diff --git a/docs/assets/images/import_scan_ui.png b/docs/assets/images/import_scan_ui.png
index 851dfa95d34..ccf9a1b4aee 100644
Binary files a/docs/assets/images/import_scan_ui.png and b/docs/assets/images/import_scan_ui.png differ
diff --git a/docs/assets/images/metrics_image1.png b/docs/assets/images/metrics_image1.png
new file mode 100644
index 00000000000..6cc5b8f0119
Binary files /dev/null and b/docs/assets/images/metrics_image1.png differ
diff --git a/docs/assets/images/metrics_image2.png b/docs/assets/images/metrics_image2.png
new file mode 100644
index 00000000000..4216af8301f
Binary files /dev/null and b/docs/assets/images/metrics_image2.png differ
diff --git a/docs/assets/images/metrics_image3.png b/docs/assets/images/metrics_image3.png
new file mode 100644
index 00000000000..31b902848a8
Binary files /dev/null and b/docs/assets/images/metrics_image3.png differ
diff --git a/docs/assets/images/metrics_image4.gif b/docs/assets/images/metrics_image4.gif
new file mode 100644
index 00000000000..b13835114f5
Binary files /dev/null and b/docs/assets/images/metrics_image4.gif differ
diff --git a/docs/assets/images/metrics_image6.png b/docs/assets/images/metrics_image6.png
new file mode 100644
index 00000000000..1e2bbfdcab6
Binary files /dev/null and b/docs/assets/images/metrics_image6.png differ
diff --git a/docs/assets/js/custom.js b/docs/assets/js/custom.js
index c5525d04e5e..f6cb612dd0c 100644
--- a/docs/assets/js/custom.js
+++ b/docs/assets/js/custom.js
@@ -1 +1,60 @@
-// Put your custom JS code here
+// custom js
+
+
+// version toggler
+(() => {
+ "use strict";
+
+ console.log("[VersionToggle] custom.js loaded");
+
+ const setVersion = (version) => {
+ console.log("[VersionToggle] Setting version to:", version);
+
+ document.querySelectorAll(".version-opensource, .version-pro").forEach(el => {
+ el.style.display = el.classList.contains(`version-${version}`) ? "" : "none";
+ });
+
+ localStorage.setItem("version", version);
+ console.log("[VersionToggle] localStorage updated:", localStorage.getItem("version"));
+
+ // Update dropdown
+ const selects = document.querySelectorAll("#version-select");
+ selects.forEach(sel => {
+ sel.value = version;
+ sel.dataset.version = version;
+ sel.style.visibility = "visible";
+ });
+
+ // unhide sidebar after version is applied
+ const sidebar = document.querySelector(".docs-sidebar");
+ if (sidebar) {
+ sidebar.style.visibility = "visible";
+ console.log("[VersionToggle] Sidebar revealed");
+ }
+ };
+
+ const initVersionToggle = () => {
+ const storedVersion = localStorage.getItem("version") || "opensource";
+ console.log("[VersionToggle] Stored version:", storedVersion);
+ setVersion(storedVersion);
+ };
+
+ // Delegated listener on body
+ document.body.addEventListener("change", (e) => {
+ if (e.target && e.target.id === "version-select") {
+ console.log("[VersionToggle] Dropdown changed to:", e.target.value);
+ setVersion(e.target.value);
+ }
+ });
+
+ // Run on DOM ready
+ window.addEventListener("DOMContentLoaded", initVersionToggle);
+
+ // MutationObserver to detect dynamically replaced sidebar
+ const observer = new MutationObserver(() => {
+ // Re-run init to make sure menus match stored version
+ initVersionToggle();
+ });
+ observer.observe(document.body, { childList: true, subtree: true });
+
+})();
diff --git a/docs/assets/scss/common/_custom.scss b/docs/assets/scss/common/_custom.scss
index e3429be7722..d16f34214b7 100644
--- a/docs/assets/scss/common/_custom.scss
+++ b/docs/assets/scss/common/_custom.scss
@@ -43,4 +43,38 @@
.DocSearch-Modal {
position: fixed !important;
}
+}
+
+.logo-darkmode {
+ display: none;
+}
+
+[data-bs-theme="dark"] .logo-lightmode {
+ display: none;
+}
+
+[data-bs-theme="dark"] .logo-darkmode {
+ display: inline-block;
+}
+
+html {
+ font-size: 85%; /* scales all rem/em fonts */
+}
+
+/* Hide sidebar until version is resolved */
+.docs-sidebar {
+ visibility: hidden;
+}
+
+
+#version-select[data-version="opensource"] {
+ background-color: #003964b7;
+ border: 2px solid #003864;
+ color: white;
+}
+
+#version-select[data-version="pro"] {
+ background-color: #a84e32b7;
+ border: 2px solid #a84e32;
+ color: white;
}
\ No newline at end of file
diff --git a/docs/config/_default/menus/menus.en.toml b/docs/config/_default/menus/menus.en.toml
index 2189b85513a..58752fbcba0 100644
--- a/docs/config/_default/menus/menus.en.toml
+++ b/docs/config/_default/menus/menus.en.toml
@@ -1,28 +1,48 @@
[[main]]
- name = "Docs Home"
- url = "/en/about_defectdojo/about_docs/"
+ name = "Get started ⏷"
+ url = "/get_started/about/about_defectdojo"
weight = 10
[[main]]
- name = "Supported Tools"
- url = "/supported_tools/"
- weight = 11
+ name = "Import data ⏷"
+ url = "/import_data/import_intro/comparison/"
+ weight = 12
[[main]]
- name = "Pro Features"
- url = "/en/about_defectdojo/pro_features"
+ name = "Triage Findings ⏷"
+ url = "/triage_findings/findings_workflows/intro_to_findings/"
weight = 12
[[main]]
- name = "Changelog"
- url = "/en/changelog/changelog/"
+ name = "Model your assets ⏷"
+ url = "/asset_modelling/hierarchy/pro__assets_organizations/"
weight = 13
[[main]]
- name = "Support"
- url = "/en/about_defectdojo/contact_defectdojo_support"
+ name = "Metrics & reports ⏷"
+ url = "/metrics_reports/dashboards/introduction_dashboard/"
weight = 14
+[[main]]
+ name = "Admin ⏷"
+ url = "/admin/admin_intro/intro/"
+ weight = 16
+
+[[main]]
+ name = "Issue tracking ⏷"
+ url = "/issue_tracking/intro/intro/"
+ weight = 15
+
+[[main]]
+ name = "Automation ⏷"
+ url = "/automation/api/api-v2-docs/"
+ weight = 15
+
+[[main]]
+ name = "Supported tools ⏷"
+ url = "/supported_tools/"
+ weight = 16
+
[[social]]
name = "YouTube"
pre = ''
diff --git a/docs/config/_default/params.toml b/docs/config/_default/params.toml
index 876e6d44e2f..36331f1428b 100644
--- a/docs/config/_default/params.toml
+++ b/docs/config/_default/params.toml
@@ -44,9 +44,21 @@ mainSections = ["docs"]
bootstrapJavascript = false # false (default) or true
# Nav
- sectionNav = ["docs", "en", "supported_tools"] # ["docs"] (default) or list of sections (e.g. ["docs", "guides"])
+ sectionNav = [
+ "docs",
+ "en",
+ "supported_tools",
+ "get_started",
+ "import_data",
+ "triage_findings",
+ "metrics_reports",
+ "admin",
+ "automation",
+ "asset_modelling",
+ "issue_tracking"] # ["docs"] (default) or list of sections (e.g. ["docs", "guides"])
+
toTopButton = false # false (default) or true
- breadcrumbTrail = true # false (default) or true
+ breadcrumbTrail = false # false (default) or true
headlineHash = true # true (default) or false
scrollSpy = true # true (default) or false
diff --git a/docs/content/admin/admin_intro/_index.md b/docs/content/admin/admin_intro/_index.md
new file mode 100644
index 00000000000..8452f739bba
--- /dev/null
+++ b/docs/content/admin/admin_intro/_index.md
@@ -0,0 +1,16 @@
+---
+title: "Intro"
+description: ""
+summary: ""
+date: 2023-09-07T16:06:50+02:00
+lastmod: 2023-09-07T16:06:50+02:00
+draft: false
+weight: 3
+chapter: true
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ robots: "" # custom robot tags (optional)
+exclude_search: true
+---
\ No newline at end of file
diff --git a/docs/content/admin/admin_intro/intro.md b/docs/content/admin/admin_intro/intro.md
new file mode 100644
index 00000000000..eef83cdd763
--- /dev/null
+++ b/docs/content/admin/admin_intro/intro.md
@@ -0,0 +1,9 @@
+---
+title: "DefectDojo Admin Controls"
+description: "Administrative controls for configuring, securing, and maintaining your DefectDojo instance."
+weight: 0
+---
+
+Admin actions in DefectDojo provide the controls needed to configure and maintain the platform across your organization. These actions are designed for administrators who are responsible for user management, system configuration, and ensuring DefectDojo operates securely and reliably at scale.
+
+Administrative actions allow you to manage core aspects of DefectDojo, including authentication methods, user access, global settings, and integrations. From initial setup to ongoing maintenance, these controls define how DefectDojo behaves and how users interact with it.
\ No newline at end of file
diff --git a/docs/content/en/customize_dojo/notifications/_index.md b/docs/content/admin/notifications/_index.md
similarity index 93%
rename from docs/content/en/customize_dojo/notifications/_index.md
rename to docs/content/admin/notifications/_index.md
index 218ba05ea85..3c6eb3a19d5 100644
--- a/docs/content/en/customize_dojo/notifications/_index.md
+++ b/docs/content/admin/notifications/_index.md
@@ -6,8 +6,6 @@ lastmod: 2023-09-07T16:06:50+02:00
draft: false
weight: 7
chapter: true
-sidebar:
- collapsed: true
seo:
title: "" # custom title (optional)
description: "" # custom description (recommended)
diff --git a/docs/content/en/customize_dojo/notifications/about_notifications.md b/docs/content/admin/notifications/about_notifications.md
similarity index 97%
rename from docs/content/en/customize_dojo/notifications/about_notifications.md
rename to docs/content/admin/notifications/about_notifications.md
index 1426d42ac5d..cb27b5e0995 100644
--- a/docs/content/en/customize_dojo/notifications/about_notifications.md
+++ b/docs/content/admin/notifications/about_notifications.md
@@ -74,4 +74,4 @@ For more information about this behavior see the [related pull request #9699](ht
### Webhooks (experimental)
-DefectDojo also supports webhooks that follow the same events as other notifications (you can be notified in the same situations). Details about setup are described in [related page](/en/open_source/notification_webhooks/how_to).
+DefectDojo also supports webhooks that follow the same events as other notifications (you can be notified in the same situations). Details about setup are described in [related page](/open_source/notification_webhooks/how_to).
diff --git a/docs/content/en/customize_dojo/notifications/configure_personal_notifs.md b/docs/content/admin/notifications/configure_personal_notifs.md
similarity index 100%
rename from docs/content/en/customize_dojo/notifications/configure_personal_notifs.md
rename to docs/content/admin/notifications/configure_personal_notifs.md
diff --git a/docs/content/en/customize_dojo/notifications/configure_system_notifs.md b/docs/content/admin/notifications/configure_system_notifs.md
similarity index 100%
rename from docs/content/en/customize_dojo/notifications/configure_system_notifs.md
rename to docs/content/admin/notifications/configure_system_notifs.md
diff --git a/docs/content/en/customize_dojo/notifications/email_slack_teams.md b/docs/content/admin/notifications/email_slack_teams.md
similarity index 100%
rename from docs/content/en/customize_dojo/notifications/email_slack_teams.md
rename to docs/content/admin/notifications/email_slack_teams.md
diff --git a/docs/content/en/customize_dojo/user_management/_index.md b/docs/content/admin/user_management/_index.md
similarity index 93%
rename from docs/content/en/customize_dojo/user_management/_index.md
rename to docs/content/admin/user_management/_index.md
index d7ef4c307e1..e35cf318f4b 100644
--- a/docs/content/en/customize_dojo/user_management/_index.md
+++ b/docs/content/admin/user_management/_index.md
@@ -7,8 +7,6 @@ lastmod: 2023-09-07T16:06:50+02:00
draft: false
weight: 5
chapter: true
-sidebar:
- collapsed: true
seo:
title: "" # custom title (optional)
description: "" # custom description (recommended)
diff --git a/docs/content/en/customize_dojo/user_management/about_perms_and_roles.md b/docs/content/admin/user_management/about_perms_and_roles.md
similarity index 100%
rename from docs/content/en/customize_dojo/user_management/about_perms_and_roles.md
rename to docs/content/admin/user_management/about_perms_and_roles.md
diff --git a/docs/content/en/customize_dojo/user_management/audit_logging.md b/docs/content/admin/user_management/audit_logging.md
similarity index 100%
rename from docs/content/en/customize_dojo/user_management/audit_logging.md
rename to docs/content/admin/user_management/audit_logging.md
diff --git a/docs/content/en/customize_dojo/user_management/configure_sso.md b/docs/content/admin/user_management/configure_sso.md
similarity index 98%
rename from docs/content/en/customize_dojo/user_management/configure_sso.md
rename to docs/content/admin/user_management/configure_sso.md
index e86eb3fb1f5..67d804d6e7d 100644
--- a/docs/content/en/customize_dojo/user_management/configure_sso.md
+++ b/docs/content/admin/user_management/configure_sso.md
@@ -16,7 +16,7 @@ Users can connect to DefectDojo with a Username and Password, but if you prefer,
All of these methods can only be configured by a Superuser in DefectDojo. DefectDojo Pro users can quickly set up SSO through their system settings, while Open Source users will need to configure these settings on the back-end by setting an environment variable within Docker. This article covers both methods of configuration.
-**NOTE: DefectDojo Pro users will all need to add the IP addresses of SAML or SSO services to their Firewall whitelist. See [Firewall Rules](/en/cloud_management/using-cloud-manager/#changing-your-firewall-settings) for more information.**
+**NOTE: DefectDojo Pro users will all need to add the IP addresses of SAML or SSO services to their Firewall whitelist. See [Firewall Rules](/get_started/pro/cloud/using-cloud-manager/#changing-your-firewall-settings) for more information.**
## Disable username / password use
You may wish to disable traditional username/password login on your instance.
@@ -70,7 +70,7 @@ Both DefectDojo Pro
### Open-Source
-Open-Source users will need to map these variables in the local_settings.py file. (see [Configuration](/en/open_source/installation/configuration/)).
+Open-Source users will need to map these variables in the local_settings.py file. (see [Configuration](/get_started/open_source/configuration/)).
