a separate tab with a corresponding Findings Table. diff --git a/docs/content/metrics_reports/pro_metrics/PRO__overview.md b/docs/content/metrics_reports/pro_metrics/PRO__overview.md new file mode 100644 index 00000000000..c161154f3e3 --- /dev/null +++ b/docs/content/metrics_reports/pro_metrics/PRO__overview.md @@ -0,0 +1,56 @@ +--- +title: "Pro Metrics Overview" +description: "How to Leverage Metrics in DefectDojo Pro" +audience: pro +weight: 2 +--- + +The DefectDojo Pro UI has various Metrics dashboards to help visualize your current security posture. Each dashboard allows stakeholders at different levels of the organization to make informed decisions without needing to interpret raw data or navigate individual Findings. These dashboards include: +* [Executive Insights](#executive-insights) +* [Priority Insights](#priority-insights) +* [Program Insights](#program-insights) +* [Remediation Insights](#remediation-insights) +* [Tool Insights](#tool-insights) + +![Metrics overview](images/metrics_image1.png) + +## Metrics Features + +Before elaborating on each particular dashboard, there are some commonalities between all dashboards that are worth reviewing. + +### Filtering + +All Metrics can be filtered by timeframe, Organization, Asset, and Tag. After adjusting the filter as desired, Apply Filter must be clicked in order for the filter to take effect. If you wish to export a PDF of all charts, tables, and graphs on the dashboard as currently filtered, click Export as PDF. + +The filtering timeframe is limited to the past year, but can otherwise be adjusted to include the past 7, 14, 30, 90, or 180 days. + +Note that filter parameters are rendered in the URL, so you can bookmark multiple pages with various filter parameters. This can be useful for quick reference, or for consistently generating a particular kind of report. + +### Submenus + +Each graph has a ⋮ kebab menu in the top right of each view with the following features: +* Force Refresh — Manually refreshes to incorporate any new updates in the data. +* Expand Plot — Opens the same chart in a larger pop-up modal. +* Download Plot as SVG — Downloads the chart as an SVG file. +* View as Table — Shows the data from the chart in table format. + * Each column of the table can be toggled to appear in ascending or descending order when clicked. You can also download each table. + +![Kebab menu contents](images/metrics_image2.png) + +### Access + +The Metrics section will only represent data from the Organizations and Assets that each User has the appropriate permissions to view. A User with access limited to a single Asset will only be able to see Metrics for that particular Asset, but if they don’t have access to the other Assets within the parent Organization, data from those other Assets won't be represented in Metrics. + +### Viewing Data Within Charts + +The X-axis of line charts will always represent the current timeframe filter. Hovering your cursor over a line chart will cause a modal to appear with a count of the figures on the Y-axis at that point in time. + +![Graph pop-up modal](images/metrics_image3.png) + +### Toggling Results + +Users can toggle certain categories of Findings as viewable and nonviewable in the chart by clicking on their respective color/name at the top of each chart. + +For example, in the Active Findings by Severity chart below, if you only wanted to see Findings with a High or Critical severity, you would click Medium, Low, and Info at the top to remove those results from the chart. Clicking Medium, Low, and Info again would make those results reappear. + +![Toggling graph results gif](images/metrics_image4.gif) diff --git a/docs/content/metrics_reports/pro_metrics/PRO__priority_insights.md b/docs/content/metrics_reports/pro_metrics/PRO__priority_insights.md new file mode 100644 index 00000000000..8d1f7b40c19 --- /dev/null +++ b/docs/content/metrics_reports/pro_metrics/PRO__priority_insights.md @@ -0,0 +1,19 @@ +--- +title: "Priority Insights" +description: "How to Leverage Metrics in DefectDojo Pro" +audience: pro +weight: 3 +--- + +The **Priority Insights** metrics page shows the most critical Findings as determined by Risk, Severity, eEploitability, or custom scoring, helping teams understand which vulnerabilities pose the greatest threat at any given moment and focus their efforts accordingly. + +Apart from various charts and graphs, Priority Insights includes four clickable modals that will open a separate tab with a table for all of the data those four modals represent: + +* Total Urgent Risk Findings +* Total Needs Action Risk Findings +* Total Medium Risk Findings +* Average Finding Priority + +It also includes an integrated table of Prioritized Findings arranged either by AppSec or SOC, allowing Users to further filter, interact with, and view the data associated with individual Findings. The contents can be exported as a CSV file or a Quick Report, and other various columns can be added prior to export. + +![Priority Insights table](images/metrics_image6.png) diff --git