1. Fill out the variables as follows:
{{< highlight python >}}
@@ -143,7 +143,7 @@ When a user is removed from a given group in Azure AD, they will also be removed
### Open-Source
-Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/en/open_source/installation/configuration)).
+Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/get_started/open_source/configuration)).
1. Set the following environment variables
@@ -215,7 +215,7 @@ Both DefectDojo Pro
### Open-Source
-Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/en/open_source/installation/configuration)).
+Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/get_started/open_source/configuration)).
1. Set the following environment variables
{{< highlight python >}}
@@ -261,7 +261,7 @@ Follow along below.
### Open-Source
-Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/en/open_source/installation/configuration)).
+Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/get_started/open_source/configuration)).
1. Set the following environment variables
{{< highlight python >}}
@@ -323,7 +323,7 @@ In order to use Google Authentication, a Google Authentication Server will need
### Open-Source
-Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/en/open_source/installation/configuration)).
+Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/get_started/open_source/configuration)).
1. Set the following environment variables
@@ -407,7 +407,7 @@ This guide assumes you already have a KeyCloak Realm set up. If not, you will n
### Open-Source
-Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/en/open_source/installation/configuration)).
+Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/get_started/open_source/configuration)).
1. Set the following environment variables
@@ -495,7 +495,7 @@ Both DefectDojo Pro
### Open-Source
-Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/en/open_source/installation/configuration)).
+Open-Source users will need to set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/get_started/open_source/configuration)).
1. Set the following environment variables
@@ -621,7 +621,7 @@ The left side of the ‘=’ sign represents the attribute you want to map from
### Open-Source SAML
1. Navigate to your SAML IdP and find your metadata.
-2. Set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/en/open_source/installation/configuration)).
+2. Set these variables as an environment variable, or without the `DD_` prefix in the `local_settings.py` file. (see [Configuration](/get_started/open_source/configuration)).
{{< highlight python >}}
DD_SAML2_ENABLED=(bool, **True**),
diff --git a/docs/content/en/customize_dojo/user_management/create_user_group.md b/docs/content/admin/user_management/create_user_group.md
similarity index 100%
rename from docs/content/en/customize_dojo/user_management/create_user_group.md
rename to docs/content/admin/user_management/create_user_group.md
diff --git a/docs/content/admin/user_management/pro_permissions_overhaul.md b/docs/content/admin/user_management/pro_permissions_overhaul.md
new file mode 100644
index 00000000000..ba174ac7eee
--- /dev/null
+++ b/docs/content/admin/user_management/pro_permissions_overhaul.md
@@ -0,0 +1,52 @@
+---
+title: "Set Permissions in Pro"
+description: "Overhaul, pro feature"
+weight: 3
+audience: pro
+---
+
+## Introduction to Permission Types
+
+Individual users have four different kinds of permission that they can be assigned:
+
+* Users can be assigned as **Members to Products or Product Types**. This allows them to view and interact with Data Types (Product Types, Products, Engagements, Tests and Findings) in DefectDojo depending on the role they are assigned on the specific Product. Users can have multiple Product or Product Type memberships, with different levels of access.
+
+* Users can also have **Configuration Permissions** assigned, which allow them to access configuration pages in DefectDojo. Configuration Permissions are not related to Products or Product Types.
+
+* Users can be assigned **Global Roles**, which give them a standardized level of access to all Products and Product Types.
+
+* Users can be set up as **Superusers**: administrator level roles which give them control and access to all DefectDojo data and configuration.
+
+You can also create Groups if you want to assign Product Membership, Configuration Permissions or Global Roles to a group of users at the same time. If you have a large number of users in DefectDojo, such as a dedicated testing team for a particular Product, Groups may be a more helpful feature.
+
+## Superusers \& Global Roles
+
+Part of your Role\-Based Access Control (RBAC) configuration may require you to create additional Superusers, or users with Global Roles.
+
+* Superusers (Admins) have no limitations in the system. They can change all settings, manage users and have read / write access to all data. They can also change access rules for all users in DefectDojo. Superusers will also receive notifications for all system issues and alerts.
+* Users with Global Roles can view and interact with any Data Type (Product Types, Products, Engagements, Tests and Findings) in DefectDojo depending on their assigned Role. For more information about each Role and associated privileges, please refer to our Introduction to Roles article.
+* Users can also have specific Configuration Permissions assigned, allowing them to access certain DefectDojo configuration pages. Users have no Configuration Permissions by default.
+
+By default, the first account created on a new DefectDojo instance will have Superuser permissions. That user will be able to edit permissions for all subsequent DefectDojo users. Only an existing Superuser can add another superuser, or add a Global Role to a user.
+
+Permissions in DefectDojo Pro have been simplified, to make it easier to assign object access. This feature can be accessed through the [Pro UI](/get_started/about/ui_pro_vs_os/).
+
+### Opening the Permissions window
+
+
+
+When looking at Product Type or Product, you can open the Permissions window to set permissions quickly. This menu can be found in a Table by clicking the horizontal dots **"⋮"**. IF looking at an individual **Product** or **Product Type** page, this menu can be found under the blue gear ‘⚙️’.
+
+## Setting Permissions through the permissions window
+
+
+
+1. At the top of this window, you can choose to manage permissions for an individual user or for a [user group](../create_user_group).
+2. Here, you can select a user or group to add to the Product, and select the [Role](../about_perms_and_roles) that you want that user to have.
+3. On the lower table, you can see a list of all users or groups who have access to this object. You can also quickly assign a new role for one of these users or groups from the drop-down menu.
+
+## Setting Configuration Permissions through the User view
+
+A user's configuration permissions can now be set in a more user-friendly approach. From the Users View, all configuration permissions are displayed in a dropdown, then grouped by the permission type. If the selection of configuration permissions is different from their current value, an “Update Configuration Permissions” button is displayed. When clicked, the user will be asked to confirm they would like to update the permissions for the selected group before an update is made.
+
+
diff --git a/docs/content/en/customize_dojo/user_management/set_user_permissions.md b/docs/content/admin/user_management/set_user_permissions.md
similarity index 97%
rename from docs/content/en/customize_dojo/user_management/set_user_permissions.md
rename to docs/content/admin/user_management/set_user_permissions.md
index 4c81d381913..538cde02d26 100644
--- a/docs/content/en/customize_dojo/user_management/set_user_permissions.md
+++ b/docs/content/admin/user_management/set_user_permissions.md
@@ -2,6 +2,7 @@
title: "Set a User's permissions"
description: "How to grant Roles & Permissions to a user, as well as superuser status"
weight: 2
+audience: opensource
---
## Introduction to Permission Types
@@ -42,7 +43,7 @@ By default, the first account created on a new DefectDojo instance will have Sup
4. From the Edit User page:
-For Superuser Status, check off the ☑️Superuser Status box, located in the user's Default Information.
+For Superuser Status, check off the ☑️ Superuser Status box, located in the user's Default Information.
To assign a Global Role, select one from the dropdown Global Role menu at the bottom of the page.
@@ -118,7 +119,7 @@ Configuration Permissions are not related to a specific Product or Product Type
* **Finding Templates:** Access to the Findings \> Finding Templates page
* **Groups**: Access the 👤Users \> Groups page
* **Jira Instances:** Access the ⚙️Configuration \> JIRA page
-* **Language Types**:Access the [Language Types](/en/open_source/languages/) API endpoint
+* **Language Types**:Access the [Language Types](/open_source/languages/) API endpoint
* **Login Banner**: Edit the ⚙️Configuration \> Login Banner page
* **Announcements**: Access ⚙️Configuration \> Announcements
* **Note Types:** Access the ⚙️Configuration \> Note Types page
diff --git a/docs/content/en/customize_dojo/user_management/user_permission_chart.md b/docs/content/admin/user_management/user_permission_chart.md
similarity index 100%
rename from docs/content/en/customize_dojo/user_management/user_permission_chart.md
rename to docs/content/admin/user_management/user_permission_chart.md
diff --git a/docs/content/en/working_with_findings/_index.md b/docs/content/asset_modelling/_index.md
similarity index 74%
rename from docs/content/en/working_with_findings/_index.md
rename to docs/content/asset_modelling/_index.md
index cd8d34e560c..850ae7f8369 100644
--- a/docs/content/en/working_with_findings/_index.md
+++ b/docs/content/asset_modelling/_index.md
@@ -1,5 +1,5 @@
---
-title: "🚩 Work With Findings"
+title: "Organize DefectDojo"
date: 2021-02-02T20:46:29+01:00
draft: false
type: docs
diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/_index.md b/docs/content/asset_modelling/engagements_tests/_index.md
similarity index 53%
rename from docs/content/en/working_with_findings/organizing_engagements_tests/_index.md
rename to docs/content/asset_modelling/engagements_tests/_index.md
index d1823bda407..a61b559371c 100644
--- a/docs/content/en/working_with_findings/organizing_engagements_tests/_index.md
+++ b/docs/content/asset_modelling/engagements_tests/_index.md
@@ -1,10 +1,8 @@
---
-title: "Organizing Data"
+title: "Engagements & Tests"
date: 2021-02-02T20:46:29+01:00
draft: false
-weight: 4
type: docs
-sidebar:
- collapsed: false
+weight: 1
exclude_search: true
---
diff --git a/docs/content/en/working_with_findings/sla_configuration.md b/docs/content/asset_modelling/hierarchy/OS__sla_configuration.md
similarity index 79%
rename from docs/content/en/working_with_findings/sla_configuration.md
rename to docs/content/asset_modelling/hierarchy/OS__sla_configuration.md
index 3a9bc1e0781..5dc7957adb5 100644
--- a/docs/content/en/working_with_findings/sla_configuration.md
+++ b/docs/content/asset_modelling/hierarchy/OS__sla_configuration.md
@@ -2,11 +2,12 @@
title: "SLA Configuration"
description: "Configure Service Level Agreements for different Products"
weight: 2
+audience: opensource
---
Each Product in DefectDojo can have its own Service Level Agreement (SLA) configuration, which represents the days your organization has to remediate or otherwise manage a Finding.
-SLA can be set based on either **[Finding Severity](/en/working_with_findings/organizing_engagements_tests/product_hierarchy/#findings)** or **[Finding Risk](/en/working_with_findings/finding_priority/)** (in DefectDojo Pro).
+SLA can be set based on either **[Finding Severity](/asset_modelling/hierarchy/product_hierarchy/#findings)** or **[Finding Risk](/asset_modelling/hierarchy/pro__priority_sla/)** (in DefectDojo Pro).

@@ -17,9 +18,9 @@ SLAs apply a countdown of days to a Finding based on the day that the Finding wa
You can use SLAs as a way to represent your organizations remediation policies. You can also use them as a way to prioritize the longest-active, most critical Findings in your DefectDojo instance.
* You can sort or filter Finding tables by SLA days.
-* SLA violations can be configured to trigger [Notifications](/en/customize_dojo/notifications/about_notifications/) to DefectDojo users assigned to the related Product.
-* In **DefectDojo Pro**, SLA performance is also tracked on the [Executive Insights and Remediation](/en/customize_dojo/dashboards/pro_dashboards/) Metrics Dashboards.
-* SLA compliance can also be used to create custom [Dashboard Tiles](/en/customize_dojo/dashboards/about_custom_dashboard_tiles/#sla-violation-tile) in **DefectDojo Pro**.
+* SLA violations can be configured to trigger [Notifications](/admin/notifications/about_notifications/) to DefectDojo users assigned to the related Product.
+* In **DefectDojo Pro**, SLA performance is also tracked on the [Executive Insights and Remediation](/metrics_reports/pro_metrics/pro__overview/) Metrics Dashboards.
+* SLA compliance can also be used to create custom [Dashboard Tiles](/metrics_reports/dashboards/about_custom_dashboard_tiles/#sla-violation-tile) in **DefectDojo Pro**.
### Mitigated Within SLA status
@@ -41,7 +42,7 @@ In DefectDojo Pro, one or more SLA Configurations are managed under the **Config

-SLA Configurations can only be edited by Superusers or by a user with the corresponding [Configuration Permission](/en/customize_dojo/user_management/user_permission_chart/#configuration-permission-chart).
+SLA Configurations can only be edited by Superusers or by a user with the corresponding [Configuration Permission](/admin/user_management/user_permission_chart/#configuration-permission-chart).
### Configuring SLA
@@ -71,6 +72,6 @@ Once a new SLA has been selected for a Product, all of the associated Findings'
## Notes on SLAs
-* SLAs can be optionally restarted once a [Risk Accepted](/en/working_with_findings/findings_workflows/risk_acceptances/) Finding reactivates. This is set when creating the Risk Acceptance by setting the **Restart SLA Expired** field.
+* SLAs can be optionally restarted once a [Risk Accepted](/triage_findings/findings_workflows/risk_acceptances/) Finding reactivates. This is set when creating the Risk Acceptance by setting the **Restart SLA Expired** field.
* Reimporting a Finding does not restart the SLA - SLAs are always calculated from when a Finding was first detected unless **Restart SLA on Finding Reactivation** is enabled.
* Risk Acceptance expiry or reactivation of a Closed Finding are the only ways to reset or recalculate an SLA for a Finding once it is created (without changing the Product's SLA configuration).
diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/source-code-repositories.md b/docs/content/asset_modelling/hierarchy/OS__source-code-repositories.md
similarity index 98%
rename from docs/content/en/working_with_findings/organizing_engagements_tests/source-code-repositories.md
rename to docs/content/asset_modelling/hierarchy/OS__source-code-repositories.md
index c1d9766e456..dfd25c66c6b 100644
--- a/docs/content/en/working_with_findings/organizing_engagements_tests/source-code-repositories.md
+++ b/docs/content/asset_modelling/hierarchy/OS__source-code-repositories.md
@@ -1,8 +1,9 @@
---
title: "Link Findings to source code"
-description: "Integration of repositories to navigate to the locaction of findings in the source code."
+description: "Integration of repositories to navigate to the location of findings in the source code."
draft: false
weight: 5
+audience: opensource
---
Certain tools (particularly SAST tools) will include the associated file name and line number in vulnerability data. If the repository of the source code is specified in the Engagement, DefectDojo will present the filepath as a link and the user can navigate directly to the location of the vulnerability.
diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/pro_assets_organizations.md b/docs/content/asset_modelling/hierarchy/PRO__assets_organizations.md
similarity index 94%
rename from docs/content/en/working_with_findings/organizing_engagements_tests/pro_assets_organizations.md
rename to docs/content/asset_modelling/hierarchy/PRO__assets_organizations.md
index 877097c74d1..65c56d584b5 100644
--- a/docs/content/en/working_with_findings/organizing_engagements_tests/pro_assets_organizations.md
+++ b/docs/content/asset_modelling/hierarchy/PRO__assets_organizations.md
@@ -1,6 +1,8 @@
---
-title: "⚠️ Assets and Organizations (Pro)"
+title: "Assets and Organization structure"
description: "DefectDojo Pro - Product Hierarchy Overhaul"
+audience: pro
+weight: 1
---
DefectDojo Pro is extending the Product/Product Type object classes to provide greater flexibility with the data model.
@@ -62,7 +64,7 @@ Core Application [Organization]
└── nginx
```
-In this diagram, every element under "Core Application" could be recorded as a separate Asset, with unique business criticality (see: [Priority & Risk](/en/working_with_findings/priority_adjustments/)), RBAC, and corresponding Engagements and Tests. You could continue to test, and store results, on the parent Asset (for example, `webapp-backend`), but you could also run isolated testing on a particular child Asset (for example, `database`).
+In this diagram, every element under "Core Application" could be recorded as a separate Asset, with unique business criticality (see: [Priority & Risk](/asset_modelling/hierarchy/pro__priority_sla/#prioritization-engines/)), RBAC, and corresponding Engagements and Tests. You could continue to test, and store results, on the parent Asset (for example, `webapp-backend`), but you could also run isolated testing on a particular child Asset (for example, `database`).
### Pen Tests: Isolated RBAC
diff --git a/docs/content/asset_modelling/hierarchy/PRO__priority_sla.md b/docs/content/asset_modelling/hierarchy/PRO__priority_sla.md
new file mode 100644
index 00000000000..75abb100e54
--- /dev/null
+++ b/docs/content/asset_modelling/hierarchy/PRO__priority_sla.md
@@ -0,0 +1,264 @@
+---
+title: "Assign Priority, Risk and SLAs"
+description: "How DefectDojo ranks your Findings"
+weight: 1
+audience: pro
+---
+
+
+
+Effective risk-based vulnerability management requires an approach that considers
+both business context and technical exploitability. Using DefectDojo Pro’s Priority and Risk feature, users can automatically sort Findings into a meaningful context, ensuring
+high-impact vulnerabilities can be addressed first.
+
+**Priority** is a calculated numerical rank applied to all Findings in your DefectDojo
+instance. It allows you to quickly understand vulnerabilities in context, especially within
+large organizations that are overseeing security needs for many Findings and/or
+Products.
+
+**Risk** is a 4-level ranking system which factors in a Finding’s exploitability to a greater
+degree. This is meant as a less granular, more ’executive-level’ version of Priority.
+
+
+
+Priority and Risk values can be used with other filters to compare Findings in any context, such as:
+
+* within a single Product, Engagement or Test
+* globally in all DefectDojo Products
+* between a few specific Products
+
+Applying Finding Priority and Risk helps your team respond to the most relevant
+vulnerabilities in your organization, and also provides a framework to assist in
+compliance with regulatory standards.
+
+
+Learn more about Priority and Risk with DefectDojo Inc's May 2025 Office Hours:
+
+
+
+## How Priority & Risk are calculated
+The range of Priority values is from 0 to 1150. The higher the number, the more urgency
+the Finding is to triage or remediate.
+
+Similar to Severity, Risk is scored from Low -> Medium -> Needs Action -> Urgent. **Risk** considers Priority fields and may be different from a tool's reported Severity as a result.
+
+
+
+## Priority Fields: Product-Level
+
+Each Product in DefectDojo has metadata that tracks business criticality and risk
+factors. This metadata is used to help calculate Priority and Risk for any associated
+Findings.
+
+All of these metadata fields can be set on the **Edit Product** form for a given Product.
+
+
+
+* **Criticality** can be set to any value of None, Very Low, Low, Medium, High, or Very
+High. Criticality is a subjective field, so when assigning this field, consider how the
+Product compares to other Products in your organization.
+* **User Records** is a numerical estimation of user records in a database (or a system
+that can access that database).
+* **Revenue** is a numerical estimation of annual revenue for the Product. To calculate Priority, DefectDojo will calculate a percentage by comparing this Product's revenue to the sum of all Products within the Product Type.
+
+It is not possible to set a currency type in DefectDojo, so make sure that all of your Revenue
+estimations have the same currency denomination. (“50000” could mean $50,000
+US Dollars or ¥50,000 Japanese Yen - the denomination does not matter as long as
+all of your Products have revenue calculated in the same currency).
+* **External Audience** is a true/false value - set this to True if this Product can be
+accessed by an external audience. For example, customers, users, or anyone
+outside of your organization.
+* **Internet Accessible** is a true/false value. If this Product can connect to the open
+internet, you should set this value to True.
+
+Priority is a ‘relative’ calculation, which is meant to compare different Products within
+your DefectDojo instance. It is ultimately up to your organization to decide how these
+filters are set. These values should be as accurate as possible, but the primary goal is
+to highlight your key Products so that you can prioritize vulnerabilities according to your
+organization’s policies, so these fields do not necessarily need to be set perfectly.
+
+## Priority Fields: Finding-Level
+
+Findings within a Product can have additional metadata which can further adjust the Finding’s Priority and Risk level:
+
+* Whether or not the Finding has an EPSS score, this is automatically added to Findings and kept up to date for Pro users
+* How many Endpoints in the Product are affected by this Finding
+* Whether or not a Finding is Under Review
+* Whether the Finding is in the KEV (Known Exploited Vulnerabilities) database, which is checked by DefectDojo on a regular basis
+* The tool-reported Severity of a Finding (Info, Low, Medium, High, Critical)
+
+
+## Finding Risk Calculation
+
+
+
+The Risk column on a Findings table is another way to quickly prioritize Findings. Risk is calculated using a Finding's Priority level, but also factors in a Finding's exploitability to a greater degree. This is meant as a less granular, more 'executive-level' version of Priority.
+
+The four assignable Risk levels are:
+
+
+
+A Finding's EPSS / exploitability is much more emphasized in the Risk calculation. As a result, a Finding can have both a high priority and a low risk value.
+
+As with Finding Priority, the Risk calculation cannot currently be adjusted.
+
+## Priority Insights Dashboard
+
+Users can take an executive-level view of Priority and Risk in their environment using
+the Priority Insights Dashboard (Metrics > Priority Insights in the sidebar)
+
+
+
+This dashboard can be filtered to include specific Products or date ranges. As with
+other Pro dashboards, this dashboard can be exported from DefectDojo as a PDF to
+quickly produce a report.
+
+## Setting Priority & Risk for Regulatory Compliance
+
+This is a non-exhaustive list of regulatory standards that specifically require
+vulnerability prioritization methods:
+
+* [SOX (Sarbanes-Oxley Act](https://www.sarbanes-oxley-act.com/)) compliance requires revenue-based prioritization for
+systems impacting financial data. In DefectDojo, a system’s revenue can be entered
+at the Product level.
+* [PCI DSS](https://www.pcisecuritystandards.org/standards/pci-dss/) compliance requires prioritization based on risk ratings and criticality to
+cardholder data environments. Business Criticality and External Audience can be
+set at the Product level, while DefectDojo’s Finding-level EPSS sync supports PCI’s
+risk-based approach.
+* [NIST SP 800-40](https://csrc.nist.gov/pubs/sp/800/40/r4/final) is a preventative maintenance guide which specifically calls for
+vulnerability prioritization based on business impact, product criticality and
+internet accessibility factors. All of these can be set at DefectDojo’s Product level.
+* [ISO 27001/27002](https://www.iso.org/standard/27001) Control A.12.6.1 compliance requires management of technical
+vulnerabilities with Priority based on risk assessment.
+* [GDPR Article 32](https://gdpr-info.eu/art-32-gdpr/) requires risk-based security measures - user records and external
+audience flags at the Product level can help prioritize systems in your organization
+that process personal data.
+* [FISMA/FedRAMP](https://help.fedramp.gov/hc/en-us) compliance require continuous monitoring and risk-based vulnerability remediation.
+
+DefectDojo Pro's Priority and Risk calculations can be adjusted, allowing you to tailor DefectDojo Pro to match your internal standards for Finding Priority and Risk.
+
+## Prioritization Engines
+
+Similar to SLA configurations, Prioritization Engines allow you to set the rules governing how Priority and Risk are calculated.
+
+
+
+DefectDojo comes with a built-in Prioritization Engine, which is applied to all Products. However, you can edit this Prioritization Engine to change the weighting of **Finding** and **Product** multipliers, which will adjust how Finding Priority and Risk are assigned.
+
+### Finding Multipliers
+
+Eight contextual factors impact the Priority score of a Finding. Three of these are Finding-specific, and the other five are assigned based on the Product that holds the Finding.
+
+You can tune your Prioritization Engine by adjusting how these factors are applied to the final calculation.
+
+
+
+Select a factor by clicking the button, and adjust this slider allows you to control the percentage a particular factor is applied. As you adjust the slider, you'll see the Risk thresholds change as a result.
+
+#### Finding-Level Multipliers
+
+* **Severity** - a Finding's Severity level
+* **Exploitability** - a Finding's KEV and/or EPSS score
+* **Endpoints** - the amount of Endpoints associated with a Finding
+
+#### Product-Level Multipliers
+
+* **Business Criticality** - the related Product's Business Criticality (None, Very Low, Low, Medium, High, or Very
+High)
+* **User Records** - the related Product's User Records count
+* **Revenue** - the related Product's revenue, relative to the total revenue of the Product Type
+* **External Audience** - whether or not the related Product has an external audience
+* **Internet Accessible** - whether or not the related Product is internet accessible
+
+### Risk Thresholds
+
+Based on the tuning of the Priority Engine, DefectDojo will automatically recommend Risk Thresholds. However, these thresholds can be adjusted as well and set to whatever values you deem appropriate.
+
+
+
+## Creating New Prioritization Engines
+
+You can use multiple Prioritization Engines, which can each be assigned to different Products.
+
+
+
+Creating a new Prioritization Engine will open the Prioritization Engine form. Once this form is submitted, a new Prioritization Engine will be added to the table.
+
+## Assigning Prioritization Engines to Products
+
+Each Product can have a Prioritization Engine currently in use via the **Edit Product** form for a given Product.
+
+
+
+Note that when a Product's Prioritization Engine is changed, or a Prioritization Engine is updated, the Product's Prioritization Engine or the Prioritization Engine itself will be "Locked" until the prioritization calculation has completed.
+
+Each Product in DefectDojo can have its own Service Level Agreement (SLA) configuration, which represents the days your organization has to remediate or otherwise manage a Finding.
+
+SLA can be set based on either **[Finding Severity](/asset_modelling/hierarchy/product_hierarchy/#findings)** or **[Finding Risk](/asset_modelling/hierarchy/pro__priority_sla/)** (in DefectDojo Pro).
+
+
+
+SLAs apply a countdown of days to a Finding based on the day that the Finding was created in DefectDojo. If a Finding is not Closed within the countdown, the Finding will be labeled as in breach of SLA.
+
+## Working with SLAs
+
+You can use SLAs as a way to represent your organizations remediation policies. You can also use them as a way to prioritize the longest-active, most critical Findings in your DefectDojo instance.
+
+* You can sort or filter Finding tables by SLA days.
+* SLA violations can be configured to trigger [Notifications](/admin/notifications/about_notifications/) to DefectDojo users assigned to the related Product.
+* In **DefectDojo Pro**, SLA performance is also tracked on the [Executive Insights and Remediation](/metrics_reports/pro_metrics/pro__overview/) Metrics Dashboards.
+* SLA compliance can also be used to create custom [Dashboard Tiles](/metrics_reports/dashboards/about_custom_dashboard_tiles/#sla-violation-tile) in **DefectDojo Pro**.
+
+### Mitigated Within SLA status
+
+If a Finding is successfully Mitigated by the SLA deadline, the Finding will record a ✅ green check mark in the Mitigated Within SLA column.
+
+
+
+If a Finding was Mitigated, but not before the SLA was violated, the Finding will record a ❌ red X in the Mitigated Within SLA column.
+
+### Breaching SLAs
+
+When an SLA for a given Finding is violated (the Finding is not Closed within the SLA timeline) the ✅ green check will switch to a ❌ red X. The SLA will continue to be tracked with a negative number, to represent how many days the SLA has been breached by.
+
+
+
+## Managing SLA Configurations (Pro)
+
+In DefectDojo Pro, one or more SLA Configurations are managed under the **Configuration > Service Level Agreements** part of the sidebar. You can create a **New Service Level Agreement** or work with existing SLA configurations from the **All Service Level Agreements** page.
+
+
+
+SLA Configurations can only be edited by Superusers or by a user with the corresponding [Configuration Permission](/admin/user_management/user_permission_chart/#configuration-permission-chart).
+
+### Configuring SLA
+
+SLA configurations contain the days assigned to each **Severity** or **Risk** value of DefectDojo.
+
+
+
+Each Service Level Agreement can have a unique name, along with an optional description.
+
+**Restart SLA on Finding Reactivation**: if enabled, this option will start an SLA over when a Finding is Reopened. Otherwise, the SLA will be based on when the Finding was created.
+
+When editing an SLA, you can choose whether that SLA will use **Severity** or **Risk** as a benchmark for assigning Days To Remediate. This is done by selecting the related option from the **Service Level configuration Type** section of the form.
+
+From here, you can set the number of days allowed for each **Severity** or **Risk** level. You can also selectively enforce SLAs; by unchecking the **Enforce ___ Finding Days** you can ignore SLA calculation for those levels of Severity or Risk.
+
+## Apply an SLA Configuration to a Product (Pro)
+
+Newly created Products in DefectDojo will always apply the **Default SLA Configuration**, which can be set to different values if you wish.
+
+If you have SLA configurations, you can choose which of these is applied to your Product from the **Edit Product** form.
+
+
+
+### SLA Recalculation
+
+Once a new SLA has been selected for a Product, all of the associated Findings' SLAs will need to be recalculated by DefectDojo. While this process is running, a Product's SLA cannot be changed.
+
+## Notes on SLAs
+
+* SLAs can be optionally restarted once a [Risk Accepted](/triage_findings/findings_workflows/risk_acceptances/) Finding reactivates. This is set when creating the Risk Acceptance by setting the **Restart SLA Expired** field.
+* Reimporting a Finding does not restart the SLA - SLAs are always calculated from when a Finding was first detected unless **Restart SLA on Finding Reactivation** is enabled.