a/docs/content/metrics_reports/pro_metrics/PRO__program_insights.md b/docs/content/metrics_reports/pro_metrics/PRO__program_insights.md new file mode 100644 index 00000000000..6d82d652e4a --- /dev/null +++ b/docs/content/metrics_reports/pro_metrics/PRO__program_insights.md @@ -0,0 +1,12 @@ +--- +title: "Program Insights" +description: "How to Leverage Metrics in DefectDojo Pro" +audience: pro +weight: 3 +--- + +The **Program Insights** metrics page evaluates the effectiveness and maturity of the application security program as a whole, focusing on program-level performance rather than individual Findings. + +![image](images/pro_dashboards_3.png) + +It includes breakdowns of testing efforts, as well as how deduplication and reimport features are affecting noise reduction, efficiency increases, and cumulative cost savings, ensuring that security processes are working as intended. diff --git a/docs/content/metrics_reports/pro_metrics/PRO__remediation_insights.md b/docs/content/metrics_reports/pro_metrics/PRO__remediation_insights.md new file mode 100644 index 00000000000..827d6e18f9b --- /dev/null +++ b/docs/content/metrics_reports/pro_metrics/PRO__remediation_insights.md @@ -0,0 +1,16 @@ +--- +title: "Remediation Insights" +description: "How to Leverage Metrics in DefectDojo Pro" +audience: pro +weight: 3 +--- + +The **Remediation Insights** dashboard focuses on closure performance and remediation accountability, charting SLA adherence, overdue Findings, and Risk Acceptance over time. It relies on EPSS scores to determine a Finding’s exploitability, the database for which DefectDojo Pro updates daily and applies to each of your Findings. + +![image](images/pro_dashboards_4.png) + +Similar to Priority Insights, Remediation Insights also includes four clickable modals that will open a separate tab with a table for all of the data those four modals represent: +* Total Open Findings +* Critical & High Open Findings +* Mitigated Within SLA +* Highly Exploitable Findings diff --git a/docs/content/metrics_reports/pro_metrics/PRO__tool_insights.md b/docs/content/metrics_reports/pro_metrics/PRO__tool_insights.md new file mode 100644 index 00000000000..524c447d4e5 --- /dev/null +++ b/docs/content/metrics_reports/pro_metrics/PRO__tool_insights.md @@ -0,0 +1,14 @@ +--- +title: "Tool Insights" +description: "How to Leverage Metrics in DefectDojo Pro" +audience: pro +weight: 3 +--- + +**Tool Insights** tracks the performance of each security tool used in DefectDojo based on the count and severity of Findings that it reports, helping to evaluate the comparative effectiveness of tools over time. + +![image](images/pro_dashboards_5.png) + +Specifically, the Severity by Tool (Top 10 Most Findings) modal will provide a radar chart comparing the severity of the Findings your tools reveal. + +Severity by Tool Monthly will also provide a table arranged by the total Findings a particular scan type revealed on a particular date. Each column of this table can also be toggled to present in ascending or descending order. diff --git a/docs/content/metrics_reports/pro_metrics/_index.md b/docs/content/metrics_reports/pro_metrics/_index.md new file mode 100644 index 00000000000..1e6332bca58 --- /dev/null +++ b/docs/content/metrics_reports/pro_metrics/_index.md @@ -0,0 +1,17 @@ +--- +title: "Pro Metrics" +description: "Performance metrics and insights" +summary: "" +date: 2026-01-20T17:33:00+00:00 +lastmod: 2026-01-20T17:33:00+00:00 +draft: false +weight: 2 +chapter: true +audience: pro +seo: + title: "" + description: "" + canonical: "" + robots: "" +exclude_search: true +--- \ No newline at end of file diff --git a/docs/content/en/share_your_findings/pro_reports/using_the_report_builder.md b/docs/content/metrics_reports/using_the_report_builder.md similarity index 100% rename from docs/content/en/share_your_findings/pro_reports/using_the_report_builder.md rename to docs/content/metrics_reports/using_the_report_builder.md diff --git a/docs/content/en/share_your_findings/pro_reports/working_with_generated_reports.md b/docs/content/metrics_reports/working_with_generated_reports.md similarity index 100% rename from docs/content/en/share_your_findings/pro_reports/working_with_generated_reports.md rename to docs/content/metrics_reports/working_with_generated_reports.md diff --git a/docs/content/navigation/_index.md b/docs/content/navigation/_index.md new file mode 100644 index 00000000000..0a736fd95cb --- /dev/null +++ b/docs/content/navigation/_index.md @@ -0,0 +1,17 @@ +--- +title: "Navigating DefectDojo" +description: "" +summary: "" +date: 2023-09-07T16:12:03+02:00 +lastmod: 2023-09-07T16:12:03+02:00 +draft: false +weight: 999 +toc: true +sidebar: + collapsed: true +seo: + title: "" # custom title (optional) + description: "" # custom description (recommended) + canonical: "" # custom canonical URL (optional) + robots: "" # custom robot tags (optional) +--- \ No newline at end of file diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/filter_index.md b/docs/content/navigation/filter_index.md similarity index 100% rename from