+* Risk Acceptance expiry or reactivation of a Closed Finding are the only ways to reset or recalculate an SLA for a Finding once it is created (without changing the Product's SLA configuration).
diff --git a/docs/content/en/working_with_findings/finding_deduplication/_index.md b/docs/content/asset_modelling/hierarchy/_index.md
similarity index 63%
rename from docs/content/en/working_with_findings/finding_deduplication/_index.md
rename to docs/content/asset_modelling/hierarchy/_index.md
index 4a35b777b6a..8a33bb5eda6 100644
--- a/docs/content/en/working_with_findings/finding_deduplication/_index.md
+++ b/docs/content/asset_modelling/hierarchy/_index.md
@@ -1,10 +1,10 @@
---
-title: "Finding Deduplication"
+title: "Asset Hierarchy"
date: 2021-02-02T20:46:29+01:00
draft: false
type: docs
weight: 3
sidebar:
- collapsed: true
+ collapsed: false
exclude_search: true
---
diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/product_health_grade.md b/docs/content/asset_modelling/hierarchy/product_health_grade.md
similarity index 100%
rename from docs/content/en/working_with_findings/organizing_engagements_tests/product_health_grade.md
rename to docs/content/asset_modelling/hierarchy/product_health_grade.md
diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/product_hierarchy.md b/docs/content/asset_modelling/hierarchy/product_hierarchy.md
similarity index 99%
rename from docs/content/en/working_with_findings/organizing_engagements_tests/product_hierarchy.md
rename to docs/content/asset_modelling/hierarchy/product_hierarchy.md
index 093ba1d90e0..77458d98df1 100644
--- a/docs/content/en/working_with_findings/organizing_engagements_tests/product_hierarchy.md
+++ b/docs/content/asset_modelling/hierarchy/product_hierarchy.md
@@ -2,6 +2,7 @@
title: "Product Hierarchy: Overview"
description: "Understand Product Types, Products, Engagements, Tests and Findings"
weight: 1
+audience: opensource
---
DefectDojo uses five main data classes to organize your work: **Product Types, Products**, **Engagements**, **Tests**, and **Findings**.
diff --git a/docs/content/asset_modelling/tags/OS__tagging_objects.md b/docs/content/asset_modelling/tags/OS__tagging_objects.md
new file mode 100644
index 00000000000..e9f5f7fcfb3
--- /dev/null
+++ b/docs/content/asset_modelling/tags/OS__tagging_objects.md
@@ -0,0 +1,149 @@
+---
+title: "Tagging Objects"
+description: "Use Tags to create a new slice of your data model"
+draft: false
+weight: 2
+exclude_search: false
+audience: opensource
+---
+
+Tags are ideal for grouping objects in a manner that can be filtered out into smaller, more digestible chunks. They can be used to denote status, or to create custom sets of Product Type, Products, Engagements or Findings across the data model.
+
+In DefectDojo, tags are a first class citizen and are recognized as the facilitators
+of organization within each level of the data model.
+
+Here is an example with a Product with two tags and four findings each with a single tag:
+
+
+
+### Tag Formats
+
+Tags can be formatted in any of the following ways:
+- StringWithNoSpaces
+- string-with-hyphens
+- string_with_underscores
+- colons:acceptable
+
+## Tag Management
+
+### Adding and Removing
+
+Tags can be managed in the following ways:
+
+1. Creating or Editing new objects
+
+ When a new object is created or edited through the UI or API, there is a field for specifying
+ the tags to be set on a given object. This field is a multiselect field that also has
+ auto completion to make searching and adding existing tags a breeze. Here is what the field
+ looks like on the Product from the screenshot in the previous section:
+
+ 
+
+2. Import and Reimport
+
+ Tags can also be applied to a given test at the time of import or reimport. This is a very
+ handy use case when importing via the API with automation as it provides an opportunity to
+ append automation run details and tool information that may not be captured in the test
+ or finding object directly.
+
+ The field looks and behaves exactly as it does on a given object
+
+3. Bulk Edit Menu (Findings only)
+
+ When needing to update many Findings with the same set of tags, the bulk edit menu can be
+ used to ease the burden.
+
+ In the following example, lets say I want to update the tags of the two findings with the tag "tag-group-alpha" to be a new tag list like this ["tag-group-charlie", "tag-group-delta"].
+ First I would select the tags to be updated:
+
+ 
+
+ Once a finding is selected, a new button appears with the name "Bulk Edit". Clicking this button
+ produces a dropdown menu with many options, but the focus is just on tags for now. Update the
+ field to have the desired tag list as follows, and click submit
+
+ 
+
+ The tags on the selected Findings will be updated to whatever was specified in the tags field
+ within the bulk edit menu
+
+ 
+
+## Tag Inheritance
+
+When Tag Inheritance is enabled, tags applied to a given Product will automatically be applied to all objects under Products in the [Product Hierarchy](/asset_modelling/hierarchy/product_hierarchy/).
+
+### Configuration
+
+Tag Inheritance can be enabled at the following scope levels:
+- Global Scope
+ - Every Product system wide will begin applying tags to all children objects (Engagements, Tests and Findings)
+ - This is set within the System Settings
+- Product Scope
+ - Only the selected Product will begin applying tags to all children objects (Engagements, Tests and Findings)
+ - This is set at the Product creation/edit page
+
+### Behaviors
+
+When Tag Inheritance is enabled, standard Tags can be added to and removed from objects in the standard way.
+However inherited tags cannot be removed from a child object without removing them from the parent object
+See the following example of adding a tag "test_only_tag" to the Test object and a tag "engagement_only_tag" to the Engagement.
+
+
+
+When updates are made to the tag list on a Product, the same changes are made to all objects within the Product asynchronously. The duration of this task directly correlates to the number the objects contained within a finding.
+
+**Open-Source:** If Tag changes are not observed within a reasonable time period, consult the celery worker logs to identify where any problems might have arisen.
+
+
+### Filtering for Tags (Classic UI)
+
+Tags can be filtered in many ways through both the UI and the API. For example, here is a snippet
+of the Finding filters:
+
+
+
+There are ten fields related to tags:
+
+ - Tags: filter on any tags that are attached to a given Finding
+ - Examples:
+ - Finding will be returned
+ - Finding Tags: ["A", "B", "C"]
+ - Filter Query: "B"
+ - Finding Will *not* be returned
+ - Finding Tags: ["A", "B", "C"]
+ - Filter Query: "F"
+ - Not Tags: filter on any tags that are *not* attached to a given Finding
+ - Examples:
+ - Finding will be returned
+ - Finding Tags: ["A", "B", "C"]
+ - Filter Query: "F"
+ - Finding Will *not* be returned
+ - Finding Tags: ["A", "B", "C"]
+ - Filter Query: "B"
+ - Tag Name Contains: filter on any tags that contain part or all of the query in the given Finding
+ - Examples:
+ - Finding will be returned
+ - Finding Tags: ["Alpha", "Beta", "Charlie"]
+ - Filter Query: "et" (part of "Beta")
+ - Finding Will *not* be returned
+ - Finding Tags: ["Alpha", "Beta", "Charlie"]
+ - Filter Query: "meg" (part of "Omega")
+ - Not Tags: filter on any tags that do *not* contain part or all of the query in the given Finding
+ - Examples:
+ - Finding will be returned
+ - Finding Tags: ["Alpha", "Beta", "Charlie"]
+ - Filter Query: "meg" (part of "Omega")
+ - Finding Will *not* be returned
+ - Finding Tags: ["Alpha", "Beta", "Charlie"]
+ - Filter Query: "et" (part of "Beta")
+
+For the other six tag filters, they follow the same rules as "Tags" and "Not Tags" as above,
+but at different levels in the data model:
+
+ - Tags (Test): filter on any tags that are attached to the Test of a given Finding
+ - Not Tags (Test): filter on any tags that are *not* attached to the Test of a given Finding
+ - Tags (Engagement): filter on any tags that are attached to the Engagement of a given Finding
+ - Not Tags (Engagement): filter on any tags that are *not* attached to the Engagement of a given Finding
+ - Tags (Product): filter on any tags that are attached to the Product of a given Finding
+ - Not Tags (Product): filter on any tags that are *not* attached to the Product of a given Finding
diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/tagging_objects.md b/docs/content/asset_modelling/tags/PRO__tagging_objects copy.md
similarity index 95%
rename from docs/content/en/working_with_findings/organizing_engagements_tests/tagging_objects.md
rename to docs/content/asset_modelling/tags/PRO__tagging_objects copy.md
index d551f07de0b..cc729ee5141 100644
--- a/docs/content/en/working_with_findings/organizing_engagements_tests/tagging_objects.md
+++ b/docs/content/asset_modelling/tags/PRO__tagging_objects copy.md
@@ -1,15 +1,16 @@
---
-title: "Tags"
+title: "Tagging Objects"
description: "Use Tags to create a new slice of your data model"
draft: false
weight: 2
exclude_search: false
+audience: pro
---
Tags are ideal for grouping objects in a manner that can be filtered out into smaller, more digestible chunks. They can be used to denote status, or to create custom sets of Product Type, Products, Engagements or Findings across the data model.
In DefectDojo, tags are a first class citizen and are recognized as the facilitators
-of organization within each level of the [data model](../product_hierarchy).
+of organization within each level of the data model.
Here is an example with a Product with two tags and four findings each with a single tag:
@@ -48,8 +49,6 @@ Tags can be managed in the following ways:

- For more information, see our guide to [Bulk Editing Findings](/en/working_with_findings/findings_workflows/editing_findings/#bulk-edit-findings).
-
## Tag Management (Classic UI / OpenSource)
@@ -100,7 +99,7 @@ Tags can be managed in the following ways:
**Pro UI note: though Tag inheritance can be configured using the Pro UI, inherited Tags currently can only be accessed and filtered for through the Classic UI or the API.**
-When Tag Inheritance is enabled, tags applied to a given Product will automatically be applied to all objects under Products in the [Product Hierarchy](/en/working_with_findings/organizing_engagements_tests/Product_hierarchy).
+When Tag Inheritance is enabled, tags applied to a given Product will automatically be applied to all objects under Products in the [Product Hierarchy](/asset_modelling/hierarchy/product_hierarchy/).
### Configuration
diff --git a/docs/content/asset_modelling/tags/_index.md b/docs/content/asset_modelling/tags/_index.md
new file mode 100644
index 00000000000..9e85b155376
--- /dev/null
+++ b/docs/content/asset_modelling/tags/_index.md
@@ -0,0 +1,8 @@
+---
+title: "Tags"
+date: 2021-02-02T20:46:29+01:00
+draft: false
+type: docs
+weight: 1
+exclude_search: true
+---
diff --git a/docs/content/en/changelog/_index.md b/docs/content/automation/api/_index.md
similarity index 93%
rename from docs/content/en/changelog/_index.md
rename to docs/content/automation/api/_index.md
index e0913288e2e..c415210e8d4 100644
--- a/docs/content/en/changelog/_index.md
+++ b/docs/content/automation/api/_index.md
@@ -1,5 +1,5 @@
---
-title: "📝 Changelog"
+title: "Automation"
description: ""
summary: ""
date: 2023-09-07T16:06:50+02:00
diff --git a/docs/content/en/api/api-v2-docs.md b/docs/content/automation/api/api-v2-docs.md
similarity index 96%
rename from docs/content/en/api/api-v2-docs.md
rename to docs/content/automation/api/api-v2-docs.md
index 819138bf43a..df8ba8b6d70 100644
--- a/docs/content/en/api/api-v2-docs.md
+++ b/docs/content/automation/api/api-v2-docs.md
@@ -188,7 +188,7 @@ Some of the api wrappers contain quite a bit of logic to ease scanning and impor
## Import
Importing via the API is performed via the [import-scan](https://demo.defectdojo.org/api/v2/doc/) endpoint.
-As described in the [Product Hierarchy](/en/working_with_findings/organizing_engagements_tests/product_hierarchy), Test gets created inside an Engagement, inside a Product, inside a Product Type.
+As described in the [Product Hierarchy](/asset_modelling/hierarchy/product_hierarchy/), Test gets created inside an Engagement, inside a Product, inside a Product Type.
An import can be performed by specifying the names of these entities in the API request:
@@ -207,7 +207,7 @@ An import can be performed by specifying the names of these entities in the API
}
```
-When `auto_create_context` is `True`, the product, engagement, and environment will be created if needed. Make sure your user has sufficient [permissions](/en/customize_dojo/user_management/about_perms_and_roles/) to do this.
+When `auto_create_context` is `True`, the product, engagement, and environment will be created if needed. Make sure your user has sufficient [permissions](/admin/user_management/about_perms_and_roles/) to do this.
A classic way of importing a scan is by specifying the ID of the engagement instead:
@@ -243,7 +243,7 @@ A reimport can be performed by specifying the names of these entities in the API
}
```
-When `auto_create_context` is `True`, the Product Type, Product and Engagement will be created if they do not already exist. Make sure your user has sufficient [permissions](/en/customize_dojo/user_management/about_perms_and_roles/) to create a Product/Product Type.
+When `auto_create_context` is `True`, the Product Type, Product and Engagement will be created if they do not already exist. Make sure your user has sufficient [permissions](/admin/user_management/about_perms_and_roles/) to create a Product/Product Type.
When `do_not_reactivate` is `True`, the importing/reimporting will ignore uploaded active findings and not reactivate previously closed findings, while still creating new findings if there are new ones. You will get a note on the finding to explain that it was not reactivated for that reason.
diff --git a/docs/content/en/api/_index.md b/docs/content/automation/rules_engine/_index.md
similarity index 91%
rename from docs/content/en/api/_index.md
rename to docs/content/automation/rules_engine/_index.md
index c49a452ad0b..25a5b4b104f 100644
--- a/docs/content/en/api/_index.md
+++ b/docs/content/automation/rules_engine/_index.md
@@ -1,5 +1,5 @@
---
-title: "🤖 API Documentation"
+title: "Rules Engine"
description: ""
summary: ""
date: 2023-09-07T16:06:50+02:00
diff --git a/docs/content/en/customize_dojo/rules_engine.md b/docs/content/automation/rules_engine/about.md
similarity index 91%
rename from docs/content/en/customize_dojo/rules_engine.md
rename to docs/content/automation/rules_engine/about.md
index 22f156dd56c..86700c3853c 100644
--- a/docs/content/en/customize_dojo/rules_engine.md
+++ b/docs/content/automation/rules_engine/about.md
@@ -2,13 +2,14 @@
title: "Rules Engine Automation"
description: "Working with Rules Engine Automation"
weight: 1
+audience: pro
---
Note: Rules Engine is a DefectDojo Pro-only feature.
DefectDojo's Rules Engine allows you to build custom workflows and bulk actions to handle Findings and other objects. Rules Engine allows you to build automated actions that are triggered when an object matches a Rule.
-Rules Engine can only be accessed through the [Pro UI](/en/about_defectdojo/ui_pro_vs_os/).
+Rules Engine can only be accessed through the [Pro UI](/get_started/about/ui_pro_vs_os/).
Currently, Rules can only be created for Findings, however more object types will be supported in the future.
@@ -25,10 +26,10 @@ Each Rule can apply one or more of these changes to a Finding when it is trigger
* Create an Alert in DefectDojo with custom text
### Filter conditions
-Rules are automatically triggered when a Finding meets specific Filter conditions. For more information on Filters that can be used to create Rule Actions, see the [Filter Index](/en/working_with_findings/organizing_engagements_tests/filter_index/) page.
+Rules are automatically triggered when a Finding meets specific Filter conditions. For more information on Filters that can be used to create Rule Actions, see the [Filter Index](/navigation/pro__filter_index) page.
## Creating a New Rule
-Start this process from the New Rule page. In the [Pro UI](/en/about_defectdojo/ui_pro_vs_os/), under **Manage Category**, Expand the **Rules Engine** dropdown and click **+ New Rule**.
+Start this process from the New Rule page. In the [Pro UI](/get_started/about/ui_pro_vs_os/), under **Manage Category**, Expand the **Rules Engine** dropdown and click **+ New Rule**.

@@ -38,7 +39,7 @@ Enter a Label as the identifier for the new rule, and click Next.

### Step 2: Set trigger conditions with a Filter
-You will see an All Findings table. Using the All Findings Table, set the Filter conditions to filter the set of Findings that you want your rule to apply to. For more information on applying Filters to a table, see [our guide to the Pro UI](/en/about_defectdojo/ui_pro_vs_os/#navigational-changes).
+You will see an All Findings table. Using the All Findings Table, set the Filter conditions to filter the set of Findings that you want your rule to apply to. For more information on applying Filters to a table, see [our guide to the Pro UI](/get_started/about/ui_pro_vs_os/#navigational-changes).
The table will preview the list of existing Findings that you have filtered.
diff --git a/docs/content/en/open_source/upgrading/1.10.md b/docs/content/changelog/os_upgrading/1.10.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.10.md
rename to docs/content/changelog/os_upgrading/1.10.md
diff --git a/docs/content/en/open_source/upgrading/1.11.md b/docs/content/changelog/os_upgrading/1.11.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.11.md
rename to docs/content/changelog/os_upgrading/1.11.md
diff --git a/docs/content/en/open_source/upgrading/1.12.md b/docs/content/changelog/os_upgrading/1.12.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.12.md
rename to docs/content/changelog/os_upgrading/1.12.md
diff --git a/docs/content/en/open_source/upgrading/1.13.md b/docs/content/changelog/os_upgrading/1.13.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.13.md
rename to docs/content/changelog/os_upgrading/1.13.md
diff --git a/docs/content/en/open_source/upgrading/1.14.md b/docs/content/changelog/os_upgrading/1.14.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.14.md
rename to docs/content/changelog/os_upgrading/1.14.md
diff --git a/docs/content/en/open_source/upgrading/1.15.md b/docs/content/changelog/os_upgrading/1.15.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.15.md
rename to docs/content/changelog/os_upgrading/1.15.md
diff --git a/docs/content/en/open_source/upgrading/1.2.2.md b/docs/content/changelog/os_upgrading/1.2.2.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.2.2.md
rename to docs/content/changelog/os_upgrading/1.2.2.md
diff --git a/docs/content/en/open_source/upgrading/1.2.3.md b/docs/content/changelog/os_upgrading/1.2.3.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.2.3.md
rename to docs/content/changelog/os_upgrading/1.2.3.md
diff --git a/docs/content/en/open_source/upgrading/1.2.4.md b/docs/content/changelog/os_upgrading/1.2.4.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.2.4.md
rename to docs/content/changelog/os_upgrading/1.2.4.md
diff --git a/docs/content/en/open_source/upgrading/1.2.8.md b/docs/content/changelog/os_upgrading/1.2.8.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.2.8.md
rename to docs/content/changelog/os_upgrading/1.2.8.md
diff --git a/docs/content/en/open_source/upgrading/1.2.9.md b/docs/content/changelog/os_upgrading/1.2.9.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.2.9.md
rename to docs/content/changelog/os_upgrading/1.2.9.md
diff --git a/docs/content/en/open_source/upgrading/1.3.1.md b/docs/content/changelog/os_upgrading/1.3.1.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.3.1.md
rename to docs/content/changelog/os_upgrading/1.3.1.md
diff --git a/docs/content/en/open_source/upgrading/1.7.0.md b/docs/content/changelog/os_upgrading/1.7.0.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.7.0.md
rename to docs/content/changelog/os_upgrading/1.7.0.md
diff --git a/docs/content/en/open_source/upgrading/1.8.0.md b/docs/content/changelog/os_upgrading/1.8.0.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.8.0.md
rename to docs/content/changelog/os_upgrading/1.8.0.md
diff --git a/docs/content/en/open_source/upgrading/1.9.3.md b/docs/content/changelog/os_upgrading/1.9.3.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/1.9.3.md
rename to docs/content/changelog/os_upgrading/1.9.3.md
diff --git a/docs/content/en/open_source/upgrading/2.0.md b/docs/content/changelog/os_upgrading/2.0.md
similarity index 96%
rename from docs/content/en/open_source/upgrading/2.0.md
rename to docs/content/changelog/os_upgrading/2.0.md
index f9fe4e44c59..788ee81d1b1 100644
--- a/docs/content/en/open_source/upgrading/2.0.md
+++ b/docs/content/changelog/os_upgrading/2.0.md
@@ -54,7 +54,7 @@ This can take a while depending on your instance size.
### Authorization
-The new authorization system for Products and Product Types based on roles is the default now. The fields for authorized users are not available anymore, but you can assign roles as described in [Permissions](/en/customize_dojo/user_management/about_perms_and_roles). Users are migrated automatically, so that their permissions are as close as possible to the previous authorization:
+The new authorization system for Products and Product Types based on roles is the default now. The fields for authorized users are not available anymore, but you can assign roles as described in [Permissions](/admin/user_management/about_perms_and_roles/). Users are migrated automatically, so that their permissions are as close as possible to the previous authorization:
- Superusers will still have all permissions on Products and Product Types, so they must not be changed.
- Staff users have had all permissions for all product types and products, so they will be get a global role as *Owner*.
- Product_Members and Product Type_Members will be added for authorized users according to the settings for the previous authorization:
diff --git a/docs/content/en/open_source/upgrading/2.10.md b/docs/content/changelog/os_upgrading/2.10.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.10.md
rename to docs/content/changelog/os_upgrading/2.10.md
diff --git a/docs/content/en/open_source/upgrading/2.12.md b/docs/content/changelog/os_upgrading/2.12.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.12.md
rename to docs/content/changelog/os_upgrading/2.12.md
diff --git a/docs/content/en/open_source/upgrading/2.13.md b/docs/content/changelog/os_upgrading/2.13.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.13.md
rename to docs/content/changelog/os_upgrading/2.13.md
diff --git a/docs/content/en/open_source/upgrading/2.15.md b/docs/content/changelog/os_upgrading/2.15.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.15.md
rename to docs/content/changelog/os_upgrading/2.15.md
diff --git a/docs/content/en/open_source/upgrading/2.16.md b/docs/content/changelog/os_upgrading/2.16.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.16.md
rename to docs/content/changelog/os_upgrading/2.16.md
diff --git a/docs/content/en/open_source/upgrading/2.17.md b/docs/content/changelog/os_upgrading/2.17.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.17.md
rename to docs/content/changelog/os_upgrading/2.17.md
diff --git a/docs/content/en/open_source/upgrading/2.18.md b/docs/content/changelog/os_upgrading/2.18.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.18.md
rename to docs/content/changelog/os_upgrading/2.18.md
diff --git a/docs/content/en/open_source/upgrading/2.19.md b/docs/content/changelog/os_upgrading/2.19.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.19.md
rename to docs/content/changelog/os_upgrading/2.19.md
diff --git a/docs/content/en/open_source/upgrading/2.2.md b/docs/content/changelog/os_upgrading/2.2.md
similarity index 90%
rename from docs/content/en/open_source/upgrading/2.2.md
rename to docs/content/changelog/os_upgrading/2.2.md
index d0785c9dc01..f7b1a9ea3c8 100644
--- a/docs/content/en/open_source/upgrading/2.2.md
+++ b/docs/content/changelog/os_upgrading/2.2.md
@@ -8,5 +8,5 @@ exclude_search: true
Upgrade to 2.0.0 contained migration of endpoints. Some parts of migration haven't been done properly. This deficiency
may manifest as a doubled slash in endpoint URLs (like `http://foo.bar:8080//test`) or as a problem with deduplication
of the same endpoints. The mentioned bug was fixed in 2.2.0 and if you have seen these kinds of problems, just rerun
-"Endpoint migration" as it is written in [Upgrading to DefectDojo Version 2.0.x.](/en/open_source/upgrading/2.0/#endpoints).
+"Endpoint migration" as it is written in [Upgrading to DefectDojo Version 2.0.x.](/open_source/upgrading/2.0/#endpoints).
diff --git a/docs/content/en/open_source/upgrading/2.20.md b/docs/content/changelog/os_upgrading/2.20.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.20.md
rename to docs/content/changelog/os_upgrading/2.20.md
diff --git a/docs/content/en/open_source/upgrading/2.21.md b/docs/content/changelog/os_upgrading/2.21.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.21.md
rename to docs/content/changelog/os_upgrading/2.21.md
diff --git a/docs/content/en/open_source/upgrading/2.22.md b/docs/content/changelog/os_upgrading/2.22.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.22.md
rename to docs/content/changelog/os_upgrading/2.22.md
diff --git a/docs/content/en/open_source/upgrading/2.23.md b/docs/content/changelog/os_upgrading/2.23.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.23.md
rename to docs/content/changelog/os_upgrading/2.23.md
diff --git a/docs/content/en/open_source/upgrading/2.24.md b/docs/content/changelog/os_upgrading/2.24.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.24.md
rename to docs/content/changelog/os_upgrading/2.24.md
diff --git a/docs/content/en/open_source/upgrading/2.25.md b/docs/content/changelog/os_upgrading/2.25.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.25.md
rename to docs/content/changelog/os_upgrading/2.25.md
diff --git a/docs/content/en/open_source/upgrading/2.26.md b/docs/content/changelog/os_upgrading/2.26.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.26.md
rename to docs/content/changelog/os_upgrading/2.26.md
diff --git a/docs/content/en/open_source/upgrading/2.27.md b/docs/content/changelog/os_upgrading/2.27.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.27.md
rename to docs/content/changelog/os_upgrading/2.27.md
diff --git a/docs/content/en/open_source/upgrading/2.28.md b/docs/content/changelog/os_upgrading/2.28.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.28.md
rename to docs/content/changelog/os_upgrading/2.28.md
diff --git a/docs/content/en/open_source/upgrading/2.29.md b/docs/content/changelog/os_upgrading/2.29.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.29.md
rename to docs/content/changelog/os_upgrading/2.29.md
diff --git a/docs/content/en/open_source/upgrading/2.3.md b/docs/content/changelog/os_upgrading/2.3.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.3.md
rename to docs/content/changelog/os_upgrading/2.3.md
diff --git a/docs/content/en/open_source/upgrading/2.30.md b/docs/content/changelog/os_upgrading/2.30.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.30.md
rename to docs/content/changelog/os_upgrading/2.30.md
diff --git a/docs/content/en/open_source/upgrading/2.31.md b/docs/content/changelog/os_upgrading/2.31.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.31.md
rename to docs/content/changelog/os_upgrading/2.31.md
diff --git a/docs/content/en/open_source/upgrading/2.32.md b/docs/content/changelog/os_upgrading/2.32.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.32.md
rename to docs/content/changelog/os_upgrading/2.32.md
diff --git a/docs/content/en/open_source/upgrading/2.33.md b/docs/content/changelog/os_upgrading/2.33.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.33.md
rename to docs/content/changelog/os_upgrading/2.33.md
diff --git a/docs/content/en/open_source/upgrading/2.34.md b/docs/content/changelog/os_upgrading/2.34.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.34.md
rename to docs/content/changelog/os_upgrading/2.34.md
diff --git a/docs/content/en/open_source/upgrading/2.35.md b/docs/content/changelog/os_upgrading/2.35.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.35.md
rename to docs/content/changelog/os_upgrading/2.35.md
diff --git a/docs/content/en/open_source/upgrading/2.36.md b/docs/content/changelog/os_upgrading/2.36.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.36.md
rename to docs/content/changelog/os_upgrading/2.36.md
diff --git a/docs/content/en/open_source/upgrading/2.37.md b/docs/content/changelog/os_upgrading/2.37.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.37.md
rename to docs/content/changelog/os_upgrading/2.37.md
diff --git a/docs/content/en/open_source/upgrading/2.38.md b/docs/content/changelog/os_upgrading/2.38.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.38.md
rename to docs/content/changelog/os_upgrading/2.38.md
diff --git a/docs/content/en/open_source/upgrading/2.39.md b/docs/content/changelog/os_upgrading/2.39.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.39.md
rename to docs/content/changelog/os_upgrading/2.39.md
diff --git a/docs/content/en/open_source/upgrading/2.4.md b/docs/content/changelog/os_upgrading/2.4.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.4.md
rename to docs/content/changelog/os_upgrading/2.4.md
diff --git a/docs/content/en/open_source/upgrading/2.40.md b/docs/content/changelog/os_upgrading/2.40.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.40.md
rename to docs/content/changelog/os_upgrading/2.40.md
diff --git a/docs/content/en/open_source/upgrading/2.41.md b/docs/content/changelog/os_upgrading/2.41.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.41.md
rename to docs/content/changelog/os_upgrading/2.41.md
diff --git a/docs/content/en/open_source/upgrading/2.42.md b/docs/content/changelog/os_upgrading/2.42.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.42.md
rename to docs/content/changelog/os_upgrading/2.42.md
diff --git a/docs/content/en/open_source/upgrading/2.43.md b/docs/content/changelog/os_upgrading/2.43.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.43.md
rename to docs/content/changelog/os_upgrading/2.43.md
diff --git a/docs/content/en/open_source/upgrading/2.44.1.md b/docs/content/changelog/os_upgrading/2.44.1.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.44.1.md
rename to docs/content/changelog/os_upgrading/2.44.1.md
diff --git a/docs/content/en/open_source/upgrading/2.44.md b/docs/content/changelog/os_upgrading/2.44.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.44.md
rename to docs/content/changelog/os_upgrading/2.44.md
diff --git a/docs/content/en/open_source/upgrading/2.45.md b/docs/content/changelog/os_upgrading/2.45.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.45.md
rename to docs/content/changelog/os_upgrading/2.45.md
diff --git a/docs/content/en/open_source/upgrading/2.46.md b/docs/content/changelog/os_upgrading/2.46.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.46.md
rename to docs/content/changelog/os_upgrading/2.46.md
diff --git a/docs/content/en/open_source/upgrading/2.47.md b/docs/content/changelog/os_upgrading/2.47.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.47.md
rename to docs/content/changelog/os_upgrading/2.47.md
diff --git a/docs/content/en/open_source/upgrading/2.48.2.md b/docs/content/changelog/os_upgrading/2.48.2.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.48.2.md
rename to docs/content/changelog/os_upgrading/2.48.2.md
diff --git a/docs/content/en/open_source/upgrading/2.48.md b/docs/content/changelog/os_upgrading/2.48.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.48.md
rename to docs/content/changelog/os_upgrading/2.48.md
diff --git a/docs/content/en/open_source/upgrading/2.49.md b/docs/content/changelog/os_upgrading/2.49.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.49.md
rename to docs/content/changelog/os_upgrading/2.49.md
diff --git a/docs/content/en/open_source/upgrading/2.5.md b/docs/content/changelog/os_upgrading/2.5.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.5.md
rename to docs/content/changelog/os_upgrading/2.5.md
diff --git a/docs/content/en/open_source/upgrading/2.50.md b/docs/content/changelog/os_upgrading/2.50.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.50.md
rename to docs/content/changelog/os_upgrading/2.50.md
diff --git a/docs/content/en/open_source/upgrading/2.51.md b/docs/content/changelog/os_upgrading/2.51.md
similarity index 97%
rename from docs/content/en/open_source/upgrading/2.51.md
rename to docs/content/changelog/os_upgrading/2.51.md
index 6c796b103d7..92aac433e95 100644
--- a/docs/content/en/open_source/upgrading/2.51.md
+++ b/docs/content/changelog/os_upgrading/2.51.md
@@ -50,8 +50,8 @@ The following Helm chart values have been modified in this release:
## GitHub Scan Type and Parser Updates
The Github Vulnerability scan type and parser has been split into two disctinct scan types:
-- [Github Vulnerability](https://github.com/DefectDojo/django-DefectDojo/blob/master/docs/content/en/connecting_your_tools/parsers/file/github_vulnerability.md) (original)
-- [Github SAST](https://github.com/DefectDojo/django-DefectDojo/blob/master/docs/content/en/connecting_your_tools/parsers/file/github_sast.md)
+- [Github Vulnerability](https://github.com/DefectDojo/django-DefectDojo/blob/master/docs/content/supported_tools/file/github_vulnerability.md) (original)
+- [Github SAST](https://github.com/DefectDojo/django-DefectDojo/blob/master/docs/content/supported_tools/file/github_sast.md)
The original Github Vulnerability scan type will continue to accept SCA vulnerabilities uploaded in GitHub's GraphQL format, as it has always done. It will also continue to accept SAST uploads, however we recommend upgrading to the new Github SAST scan type for uploading these types of vulnerabilities going forward. This new scan type will accept the raw JSON response from [GitHub's REST API for code scanning alerts](https://docs.github.com/en/rest/code-scanning/code-scanning). Sample Github SAST scan data can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/github_sast).