docs/content/en/working_with_findings/organizing_engagements_tests/filter_index.md rename to docs/content/navigation/filter_index.md diff --git a/docs/content/en/open_source/_index.md b/docs/content/open_source/_index.md similarity index 100% rename from docs/content/en/open_source/_index.md rename to docs/content/open_source/_index.md diff --git a/docs/content/en/open_source/archived_docs/_index.md b/docs/content/open_source/archived_docs/_index.md similarity index 100% rename from docs/content/en/open_source/archived_docs/_index.md rename to docs/content/open_source/archived_docs/_index.md diff --git a/docs/content/en/open_source/archived_docs/burp-plugin.md b/docs/content/open_source/archived_docs/burp-plugin.md similarity index 100% rename from docs/content/en/open_source/archived_docs/burp-plugin.md rename to docs/content/open_source/archived_docs/burp-plugin.md diff --git a/docs/content/en/open_source/archived_docs/google-sheets-sync.md b/docs/content/open_source/archived_docs/google-sheets-sync.md similarity index 100% rename from docs/content/en/open_source/archived_docs/google-sheets-sync.md rename to docs/content/open_source/archived_docs/google-sheets-sync.md diff --git a/docs/content/en/open_source/archived_docs/usage/_index.md b/docs/content/open_source/archived_docs/usage/_index.md similarity index 100% rename from docs/content/en/open_source/archived_docs/usage/_index.md rename to docs/content/open_source/archived_docs/usage/_index.md diff --git a/docs/content/en/open_source/archived_docs/usage/features.md b/docs/content/open_source/archived_docs/usage/features.md similarity index 100% rename from docs/content/en/open_source/archived_docs/usage/features.md rename to docs/content/open_source/archived_docs/usage/features.md diff --git a/docs/content/en/open_source/archived_docs/usage/questionnaires.md b/docs/content/open_source/archived_docs/usage/questionnaires.md similarity index 100% rename from docs/content/en/open_source/archived_docs/usage/questionnaires.md rename to docs/content/open_source/archived_docs/usage/questionnaires.md diff --git a/docs/content/en/open_source/contributing/_index.md b/docs/content/open_source/contributing/_index.md similarity index 100% rename from docs/content/en/open_source/contributing/_index.md rename to docs/content/open_source/contributing/_index.md diff --git a/docs/content/en/open_source/contributing/branching-model.md b/docs/content/open_source/contributing/branching-model.md similarity index 100% rename from docs/content/en/open_source/contributing/branching-model.md rename to docs/content/open_source/contributing/branching-model.md diff --git a/docs/content/en/open_source/contributing/documentation.md b/docs/content/open_source/contributing/documentation.md similarity index 100% rename from docs/content/en/open_source/contributing/documentation.md rename to docs/content/open_source/contributing/documentation.md diff --git a/docs/content/en/open_source/contributing/how-to-write-a-parser.md b/docs/content/open_source/contributing/how-to-write-a-parser.md similarity index 100% rename from docs/content/en/open_source/contributing/how-to-write-a-parser.md rename to docs/content/open_source/contributing/how-to-write-a-parser.md diff --git a/docs/content/en/open_source/contributing/parser-documentation-template.md b/docs/content/open_source/contributing/parser-documentation-template.md similarity index 100% rename from docs/content/en/open_source/contributing/parser-documentation-template.md rename to docs/content/open_source/contributing/parser-documentation-template.md diff --git a/docs/content/en/open_source/exporting.md b/docs/content/open_source/exporting.md similarity index 100% rename from docs/content/en/open_source/exporting.md rename to docs/content/open_source/exporting.md diff --git a/docs/content/en/open_source/languages.md b/docs/content/open_source/languages.md similarity index 100% rename from docs/content/en/open_source/languages.md rename to docs/content/open_source/languages.md diff --git a/docs/content/en/open_source/ldap-authentication.md b/docs/content/open_source/ldap-authentication.md similarity index 100% rename from docs/content/en/open_source/ldap-authentication.md rename to docs/content/open_source/ldap-authentication.md diff --git a/docs/content/en/open_source/notification_webhooks/_index.md b/docs/content/open_source/notification_webhooks/_index.md similarity index 100% rename from docs/content/en/open_source/notification_webhooks/_index.md rename to docs/content/open_source/notification_webhooks/_index.md diff --git a/docs/content/en/open_source/notification_webhooks/engagement_added.md b/docs/content/open_source/notification_webhooks/engagement_added.md similarity index 100% rename from docs/content/en/open_source/notification_webhooks/engagement_added.md rename to docs/content/open_source/notification_webhooks/engagement_added.md diff --git a/docs/content/en/open_source/notification_webhooks/how_to.md b/docs/content/open_source/notification_webhooks/how_to.md similarity index 100% rename from docs/content/en/open_source/notification_webhooks/how_to.md rename to docs/content/open_source/notification_webhooks/how_to.md diff --git a/docs/content/en/open_source/notification_webhooks/ping.md b/docs/content/open_source/notification_webhooks/ping.md similarity index 100% rename from docs/content/en/open_source/notification_webhooks/ping.md rename to docs/content/open_source/notification_webhooks/ping.md diff --git a/docs/content/en/open_source/notification_webhooks/product_added.md b/docs/content/open_source/notification_webhooks/product_added.md similarity index 100% rename from docs/content/en/open_source/notification_webhooks/product_added.md rename to docs/content/open_source/notification_webhooks/product_added.md diff --git a/docs/content/en/open_source/notification_webhooks/product_type_added.md b/docs/content/open_source/notification_webhooks/product_type_added.md similarity index 100% rename from docs/content/en/open_source/notification_webhooks/product_type_added.md rename to docs/content/open_source/notification_webhooks/product_type_added.md diff --git a/docs/content/en/open_source/notification_webhooks/scan_added.md b/docs/content/open_source/notification_webhooks/scan_added.md similarity index 100% rename from docs/content/en/open_source/notification_webhooks/scan_added.md rename to docs/content/open_source/notification_webhooks/scan_added.md diff --git a/docs/content/en/open_source/notification_webhooks/test_added.md b/docs/content/open_source/notification_webhooks/test_added.md similarity index 100% rename from docs/content/en/open_source/notification_webhooks/test_added.md rename to docs/content/open_source/notification_webhooks/test_added.md diff --git a/docs/content/en/open_source/notification_webhooks/transition-state b/docs/content/open_source/notification_webhooks/transition-state similarity index 100% rename from docs/content/en/open_source/notification_webhooks/transition-state rename to docs/content/open_source/notification_webhooks/transition-state diff --git a/docs/content/en/open_source/rate_limiting.md b/docs/content/open_source/rate_limiting.md similarity index 100% rename from docs/content/en/open_source/rate_limiting.md rename to docs/content/open_source/rate_limiting.md diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/_index.md b/docs/content/triage_findings/findings/_index.md similarity index 58% rename from docs/content/en/working_with_findings/organizing_engagements_tests/_index.md rename to docs/content/triage_findings/findings/_index.md index d1823bda407..8e54bd147cc 100644 --- a/docs/content/en/working_with_findings/organizing_engagements_tests/_index.md +++ b/docs/content/triage_findings/findings/_index.md @@ -1,10 +1,10 @@ --- -title: "Organizing Data" +title: "Findings" date: 2021-02-02T20:46:29+01:00 draft: false -weight: 4 type: docs +weight: 3 sidebar: - collapsed: false + collapsed: false exclude_search: true --- diff --git a/docs/content/en/working_with_findings/finding_deduplication/deduplication_tuning_os.md b/docs/content/triage_findings/findings/finding_deduplication/OS__deduplication_tuning.md similarity index 96% rename from docs/content/en/working_with_findings/finding_deduplication/deduplication_tuning_os.md rename to docs/content/triage_findings/findings/finding_deduplication/OS__deduplication_tuning.md index d46f9626567..2950c4a2f62 100644 --- a/docs/content/en/working_with_findings/finding_deduplication/deduplication_tuning_os.md +++ b/docs/content/triage_findings/findings/finding_deduplication/OS__deduplication_tuning.md @@ -1,10 +1,11 @@ --- -title: "Deduplication Tuning (Open Source)" +title: "Deduplication Tuning" description: "Configure deduplication in DefectDojo Open Source: algorithms, hash fields, endpoints, and service" weight: 5 +audience: opensource --- -This page explains how to tune deduplication in the Open Source (OS) edition of DefectDojo. For a visual, feature-rich tuning UI, see the Pro documentation. The OS edition uses settings files and environment variables. +The Open Source edition of DefectDojo uses settings files and environment variables tune deduplication. See also: [Configuration](/en/open_source/installation/configuration) for details on environment variables and `local_settings.py` overrides. diff --git a/docs/content/en/working_with_findings/finding_deduplication/tune_deduplication.md b/docs/content/triage_findings/findings/finding_deduplication/PRO__deduplication_tuning.md similarity index 98% rename from docs/content/en/working_with_findings/finding_deduplication/tune_deduplication.md rename to docs/content/triage_findings/findings/finding_deduplication/PRO__deduplication_tuning.md index 675f4cc88f3..9da8005d8a1 100644 --- a/docs/content/en/working_with_findings/finding_deduplication/tune_deduplication.md +++ b/docs/content/triage_findings/findings/finding_deduplication/PRO__deduplication_tuning.md @@ -1,7 +1,8 @@ --- -title: "Deduplication Tuning (Pro)" +title: "Deduplication Tuning" description: "Configure how DefectDojo identifies and manages duplicate findings" weight: 4 +audience: pro --- Deduplication Tuning is a