diff --git a/docs/content/en/open_source/upgrading/2.52.md b/docs/content/changelog/os_upgrading/2.52.md
similarity index 95%
rename from docs/content/en/open_source/upgrading/2.52.md
rename to docs/content/changelog/os_upgrading/2.52.md
index 20eef3fb214..18aa85e15be 100644
--- a/docs/content/en/open_source/upgrading/2.52.md
+++ b/docs/content/changelog/os_upgrading/2.52.md
@@ -90,7 +90,7 @@ There are other instructions for upgrading to 2.52.x. Check the [Release Notes](
## Merge of MobSF parsers
-Mobsfscan Scan" has been merged into the "MobSF Scan" parser. The "Mobsfscan Scan" scan_type has been retained to keep deduplication working for existing Tests, but users are encouraged to move to the "MobSF Scan" scan_type.
+"Mobsfscan Scan" has been merged into the "MobSF Scan" parser. The "Mobsfscan Scan" scan_type has been retained to keep deduplication working for existing Tests, but users are encouraged to move to the "MobSF Scan" scan_type.
## Release notes
Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.52.0) for the contents of the release.
diff --git a/docs/content/en/open_source/upgrading/2.53.md b/docs/content/changelog/os_upgrading/2.53.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.53.md
rename to docs/content/changelog/os_upgrading/2.53.md
diff --git a/docs/content/en/open_source/upgrading/2.54.3.md b/docs/content/changelog/os_upgrading/2.54.3.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.54.3.md
rename to docs/content/changelog/os_upgrading/2.54.3.md
diff --git a/docs/content/en/open_source/upgrading/2.54.md b/docs/content/changelog/os_upgrading/2.54.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.54.md
rename to docs/content/changelog/os_upgrading/2.54.md
diff --git a/docs/content/en/open_source/upgrading/2.6.md b/docs/content/changelog/os_upgrading/2.6.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.6.md
rename to docs/content/changelog/os_upgrading/2.6.md
diff --git a/docs/content/en/open_source/upgrading/2.7.md b/docs/content/changelog/os_upgrading/2.7.md
similarity index 92%
rename from docs/content/en/open_source/upgrading/2.7.md
rename to docs/content/changelog/os_upgrading/2.7.md
index 526813dbb45..aa1ef6cba96 100644
--- a/docs/content/en/open_source/upgrading/2.7.md
+++ b/docs/content/changelog/os_upgrading/2.7.md
@@ -9,7 +9,7 @@ This release is a breaking change regarding the Choctaw Hog parser. As the maint
There is another breaking change regarding the import of SSLyze scans. The parser has been renamed from `SSLyze 3 Scan (JSON)` to `SSLyze Scan (JSON)`. The data in the database is fixed by the initializer, but it may break scripted API calls.
-Release 2.7.0 contains a beta functionality to make permissions for the configuration of DefectDojo more flexible. When the settings parameter `FEATURE_CONFIGURATION_AUTHORIZATION` is set to `True`, many configuration dialogues and API endpoints can be enabled for users or groups of users, regardless of their **Superuser** or **Staff** status, see [Configuration Permissions](/en/customize_dojo/user_management/about_perms_and_roles).
+Release 2.7.0 contains a beta functionality to make permissions for the configuration of DefectDojo more flexible. When the settings parameter `FEATURE_CONFIGURATION_AUTHORIZATION` is set to `True`, many configuration dialogues and API endpoints can be enabled for users or groups of users, regardless of their **Superuser** or **Staff** status, see [Configuration Permissions](/admin/user_management/about_perms_and_roles/).
The functionality using the flag `AUTHORIZATION_STAFF_OVERRIDE` has been removed. The same result can be achieved with giving the staff users a global Owner role.
diff --git a/docs/content/en/open_source/upgrading/2.8.md b/docs/content/changelog/os_upgrading/2.8.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.8.md
rename to docs/content/changelog/os_upgrading/2.8.md
diff --git a/docs/content/en/open_source/upgrading/2.9.md b/docs/content/changelog/os_upgrading/2.9.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/2.9.md
rename to docs/content/changelog/os_upgrading/2.9.md
diff --git a/docs/content/en/open_source/upgrading/_index.md b/docs/content/changelog/os_upgrading/_index.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/_index.md
rename to docs/content/changelog/os_upgrading/_index.md
diff --git a/docs/content/en/open_source/upgrading/upgrading_guide.md b/docs/content/changelog/os_upgrading/upgrading_guide.md
similarity index 100%
rename from docs/content/en/open_source/upgrading/upgrading_guide.md
rename to docs/content/changelog/os_upgrading/upgrading_guide.md
diff --git a/docs/content/en/changelog/changelog.md b/docs/content/changelog/pro_changelog.md
similarity index 97%
rename from docs/content/en/changelog/changelog.md
rename to docs/content/changelog/pro_changelog.md
index a3561c407d5..fa3466d6505 100644
--- a/docs/content/en/changelog/changelog.md
+++ b/docs/content/changelog/pro_changelog.md
@@ -6,7 +6,7 @@ exclude_search: true
Here are the release notes for **DefectDojo Pro (Cloud Version)**. These release notes are focused on UX, so will not include all code changes.
-For Open Source release notes, please see the [Releases page on GitHub](https://github.com/DefectDojo/django-DefectDojo/releases), or alternatively consult the Open Source [upgrade notes](/en/open_source/upgrading/upgrading_guide/).
+For Open Source release notes, please see the [Releases page on GitHub](https://github.com/DefectDojo/django-DefectDojo/releases), or alternatively consult the Open Source [upgrade notes](/open_source/upgrading/upgrading_guide/).
## Jan 2025: v2.54
@@ -43,7 +43,7 @@ No significant UX changes.
### Dec 8, 2025: v2.53.1
-* **(Assets/Organizations)** Introduced overhaul to Products/Product Types, added the ability to create and diagram relationships between Assets. See [Assets/Organizations documentation](/en/working_with_findings/organizing_engagements_tests/pro_assets_organizations/) for details, and information on opting in to the Beta.
+* **(Assets/Organizations)** Introduced overhaul to Products/Product Types, added the ability to create and diagram relationships between Assets. See [Assets/Organizations documentation](/asset_modelling/hierarchy/pro__assets_organizations/) for details, and information on opting in to the Beta.
* **(Findings)** Added new KEV fields for ransomware, exploits, and date handling.
* **(Pro UI)** Added Table Preferences menu, allowing you to store preset lists of columns for each table.
@@ -150,7 +150,7 @@ The Pro UI has been significantly reorganized, with changes to page organization
#### August 25: 2.49.3
-[Integrations](/en/share_your_findings/integrations/) has been added to DefectDojo Pro, adding an Jira-style integrations for Azure DevOps, GitHub and GitLab boards.
+[Integrations](/issue_tracking/intro/intro/) has been added to DefectDojo Pro, adding an Jira-style integrations for Azure DevOps, GitHub and GitLab boards.
* **(API)** Basic Auth Login has been removed from the swagger form. Only cookieAuth and tokenAuth are accepted.
* **(API)** When MFA is enabled, an MFA code will be required to use the `/api-token-auth` endpoint.
@@ -322,8 +322,8 @@ Hotfix release - no significant feature changes.

-- **(Pro UI)** Added a link to Universal Importer to the sidebar, which provides access to the [Universal Importer and DefectDojo CLI](/en/connecting_your_tools/external_tools/) tools.
-- **(Pro UI)** Added smart Prioritization and Risk fields to DefectDojo Pro, which can be used to more easily triage Findings based on the impact of the Product they affect. See [Priority](/en/working_with_findings/finding_priority/) documentation for more information.
+- **(Pro UI)** Added a link to Universal Importer to the sidebar, which provides access to the [Universal Importer and DefectDojo CLI](/import_data/pro/specialized_import/external_tools/) tools.
+- **(Pro UI)** Added smart Prioritization and Risk fields to DefectDojo Pro, which can be used to more easily triage Findings based on the impact of the Product they affect. See [Priority](/asset_modelling/hierarchy/pro__priority_sla/) documentation for more information.
- **(Tools)** Updated Fortify Webinspect parser to handle Fortify's new XML report format.
#### Apr 14, 2025: v2.45.1
@@ -390,7 +390,7 @@ Hotfix release - no significant feature changes.
- **(Pro UI)** Added 'Has Jira' (True/False) as a filter, to filter Findings, Products or Engagements that have associated Jira data.
- **(Pro UI)** Notes can now be added to Engagement / Findings / Tests from All Engagements / Findings / Tests lists as well as View Engagement / Findings / Tests pages.
- **(Pro UI)** Added ability to Close Finding from a Finding List, without needing to first open the Edit Finding form.
-- **(CLI Tools)** Improved help text for Universal Importer / DefectDojo CLI. Many guides and examples are now in our [docs](/en/connecting_your_tools/external_tools/) instead of being displayed in the CLI itself.
+- **(CLI Tools)** Improved help text for Universal Importer / DefectDojo CLI. Many guides and examples are now in our [docs](/import_data/pro/specialized_import/external_tools/) instead of being displayed in the CLI itself.
- **(Tools)** Updated Burp scan to use Hashcode Deduplication. Default hashcode forms are `title`, `file_path`, `severity`, and `vuln_id_from_tool`.
- **(Tools)** Corrected issue with AWS Inspector2 OSS parser related to `mitigated date` being handled incorrectly.
@@ -591,7 +591,7 @@ configuration fields.
- **(API)** It is now possible to prefetch a Finding with attached files via API.
- **(Login)** A new "Forgot Username" link has been added to the login form. The link will navigate to a page which requests the user's email address. The username will be sent to that address if it exists.
- **Risk Acceptances** Notes are now added to Findings when they are removed from Risk Acceptances.
-- **(Risk Acceptance)** Risk Acceptance overhaul. Feature has been extended with new functions. See [Risk Acceptance documentation](/en/working_with_findings/findings_workflows/risk_acceptances/) for more details.
+- **(Risk Acceptance)** Risk Acceptance overhaul. Feature has been extended with new functions. See [Risk Acceptance documentation](/triage_findings/findings_workflows/risk_acceptances/) for more details.
- **Tools** Qualys HackerGuardian parser added.
- **Tools** Semgrep Parser updated with new severity mappings. HackerOne parser updated and now supports bug bounty reports.
- **Tools** fixed an issue where certain tools would not process asyncronously: Whitehat_Sentinel, SSLyze, SSLscan, Qualys_Webapp, Mend, Intsights, H1, and Blackduck.
diff --git a/docs/content/en/about_defectdojo/_index.md b/docs/content/en/about_defectdojo/_index.md
deleted file mode 100644
index aa822dcdbe4..00000000000
--- a/docs/content/en/about_defectdojo/_index.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-title: "About DefectDojo"
-date: 2021-02-02T20:46:29+01:00
-draft: false
-type: docs
-weight: 1
-
-cascade:
-- type: "blog"
- # set to false to include a blog section in the section nav along with docs
- toc_root: true
- _target:
- path: "/blog/**"
-- type: "docs"
- _target:
- path: "/**"
-exclude_search: true
----
diff --git a/docs/content/en/about_defectdojo/new_user_checklist.md b/docs/content/en/about_defectdojo/new_user_checklist.md
deleted file mode 100644
index d2e93499da9..00000000000
--- a/docs/content/en/about_defectdojo/new_user_checklist.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-title: "☑️ New User Checklist"
-description: "Get Started With DefectDojo"
-draft: "false"
-weight: 3
-chapter: true
----
-
-Here's a quick reference you can use to ensure successful implementation, from a blank canvas to a fully functional app.