DefectDojo Pro feature that gives you fine-grained control over how findings are deduplicated, allowing you to optimize duplicate detection for your specific security testing workflow. diff --git a/docs/content/en/working_with_findings/finding_deduplication/enabling_product_deduplication.md b/docs/content/triage_findings/findings/finding_deduplication/PRO_enabling_product_deduplication.md similarity index 99% rename from docs/content/en/working_with_findings/finding_deduplication/enabling_product_deduplication.md rename to docs/content/triage_findings/findings/finding_deduplication/PRO_enabling_product_deduplication.md index 7bff087c898..9c25e663b55 100644 --- a/docs/content/en/working_with_findings/finding_deduplication/enabling_product_deduplication.md +++ b/docs/content/triage_findings/findings/finding_deduplication/PRO_enabling_product_deduplication.md @@ -2,6 +2,7 @@ title: "Enabling Deduplication" description: "How to enable Deduplication at the Product level" weight: 2 +audience: pro --- Deduplication can be implemented at either a Product level or at a more narrow Engagement level. diff --git a/docs/content/triage_findings/findings/finding_deduplication/_index.md b/docs/content/triage_findings/findings/finding_deduplication/_index.md new file mode 100644 index 00000000000..86e6616427e --- /dev/null +++ b/docs/content/triage_findings/findings/finding_deduplication/_index.md @@ -0,0 +1,8 @@ +--- +title: "Deduplication" +date: 2021-02-02T20:46:29+01:00 +draft: false +type: docs +weight: 3 +exclude_search: true +--- diff --git a/docs/content/triage_findings/findings/finding_deduplication/about_deduplication.md b/docs/content/triage_findings/findings/finding_deduplication/about_deduplication.md new file mode 100644 index 00000000000..8f0f745dc2b --- /dev/null +++ b/docs/content/triage_findings/findings/finding_deduplication/about_deduplication.md @@ -0,0 +1,122 @@ +--- +title: "About Deduplication" +description: "Deduplication fundamentals and key concepts" +weight: 1 +--- + +DefectDojo is designed to ingest bulk reports from tools, creating one or more Findings based on the content of the report. When using DefectDojo, you’ll most likely be ingesting reports from the same tool on a regular basis, which means that duplicate Findings are highly likely. + +This is where Deduplication comes in, a Smart feature which you can set up to automatically manage duplicate Findings. + +## How DefectDojo handles duplicates + +1. First, you import **Test 1\.** Your report contains a vulnerability which is recorded as Finding A. +2. **Later, you import Test 2 which contains the same vulnerability. This will be recorded as Finding B, and Finding B will be marked as a duplicate of Finding A.** +3. Later still, you import **Test 3** which also contains that vulnerability. This will be recorded as Finding C, which will be marked as a duplicate of Finding A. + +By creating and marking Duplicates in this way, DefectDojo ensures that all the work for the ‘original’ vulnerability is centralized on the original Finding page, without creating separate contexts, or giving your team the impression that there are multiple separate vulnerabilities which need to be addressed. + +By default, these Tests would need to be nested under the same Product for Deduplication to be applied. If you wish, you can further limit the Deduplication scope to a single Engagement. + +![Deduplication on product and engagement level](images/deduplication.png) + +Duplicate Findings are set as Inactive by default. This does not mean the Duplicate Finding itself is Inactive. Rather, this is so that your team only has a single active Finding to work on and remediate, with the implication being that once the original Finding is Mitigated, the Duplicates will also be Mitigated. + +## Deduplication vs Reimport + +Deduplication and Reimport are similar processes but they have a key difference: + +* When you Reimport to a Test, the Reimport process looks at incoming Findings, **filters and** **discards any matches**. Those matches will never be created as Findings or Finding Duplicates. +* Deduplication is applied 'passively' on Findings that have already been created. It will identify duplicates in scope and **label them**, but it will not delete or discard the Finding unless 'Delete Deduplicate Findings' is enabled. +* The 'reimport' action of discarding a Finding always happens before deduplication; DefectDojo **cannot deduplicate Findings that are never created** as a result of Reimport's filtering. + +## When are duplicates appropriate? + +Duplicates are useful when you’re dealing with shared, but discrete Testing contexts. For example, if your Product is uploading Test results for two different repositories, which need to be compared, it’s useful to know which vulnerabilities are shared across those repositories. + +However, if DefectDojo is creating excess duplicates, this can also be a sign that you need to adjust your pipelines or import processes. + +## What do my duplicates indicate? + +* **The same vulnerability, but found in a different context:** this is the appropriate way to use Duplicate Findings. If you have many components which are affected by the same vulnerability, you would likely want to know which components are affected to understand the scope of the problem. +​ +* **The same vulnerability, found in the same context**: better options exist for this case. If the Duplicate Finding does not give you any new context on the vulnerability, or if you find yourself frequently ignoring or deleting your duplicate Findings, this is a sign that your process can be improved. For example, Reimport allows you to effectively manage incoming reports from a CI/CD pipeline. Rather than create a completely new Finding object for each duplicate, Reimport will make a note of the incoming duplicate without creating the Duplicate Finding at all. + + +## Overview + +DefectDojo supports four deduplication algorithms that can be selected per parser (test type): + +- **Unique ID From Tool**: Uses the scanner-provided unique identifier. +- **Hash Code**: Uses a configured set of fields to compute a hash. +- **Unique ID From Tool or Hash Code**: Prefer the tool’s unique ID; fall back to hash when no matching unique ID is found. +- **Legacy**: Historical algorithm with multiple conditions; only available in the Open Source version. + +Algorithm selection per parser is controlled by `DEDUPLICATION_ALGORITHM_PER_PARSER` (see the [Open-Source tuning page](/en/working_with_findings/finding_deduplication/deduplication_tuning_os/) for configuration details). + +## How endpoints are assessed per algorithm + +Endpoints can influence deduplication in different ways depending on the algorithm and configuration. + +### Unique ID From Tool + +- Deduplication uses `unique_id_from_tool` (or `vuln_id_from_tool`). +- **Endpoints are ignored** for duplicate matching. +- A finding’s hash may still be calculated for other features, but it does not affect deduplication under this algorithm. + +### Hash Code + +- Deduplication uses a hash computed from fields specified by `HASHCODE_FIELDS_PER_SCANNER` for the given parser. +- The hash also includes fields from `HASH_CODE_FIELDS_ALWAYS` (see Service field section below). +- Endpoints can affect deduplication in two ways: + - If the scanner’s hash fields include `endpoints`, they are part of the hash and must match accordingly. +- If the scanner’s hash fields do not include `endpoints`, optional endpoint-based matching can be enabled via `DEDUPE_ALGO_ENDPOINT_FIELDS` (OS setting). When configured: + - Set it to an empty list `[]` to ignore endpoints entirely. + - Set it to a list of endpoint attributes (e.g. `["host", "port"]`). If at least one endpoint pair between the two findings matches on all listed attributes, deduplication can occur. + +### Unique ID From Tool or Hash Code +A finding is a duplicate with another if they have the same unique_id_from_tool OR the same hash_code. + +The endpoints also have to match for the findings to be considered duplicates, see the Hash Code algorithm above. + +### Legacy (Open Source only) + +- Deduplication considers multiple attributes including endpoints. +- Behavior differs for static vs dynamic findings: + - **Static findings**: The new finding must contain all endpoints of the original. Extra endpoints on the new finding are allowed. + - **Dynamic findings**: Endpoints must strictly match (commonly by host and port); differing endpoints prevent deduplication. +- If there are no endpoints and both `file_path` and `line` are empty, deduplication typically does not occur. + +## Background processing + +- Dedupe is triggered on import/reimport and during certain updates run via Celery in the background. + +## Service field and its impact + +- By default, `HASH_CODE_FIELDS_ALWAYS = ["service"]`, meaning the `service` associated with a finding is appended to the hash for all scanners. +- Practical implications: + - Two otherwise identical findings with different `service` values will produce different hashes and will not deduplicate under Hash-based paths. + - During import/reimport, the `Service` field entered in the UI can override the parser-provided service. Changing it can change the hash and therefore affect deduplication outcomes. + - If you want service to have no impact on deduplication, configure `HASH_CODE_FIELDS_ALWAYS` accordingly (see the OS tuning page). Removing `service` from the always-included list will stop it from affecting hashes. + +See also: the [Open Source tuning guide](/en/working_with_findings/finding_deduplication/deduplication_tuning_os/) for configuration details and examples. + +## Delete Deduplicate Findings + +If you have an excessive amount of duplicate Findings which you want to delete, you can set **Delete Deduplicate Findings** as an option in the **System Settings**. + +**Delete Deduplicate Findings**, combined with the **Maximum Duplicates** field allows DefectDojo to limit the amount of Duplicate Findings stored. When this field is enabled, DefectDojo will only keep a certain number of Duplicate Findings. + +### Which duplicates will be deleted? + +The original Finding will never be deleted automatically from DefectDojo, but once the threshold for Maximum Duplicates is crossed, DefectDojo will automatically delete the oldest Duplicate Finding. + +For example, let’s say that you had your Maximum Duplicates field set to ‘1’. + +1. First, you import **Test 1\.