-
-The essence of DefectDojo is to import security data, organize it, and present it to the folks who need to know. Here are ways to achieve those things in DefectDojo Pro and Open-Source:
-
-### DefectDojo Pro
-
-1. Start by [importing a file](/en/connecting_your_tools/import_scan_files/import_scan_ui) using the UI. This is generally the quickest way to see how your data fits into the DefectDojo model.
-
-2. Now that you have data in DefectDojo, learn more about how to organize it with the [Product Hierarchy Overview](/en/working_with_findings/organizing_engagements_tests/product_hierarchy). The Product Hierarchy creates a working inventory of your apps, which helps you divide your data into logical categories, apply access control rules, sort Findings by [Priority and Risk](/en/working_with_findings/finding_priority/) or to segment your reports to the correct team.
-
-3. Check out your [Metrics pages](/en/customize_dojo/dashboards/pro_dashboards/) which can be used to quickly share Finding reports with key stakeholders.
-
-### DefectDojo Open-Source
-
-1. Open-Source users can start by creating their first [Product Type and Product](/en/working_with_findings/organizing_engagements_tests/product_hierarchy). Once those are created, they can [import a file](/en/connecting_your_tools/import_scan_files/import_scan_ui) to one of those Products using the UI.
-
-2. Now that you have data in DefectDojo, consider expanding your Product layout [Product Hierarchy Overview](/en/working_with_findings/organizing_engagements_tests/product_hierarchy). The Product Hierarchy creates a working inventory of your apps, which helps you divide your data up into logical categories. These categories can be used to apply access control rules, or to segment your reports to the correct team.
-
-3. Use the [Report Builder](/en/share_your_findings/pro_reports/using_the_report_builder/#opening-the-report-builder) to summarize the data you've imported. Reports can be used to quickly share Findings with stakeholders such as Product Owners.
-
-This is the essence of DefectDojo - import security data, organize it, and present it to the folks who need to know.
-
-All of these features can be automated, and because DefectDojo can handle over 200 tools (at time of writing) you should be all set to create a functional security inventory of your entire organizational output.
-
-## Other guides
-
-### Pro Features
-- If your organization uses ServiceNow, AzureDevops, GitHub or GitLab for issue tracking, check out our [documentation](/en/share_your_findings/integrations/) on those integrations.
-- Customize your [main Dashboard](/en/customize_dojo/dashboards/introduction_dashboard/) with filtered tiles to view your environment at a glance.
-- Learn how to rapidly import data and mirror your team's existing security environment with [Connectors](/en/connecting_your_tools/connectors/about_connectors/).
-
-### Open-Source Features
-- Does your organization use Jira? Learn how to use our [Jira integration](/en/share_your_findings/jira_guide/) to create Jira tickets from the data you ingest.
-- Are you expecting to share DefectDojo with many users in your organization? Check out our guides to [user management](/en/customize_dojo/user_management/about_perms_and_roles/) and set up role-based access control (RBAC).
-- Ready to dive into automation? Learn how to use the [DefectDojo API](/en/connecting_your_tools/import_scan_files/api_pipeline_modelling) to automatically import new data, and build a robust CI/CD pipeline.
\ No newline at end of file
diff --git a/docs/content/en/customize_dojo/_index.md b/docs/content/en/customize_dojo/_index.md
deleted file mode 100644
index d2799af41e9..00000000000
--- a/docs/content/en/customize_dojo/_index.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-title: "👥 Management & Customization"
-description: "Dashboards, User Access"
-summary: ""
-date: 2023-09-07T16:06:50+02:00
-lastmod: 2023-09-07T16:06:50+02:00
-draft: false
-weight: 5
-chapter: true
-seo:
- title: "" # custom title (optional)
- description: "" # custom description (recommended)
- canonical: "" # custom canonical URL (optional)
- robots: "" # custom robot tags (optional)
-exclude_search: true
----
\ No newline at end of file
diff --git a/docs/content/en/customize_dojo/dashboards/pro_dashboards.md b/docs/content/en/customize_dojo/dashboards/pro_dashboards.md
deleted file mode 100644
index ff712ead903..00000000000
--- a/docs/content/en/customize_dojo/dashboards/pro_dashboards.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-title: "Metrics Dashboards (Pro)"
-description: "How to use DefectDojo's Pro Metrics"
-weight: 3
----
-
-The DefectDojo Pro UI has many Metrics dashboards which are kept up to date in real-time. Each Dashboard can render a PDF report to share data with key stakeholders.
-
-These dashboards include:
-
-* **Executive Insights**, which displays the current state of your Products and Product Types.
-* **Program Insights**, which displays the effectiveness of your security team and the cost savings associated with separating duplicates and false positives from actionable Findings
-* **Remediation Insights**, which displays your effectiveness at remediating Findings.
-* **Tool Insights**, which displays the effectiveness of your tool suite (and Connectors pipelines) at detecting and reporting vulnerabilities.
-
-## Executive Insights
-
-
-
-This dashboard allows you to select any Product Type or Product from the filter list and get a status report on the number of Findings present. If no filters are selected, this dashboard will display the status of all Product Types and Products.
-
-
-
-Graphs are provided to illustrate SLA compliance, active Findings over time, and other metrics relevant to the selected Product/Product Types and timeframe.
-
-## Program Insights
-
-
-
-This dashboard shows a report of your team's security program, including quarterly breakdowns on testing, as well as noise reduction through the application of deduplication and reimport features.
-
-## Remediation Insights
-
-
-
-This dashboard tracks your remediation performance, charting time to remediation as well as Risk Acceptance over time. "Highly Exploitable Findings" uses [EPSS scores](/en/working_with_findings/intro_to_findings/#monitor-current-vulnerabilities-using-cves-and-epss-scores-pro-feature) to estimate the likelihood of a Finding's exploit. DefectDojo Pro comes with a daily-updated EPSS database to which assigns those scores and percentiles to each of your Findings.
-
-## Tool Insights
-
-
-
-This dashboard tracks the performance of each security tool used in DefectDojo, based on the count and severity of Findings that it reports.
-
-## Switching To The Pro UI
-
-These Dashboards are available under **Metrics** in the Pro UI.
-To access the Pro UI, open the User Options menu from the top-right hand corner. You can also switch back to the Classic UI from the same menu.
-
-
\ No newline at end of file
diff --git a/docs/content/en/customize_dojo/user_management/pro_permissions_overhaul.md b/docs/content/en/customize_dojo/user_management/pro_permissions_overhaul.md
deleted file mode 100644
index acb025cfb40..00000000000
--- a/docs/content/en/customize_dojo/user_management/pro_permissions_overhaul.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-title: "🟧 Set Permissions in Pro"
-description: "Overhaul, pro feature"
-weight: 3
----
-
-Permissions in DefectDojo Pro have been simplified, to make it easier to assign object access. This feature can be accessed through the [Pro UI](/en/about_defectdojo/ui_pro_vs_os/).
-
-### Opening the Permissions window
-
-
-
-When looking at Product Type or Product, you can open the Permissions window to set permissions quickly. This menu can be found in a Table by clicking the horizontal dots **"⋮"**. IF looking at an individual **Product** or **Product Type** page, this menu can be found under the blue gear ‘⚙️’.
-
-## Setting Permissions through the permissions window
-
-
-
-1. At the top of this window, you can choose to manage permissions for an individual user or for a [user group](../create_user_group).
-2. Here, you can select a user or group to add to the Product, and select the [Role](../about_perms_and_roles) that you want that user to have.
-3. On the lower table, you can see a list of all users or groups who have access to this object. You can also quickly assign a new role for one of these users or groups from the drop-down menu.
-
-## Setting Configuration Permissions through the User view
-
-A user's configuration permissions can now be set in a more user-friendly approach. From the Users View, all configuration permissions are displayed in a dropdown, then grouped by the permission type. If the selection of configuration permissions is different from their current value, an “Update Configuration Permissions” button is displayed. When clicked, the user will be asked to confirm they would like to update the permissions for the selected group before an update is made.
-
-
diff --git a/docs/content/en/open_source/installation/_index.md b/docs/content/en/open_source/installation/_index.md
deleted file mode 100644
index 363026c464c..00000000000
--- a/docs/content/en/open_source/installation/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: "Open-Source Installation & Configuration"
-description: "How to install and configure DefectDojo"
-weight: 1
-chapter: true
----
diff --git a/docs/content/en/open_source/installation/demo.md b/docs/content/en/open_source/installation/demo.md
deleted file mode 100644
index b98404ea6a2..00000000000
--- a/docs/content/en/open_source/installation/demo.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-title: "Online Demo"
-description: "There is DefectDojo demo site running the latest officially released version"
-draft: false
-weight: 6
----
-
-## Demo
-
-Try out the demo sever at [demo.defectdojo.org](https://demo.defectdojo.org)
-
-Log in with `admin / 1Defectdojo@demo#appsec`. Please note that the demo is publicly accessable and regularly reset. Do not put sensitive data in the demo.
diff --git a/docs/content/en/working_with_findings/finding_deduplication/about_deduplication.md b/docs/content/en/working_with_findings/finding_deduplication/about_deduplication.md
deleted file mode 100644
index b947afc335d..00000000000
--- a/docs/content/en/working_with_findings/finding_deduplication/about_deduplication.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-title: "About Deduplication"
-description: "Deduplication fundamentals and key concepts"
-weight: 1
----
-
-DefectDojo is designed to ingest bulk reports from tools, creating one or more Findings based on the content of the report. When using DefectDojo, you’ll most likely be ingesting reports from the same tool on a regular basis, which means that duplicate Findings are highly likely.
-
-This is where Deduplication comes in, a Smart feature which you can set up to automatically manage duplicate Findings.
-
-## How DefectDojo handles duplicates
-
-1. First, you import **Test 1\.** Your report contains a vulnerability which is recorded as Finding A.
-2. **Later, you import Test 2 which contains the same vulnerability. This will be recorded as Finding B, and Finding B will be marked as a duplicate of Finding A.**
-3. Later still, you import **Test 3** which also contains that vulnerability. This will be recorded as Finding C, which will be marked as a duplicate of Finding A.
-
-By creating and marking Duplicates in this way, DefectDojo ensures that all the work for the ‘original’ vulnerability is centralized on the original Finding page, without creating separate contexts, or giving your team the impression that there are multiple separate vulnerabilities which need to be addressed.
-
-By default, these Tests would need to be nested under the same Product for Deduplication to be applied. If you wish, you can further limit the Deduplication scope to a single Engagement.
-
-
-
-Duplicate Findings are set as Inactive by default. This does not mean the Duplicate Finding itself is Inactive. Rather, this is so that your team only has a single active Finding to work on and remediate, with the implication being that once the original Finding is Mitigated, the Duplicates will also be Mitigated.
-
-## Deduplication vs Reimport
-
-Deduplication and Reimport are similar processes but they have a key difference:
-
-* When you Reimport to a Test, the Reimport process looks at incoming Findings, **filters and** **discards any matches**. Those matches will never be created as Findings or Finding Duplicates.
-* Deduplication is applied 'passively' on Findings that have already been created. It will identify duplicates in scope and **label them**, but it will not delete or discard the Finding unless 'Delete Deduplicate Findings' is enabled.
-* The 'reimport' action of discarding a Finding always happens before deduplication; DefectDojo **cannot deduplicate Findings that are never created** as a result of Reimport's filtering.
-
-## When are duplicates appropriate?
-
-Duplicates are useful when you’re dealing with shared, but discrete Testing contexts. For example, if your Product is uploading Test results for two different repositories, which need to be compared, it’s useful to know which vulnerabilities are shared across those repositories.
-
-However, if DefectDojo is creating excess duplicates, this can also be a sign that you need to adjust your pipelines or import processes.
-
-## What do my duplicates indicate?
-
-* **The same vulnerability, but found in a different context:** this is the appropriate way to use Duplicate Findings. If you have many components which are affected by the same vulnerability, you would likely want to know which components are affected to understand the scope of the problem.
-
-* **The same vulnerability, found in the same context**: better options exist for this case. If the Duplicate Finding does not give you any new context on the vulnerability, or if you find yourself frequently ignoring or deleting your duplicate Findings, this is a sign that your process can be improved. For example, Reimport allows you to effectively manage incoming reports from a CI/CD pipeline. Rather than create a completely new Finding object for each duplicate, Reimport will make a note of the incoming duplicate without creating the Duplicate Finding at all.
diff --git a/docs/content/en/working_with_findings/finding_deduplication/deduplication_algorithms.md b/docs/content/en/working_with_findings/finding_deduplication/deduplication_algorithms.md
deleted file mode 100644
index 5b5d56ca85d..00000000000
--- a/docs/content/en/working_with_findings/finding_deduplication/deduplication_algorithms.md
+++ /dev/null
@@ -1,63 +0,0 @@
----
-title: "Deduplication Algorithms"
-description: "How DefectDojo identifies duplicates: Unique ID, Hash Code, Unique ID or Hash Code, Legacy"
-weight: 3
----
-
-## Overview
-
-DefectDojo supports four deduplication algorithms that can be selected per parser (test type):
-
-- **Unique ID From Tool**: Uses the scanner-provided unique identifier.
-- **Hash Code**: Uses a configured set of fields to compute a hash.
-- **Unique ID From Tool or Hash Code**: Prefer the tool’s unique ID; fall back to hash when no matching unique ID is found.
-- **Legacy**: Historical algorithm with multiple conditions; only available in the Open Source version.
-
-Algorithm selection per parser is controlled by `DEDUPLICATION_ALGORITHM_PER_PARSER` (see the [Open-Source tuning page](/en/working_with_findings/finding_deduplication/deduplication_tuning_os/) for configuration details).
-
-## How endpoints are assessed per algorithm
-
-Endpoints can influence deduplication in different ways depending on the algorithm and configuration.
-
-### Unique ID From Tool
-
-- Deduplication uses `unique_id_from_tool` (or `vuln_id_from_tool`).
-- **Endpoints are ignored** for duplicate matching.
-- A finding’s hash may still be calculated for other features, but it does not affect deduplication under this algorithm.
-
-### Hash Code
-
-- Deduplication uses a hash computed from fields specified by `HASHCODE_FIELDS_PER_SCANNER` for the given parser.
-- The hash also includes fields from `HASH_CODE_FIELDS_ALWAYS` (see Service field section below).