** Your report contains a vulnerability which is recorded as Finding A. +2. **Later, you import Test 2 contains the same vulnerability. This will be recorded as Finding B, and Finding B will be marked as a duplicate of Finding A.** +3. Later still, you import **Test 3** which also contains that vulnerability. This will be recorded as Finding C, which will be marked as a duplicate of Finding A. At this time, Finding B will be deleted from DefectDojo as the threshold for maximum duplicates has been crossed. + +### Applying this setting + +Applying **Delete Deduplicate Findings** will begin a deletion process immediately. This setting can be applied on the **System Settings** page. See Enabling Deduplication for more information. diff --git a/docs/content/en/working_with_findings/finding_deduplication/avoiding_duplicates_via_reimport.md b/docs/content/triage_findings/findings/finding_deduplication/avoiding_duplicates_via_reimport.md similarity index 100% rename from docs/content/en/working_with_findings/finding_deduplication/avoiding_duplicates_via_reimport.md rename to docs/content/triage_findings/findings/finding_deduplication/avoiding_duplicates_via_reimport.md diff --git a/docs/content/en/working_with_findings/findings_workflows/_index.md b/docs/content/triage_findings/findings/findings_workflows/_index.md similarity index 77% rename from docs/content/en/working_with_findings/findings_workflows/_index.md rename to docs/content/triage_findings/findings/findings_workflows/_index.md index 454581ccee2..d266d45d58b 100644 --- a/docs/content/en/working_with_findings/findings_workflows/_index.md +++ b/docs/content/triage_findings/findings/findings_workflows/_index.md @@ -4,7 +4,5 @@ date: 2021-02-02T20:46:29+01:00 draft: false weight: 3 type: docs -sidebar: - collapsed: true exclude_search: true --- diff --git a/docs/content/en/working_with_findings/findings_workflows/create_findings_manually.md b/docs/content/triage_findings/findings/findings_workflows/create_findings_manually.md similarity index 100% rename from docs/content/en/working_with_findings/findings_workflows/create_findings_manually.md rename to docs/content/triage_findings/findings/findings_workflows/create_findings_manually.md diff --git a/docs/content/en/working_with_findings/findings_workflows/editing_findings.md b/docs/content/triage_findings/findings/findings_workflows/editing_findings.md similarity index 100% rename from docs/content/en/working_with_findings/findings_workflows/editing_findings.md rename to docs/content/triage_findings/findings/findings_workflows/editing_findings.md diff --git a/docs/content/en/working_with_findings/findings_workflows/finding_status_definitions.md b/docs/content/triage_findings/findings/findings_workflows/finding_status_definitions.md similarity index 100% rename from docs/content/en/working_with_findings/findings_workflows/finding_status_definitions.md rename to docs/content/triage_findings/findings/findings_workflows/finding_status_definitions.md diff --git a/docs/content/en/working_with_findings/findings_workflows/manage_duplicate_findings.md b/docs/content/triage_findings/findings/findings_workflows/manage_duplicate_findings.md similarity index 100% rename from docs/content/en/working_with_findings/findings_workflows/manage_duplicate_findings.md rename to docs/content/triage_findings/findings/findings_workflows/manage_duplicate_findings.md diff --git a/docs/content/en/working_with_findings/findings_workflows/risk_acceptances.md b/docs/content/triage_findings/findings/findings_workflows/risk_acceptances.md similarity index 100% rename from docs/content/en/working_with_findings/findings_workflows/risk_acceptances.md rename to docs/content/triage_findings/findings/findings_workflows/risk_acceptances.md diff --git a/docs/content/en/working_with_findings/intro_to_findings.md b/docs/content/triage_findings/findings/intro_to_findings.md similarity index 96% rename from docs/content/en/working_with_findings/intro_to_findings.md rename to docs/content/triage_findings/findings/intro_to_findings.md index 8bc26bf21ae..dce0395c909 100644 --- a/docs/content/en/working_with_findings/intro_to_findings.md +++ b/docs/content/triage_findings/findings/intro_to_findings.md @@ -102,8 +102,3 @@ Any Appsec team member understands that issue mitigation can’t be prioritized Sometimes, the exploitability and threat posed by a known vulnerability can change based on new data. To keep your work up to date, DefectDojo Pro has partnered with First.org to maintain a database of the latest EPSS scores related to Findings. Any Findings in DefectDojo Pro will be kept up to date automatically according to their EPSS, which is directly based on the CVE of the Finding. If a Finding’s EPSS score changes (i.e. the related Finding becomes more exploitable or less exploitable), the Severity of the Finding will adjust accordingly. - -# Next Steps: - -* Learn how to add or adjust data on your Findings: **[Editing Findings](../findings_workflows/editing_findings)**. -* Learn how to apply **[Risk Acceptances](../findings_workflows/risk_acceptances/)** to Findings which create a record of sensitive decisions made surrounding risk\-accepted vulnerabilities. diff --git a/docs/layouts/_partials/header/header.html b/docs/layouts/_partials/header/header.html index c76685e5e10..7276888460c 100644 --- a/docs/layouts/_partials/header/header.html +++ b/docs/layouts/_partials/header/header.html @@ -17,21 +17,6 @@
{{ end -}} - - - {{ partial "main/showFlexSearch" . }} {{ $showFlexSearch := .Scratch.Get "showFlexSearch" -}} @@ -148,73 +133,51 @@
{{ .Site.Params.T
--> -
- - - - {{ partial "main/showFlexSearch" . }} - {{ $showFlexSearch := .Scratch.Get "showFlexSearch" -}} - {{ if $showFlexSearch -}} - - {{ end -}} + + {{ end -}} - - {{ if site.Params.add_ons.docSearch -}} - - {{ end -}} + + {{ if site.Params.add_ons.docSearch -}} + + {{ end -}} +
+ {{ if eq site.Params.doks.multilingualMode true -}} @@ -314,39 +277,41 @@
{{ .Site.Params.T {{ end -}} - - {{ if and (eq site.Params.doks.colorMode "auto") site.Params.doks.colorModeToggler -}} - - {{ end -}} - - - {{ if .Site.Menus.social -}} - - {{ end -}} + + {{ if .Site.Menus.social -}} + + {{ end -}} + {{ if site.Params.doks.navBarButton -}} @@ -355,6 +320,44 @@
{{ .Site.Params.T }} {{ end -}} +
+
    + {{ $current := index (split .RelPermalink "/") 1 }} + {{ if eq $current "" }}{{ $current = "en" }}{{ end }} + + {{ range .Site.Menus.main }} + {{ $menuSegment := index (split .URL "/") 1 }} + {{ $active := eq $menuSegment $current }} + {{ if .HasChildren -}} +
  • + +
      + {{ range .Children -}} + {{- $active = eq .Name $current.Title -}} +
    • {{ .Name }}
      • + {{ end -}} +
    +
    • + {{ else -}} +
  • + {{ .Name }} +
    • + {{ end -}} + {{ end -}} +
+
+ diff --git a/docs/layouts/_partials/sidebar/render-section-menu.html b/docs/layouts/_partials/sidebar/render-section-menu.html new file mode 100644 index 00000000000..77d257b1909 --- /dev/null +++ b/docs/layouts/_partials/sidebar/render-section-menu.html @@ -0,0 +1,67 @@ +{{- /* Get parameters */ -}} +{{- $currentPage := .currentPage -}} +{{- $nodes := .nodes -}} +{{- $version := .version | default "opensource" -}} + + + +{{- define "walk" }} + {{- $currentPage := .currentPage -}} + {{- $node := .node -}} + {{- $version := .version -}} + + {{- /* Skip node if it has a Page with an audience that does not match version */ -}} + {{- $skip := false -}} + {{- with $node.Page }} + {{- $audience := .Params.audience -}} + {{- if and $audience (ne $audience $version) }} + {{- $skip = true -}} + {{- end }} + {{- end }} + + {{- if not $skip }} + {{- $linkContent := $node.Page.LinkTitle -}} + {{- with $node.Name }} + {{- $linkContent = . }} + {{- end }} + + {{- $ariaCurrent := "" -}} + {{- $liClass := "" -}} + + {{- if $node.Page }} + {{- if in $currentPage.Ancestors $node.Page }} + {{- $ariaCurrent = "true" }} + {{- end }} + {{- if $currentPage.Eq $node.Page }} + {{- $ariaCurrent = "page" }} + {{- $liClass = "active" }} + {{- end }} + {{- end }} + +
  • + {{- with $node.Page.Pages }} + + {{ $linkContent }} +
      + {{- range . }} + {{- template "walk" (dict "node" . "currentPage" $currentPage "version" $version) }} + {{- end }} +
    + + {{- else }} + {{- if $node.Page }} + {{ $linkContent }} + {{- else }} + {{- /* Menu-only item with no page */ -}} + {{ $linkContent }} + {{- end }} + {{- end }} +
    • + {{- end }} +{{- end }} diff --git a/docs/layouts/_partials/sidebar/section-menu.html b/docs/layouts/_partials/sidebar/section-menu.html new file mode 100644 index 00000000000..fa74afdb965 --- /dev/null +++ b/docs/layouts/_partials/sidebar/section-menu.html @@ -0,0 +1,32 @@ +{{- /* section-menu.html with version toggle */ -}} + +{{- $sidebar := printf "sidebar_%s" .Section -}} +{{- $nodes := slice -}} + +{{- /* Get nodes from menu or section */ -}} +{{- with index site.Menus $sidebar }} +{{- $nodes = . -}} +{{- else }} +{{- with (.Site.GetPage "section" .Section).Sections }} +{{- $nodes = . -}} +{{- end }} +{{- end }} + + + + +
    +
    + {{ partial "sidebar/render-section-menu.html" (dict "currentPage" $ "nodes" $nodes "version" "opensource") }} +
    + +
    + {{ partial "sidebar/render-section-menu.html" (dict "currentPage" $ "nodes" $nodes "version" "pro") }} +
    +
    \ No newline at end of file diff --git a/docs/static/svgs/logo-darkmode.svg b/docs/static/svgs/logo-darkmode.svg new file mode 100644 index 00000000000..70f6c6c184e --- /dev/null +++ b/docs/static/svgs/logo-darkmode.svg @@ -0,0 +1,726 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/static/svgs/logo-lightmode.svg b/docs/static/svgs/logo-lightmode.svg new file mode 100644 index 00000000000..212d132dea8 --- /dev/null +++ b/docs/static/svgs/logo-lightmode.svg @@ -0,0 +1,836 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file