-- Endpoints can affect deduplication in two ways:
- - If the scanner’s hash fields include `endpoints`, they are part of the hash and must match accordingly.
-- If the scanner’s hash fields do not include `endpoints`, optional endpoint-based matching can be enabled via `DEDUPE_ALGO_ENDPOINT_FIELDS` (OS setting). When configured:
- - Set it to an empty list `[]` to ignore endpoints entirely.
- - Set it to a list of endpoint attributes (e.g. `["host", "port"]`). If at least one endpoint pair between the two findings matches on all listed attributes, deduplication can occur.
-
-### Unique ID From Tool or Hash Code
-A finding is a duplicate with another if they have the same unique_id_from_tool OR the same hash_code.
-
-The endpoints also have to match for the findings to be considered duplicates, see the Hash Code algorithm above.
-
-### Legacy (OS only)
-
-- Deduplication considers multiple attributes including endpoints.
-- Behavior differs for static vs dynamic findings:
- - **Static findings**: The new finding must contain all endpoints of the original. Extra endpoints on the new finding are allowed.
- - **Dynamic findings**: Endpoints must strictly match (commonly by host and port); differing endpoints prevent deduplication.
-- If there are no endpoints and both `file_path` and `line` are empty, deduplication typically does not occur.
-
-## Background processing
-
-- Dedupe is triggered on import/reimport and during certain updates run via Celery in the background.
-
-## Service field and its impact
-
-- By default, `HASH_CODE_FIELDS_ALWAYS = ["service"]`, meaning the `service` associated with a finding is appended to the hash for all scanners.
-- Practical implications:
- - Two otherwise identical findings with different `service` values will produce different hashes and will not deduplicate under Hash-based paths.
- - During import/reimport, the `Service` field entered in the UI can override the parser-provided service. Changing it can change the hash and therefore affect deduplication outcomes.
- - If you want service to have no impact on deduplication, configure `HASH_CODE_FIELDS_ALWAYS` accordingly (see the OS tuning page). Removing `service` from the always-included list will stop it from affecting hashes.
-
-See also: the [Open Source tuning guide](/en/working_with_findings/finding_deduplication/deduplication_tuning_os/) for configuration details and examples.
diff --git a/docs/content/en/working_with_findings/finding_deduplication/delete_deduplicates.md b/docs/content/en/working_with_findings/finding_deduplication/delete_deduplicates.md
deleted file mode 100644
index 8a4cbed898b..00000000000
--- a/docs/content/en/working_with_findings/finding_deduplication/delete_deduplicates.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-title: "Delete Deduplicate Findings"
-description: "Remove excess duplicate Findings from DefectDojo"
-weight: 3
----
-
-If you have an excessive amount of duplicate Findings which you want to delete, you can set **Delete Deduplicate Findings** as an option in the **System Settings**.
-
-**Delete Deduplicate Findings**, combined with the **Maximum Duplicates** field allows DefectDojo to limit the amount of Duplicate Findings stored. When this field is enabled, DefectDojo will only keep a certain number of Duplicate Findings.
-
-## Which duplicates will be deleted?
-
-The original Finding will never be deleted automatically from DefectDojo, but once the threshold for Maximum Duplicates is crossed, DefectDojo will automatically delete the oldest Duplicate Finding.
-
-For example, let’s say that you had your Maximum Duplicates field set to ‘1’.
-
-1. First, you import **Test 1\.** Your report contains a vulnerability which is recorded as Finding A.
-2. **Later, you import Test 2 contains the same vulnerability. This will be recorded as Finding B, and Finding B will be marked as a duplicate of Finding A.**
-3. Later still, you import **Test 3** which also contains that vulnerability. This will be recorded as Finding C, which will be marked as a duplicate of Finding A. At this time, Finding B will be deleted from DefectDojo as the threshold for maximum duplicates has been crossed.
-
-## Applying this setting
-
-Applying **Delete Deduplicate Findings** will begin a deletion process immediately. This setting can be applied on the **System Settings** page. See Enabling Deduplication for more information.
diff --git a/docs/content/en/working_with_findings/finding_priority.md b/docs/content/en/working_with_findings/finding_priority.md
deleted file mode 100644
index caff9c56bae..00000000000
--- a/docs/content/en/working_with_findings/finding_priority.md
+++ /dev/null
@@ -1,135 +0,0 @@
----
-title: "⏱️ Finding Priority and Risk (Pro)"
-description: "How DefectDojo ranks your Findings"
-weight: 1
----
-
-
-
-Effective risk-based vulnerability management requires an approach that considers
-both business context and technical exploitability. Using DefectDojo Pro’s Priority and Risk feature, users can automatically sort Findings into a meaningful context, ensuring
-high-impact vulnerabilities can be addressed first.
-
-**Priority** is a calculated numerical rank applied to all Findings in your DefectDojo
-instance. It allows you to quickly understand vulnerabilities in context, especially within
-large organizations that are overseeing security needs for many Findings and/or
-Products.
-
-**Risk** is a 4-level ranking system which factors in a Finding’s exploitability to a greater
-degree. This is meant as a less granular, more ’executive-level’ version of Priority.
-
-
-
-Priority and Risk values can be used with other filters to compare Findings in any context, such as:
-
-* within a single Product, Engagement or Test
-* globally in all DefectDojo Products
-* between a few specific Products
-
-Applying Finding Priority and Risk helps your team respond to the most relevant
-vulnerabilities in your organization, and also provides a framework to assist in
-compliance with regulatory standards.
-
-
-Learn more about Priority and Risk with DefectDojo Inc's May 2025 Office Hours:
-
-
-
-## How Priority & Risk are calculated
-The range of Priority values is from 0 to 1150. The higher the number, the more urgency
-the Finding is to triage or remediate.
-
-Similar to Severity, Risk is scored from Low -> Medium -> Needs Action -> Urgent. **Risk** considers Priority fields and may be different from a tool's reported Severity as a result.
-
-
-
-## Priority Fields: Product-Level
-
-Each Product in DefectDojo has metadata that tracks business criticality and risk
-factors. This metadata is used to help calculate Priority and Risk for any associated
-Findings.
-
-All of these metadata fields can be set on the **Edit Product** form for a given Product.
-
-
-
-* **Criticality** can be set to any value of None, Very Low, Low, Medium, High, or Very
-High. Criticality is a subjective field, so when assigning this field, consider how the
-Product compares to other Products in your organization.
-* **User Records** is a numerical estimation of user records in a database (or a system
-that can access that database).
-* **Revenue** is a numerical estimation of annual revenue for the Product. To calculate Priority, DefectDojo will calculate a percentage by comparing this Product's revenue to the sum of all Products within the Product Type.
-
-It is not possible to set a currency type in DefectDojo, so make sure that all of your Revenue
-estimations have the same currency denomination. (“50000” could mean $50,000
-US Dollars or ¥50,000 Japanese Yen - the denomination does not matter as long as
-all of your Products have revenue calculated in the same currency).
-* **External Audience** is a true/false value - set this to True if this Product can be
-accessed by an external audience. For example, customers, users, or anyone
-outside of your organization.
-* **Internet Accessible** is a true/false value. If this Product can connect to the open
-internet, you should set this value to True.
-
-Priority is a ‘relative’ calculation, which is meant to compare different Products within
-your DefectDojo instance. It is ultimately up to your organization to decide how these
-filters are set. These values should be as accurate as possible, but the primary goal is
-to highlight your key Products so that you can prioritize vulnerabilities according to your
-organization’s policies, so these fields do not necessarily need to be set perfectly.
-
-## Priority Fields: Finding-Level
-
-Findings within a Product can have additional metadata which can further adjust the Finding’s Priority and Risk level:
-
-* Whether or not the Finding has an EPSS score, this is automatically added to Findings and kept up to date for Pro users
-* How many Endpoints in the Product are affected by this Finding
-* Whether or not a Finding is Under Review
-* Whether the Finding is in the KEV (Known Exploited Vulnerabilities) database, which is checked by DefectDojo on a regular basis
-* The tool-reported Severity of a Finding (Info, Low, Medium, High, Critical)
-
-
-## Finding Risk Calculation
-
-
-
-The Risk column on a Findings table is another way to quickly prioritize Findings. Risk is calculated using a Finding's Priority level, but also factors in a Finding's exploitability to a greater degree. This is meant as a less granular, more 'executive-level' version of Priority.
-
-The four assignable Risk levels are:
-
-
-
-A Finding's EPSS / exploitability is much more emphasized in the Risk calculation. As a result, a Finding can have both a high priority and a low risk value.
-
-As with Finding Priority, the Risk calculation cannot currently be adjusted.
-
-## Priority Insights Dashboard
-
-Users can take an executive-level view of Priority and Risk in their environment using
-the Priority Insights Dashboard (Metrics > Priority Insights in the sidebar)
-
-
-
-This dashboard can be filtered to include specific Products or date ranges. As with
-other Pro dashboards, this dashboard can be exported from DefectDojo as a PDF to
-quickly produce a report.
-
-## Setting Priority & Risk for Regulatory Compliance
-
-This is a non-exhaustive list of regulatory standards that specifically require
-vulnerability prioritization methods:
-
-* [SOX (Sarbanes-Oxley Act](https://www.sarbanes-oxley-act.com/)) compliance requires revenue-based prioritization for
-systems impacting financial data. In DefectDojo, a system’s revenue can be entered
-at the Product level.
-* [PCI DSS](https://www.pcisecuritystandards.org/standards/pci-dss/) compliance requires prioritization based on risk ratings and criticality to
-cardholder data environments. Business Criticality and External Audience can be
-set at the Product level, while DefectDojo’s Finding-level EPSS sync supports PCI’s
-risk-based approach.
-* [NIST SP 800-40](https://csrc.nist.gov/pubs/sp/800/40/r4/final) is a preventative maintenance guide which specifically calls for
-vulnerability prioritization based on business impact, product criticality and
-internet accessibility factors. All of these can be set at DefectDojo’s Product level.
-* [ISO 27001/27002](https://www.iso.org/standard/27001) Control A.12.6.1 compliance requires management of technical
-vulnerabilities with Priority based on risk assessment.
-* [GDPR Article 32](https://gdpr-info.eu/art-32-gdpr/) requires risk-based security measures - user records and external
-audience flags at the Product level can help prioritize systems in your organization
-that process personal data.
-* [FISMA/FedRAMP](https://help.fedramp.gov/hc/en-us) compliance require continuous monitoring and risk-based vulnerability remediation.
\ No newline at end of file
diff --git a/docs/content/en/working_with_findings/findings_workflows/manage_duplicate_findings.md b/docs/content/en/working_with_findings/findings_workflows/manage_duplicate_findings.md
deleted file mode 100644
index b1eac050c2f..00000000000
--- a/docs/content/en/working_with_findings/findings_workflows/manage_duplicate_findings.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-title: "Manage Duplicate Findings"
-description: "How to discover and correct redundancies in your workflow - using Deduplication, Reimiport and other Smart features"
-weight: 3
----
-
-One of DefectDojo’s strengths is that the data model can accommodate many different use\-cases and applications. You’ll likely change your approach as you master the software and discover ways to optimize your workflow.
-
-By default, DefectDojo does not delete any duplicate Findings that are created. Each Finding is considered to be a separate instance of a vulnerability. So in this case, **Duplicate Findings** can be an indicator that a process change is required to your workflow.
-
-## Step 1: Clean up your excess Duplicates
-
-Fortunately, DefectDojo’s Deduplication settings allow you to mass\-delete duplicates once a certain threshold has been crossed. This feature makes the cleanup process easier. To learn more about this process, see our article on **Finding Deduplication** \<\-link will go here.
-
-## Step 2: Evaluate your Engagements for redundancies
-
-Once you’ve cleaned up your duplicate Findings, it’s a good practice to look at the Product which contained them to see if there’s a clear culprit. You might find that there are Engagements contained within which have a redundant context.
-
-### Duplicate or Reused Engagements
-
-Engagements store one or more Tests for a particular testing context. That context is ultimately up to you to define for yourself, but if you see a few Engagements within your Product which should share the same context, consider combining them into a single engagement.
-
-### Questions to ask when defining Engagement context:
-
-* If I wanted to make a report on this work, would the Engagement contain all of the relevant information I need?
-* Are we proactively creating Engagements ahead of time or are they being created ‘ad\-hoc’ by my import process?
-* Are we using the right kind of Engagement \- **Interactive** or **CI/CD**?
-* What section of the codebase is being worked on by tests: is each repository a separate context or could multiple repositories make up a shared context for testing?
-* Who are the stakeholders involved with the Productt, and how will I share results with them?
-
-## Step 3: Check for redundant Tests
-
-If you discover that separate Tests have been created which capture the same testing context, this may be an indicator that these tests can be consolidated into a single Reimport.
-
-DefectDojo has two methods for importing test data to create Findings: **Import** and **Reimport**. Both of these methods are very similar, but the key difference between the two is that **Import** always creates a new Test, while **Reimport** can add new data to an existing Test. It’s also worth noting that **Reimport** does not create duplicate Findings within that Test.
-
-Each time you import new vulnerability reports into DefectDojo, those reports will be stored in a Test object. A Test object can be created by a user ahead of time to hold a future **Import**. If a user wants to import data without specifying a Test destination, a new Test will be created to store the incoming report.
-
-Tests are flexible objects, and although they can only hold one *kind* of report, they can handle multiple instances of that same report through the **Reimport** method. To learn more about Reimport, see our **[article](/en/connecting_your_tools/import_scan_files/using_reimport)** on this topic.
-
-## When are Duplicate Findings acceptable?
-
-Duplicate Findings are not always indicative of a problem. There are many cases where keeping duplicates is the preferred approach. For example:
-
-* If your team uses and reports on Interactive Engagements. If you want to create a discrete report on a single Test specifically, you would want to know if there’s an occurrence of a Finding that was already uncovered earlier.
-* If you have Engagements which are contextually separated (for example, because they cover different repositories) you would want to be able to flag Findings which are occurring in both places.
diff --git a/docs/content/en/working_with_findings/priority_adjustments.md b/docs/content/en/working_with_findings/priority_adjustments.md
deleted file mode 100644
index 2ea030b61c2..00000000000
--- a/docs/content/en/working_with_findings/priority_adjustments.md
+++ /dev/null
@@ -1,62 +0,0 @@
----
-title: "Adjusting Priority and Risk (Pro)"
-description: "Change weighting of Priority and Risk calculations"
-weight: 2
----
-
-DefectDojo Pro's Priority and Risk calculations can be adjusted, allowing you to tailor DefectDojo Pro to match your internal standards for Finding Priority and Risk.
-
-## Prioritization Engines
-
-Similar to SLA configurations, Prioritization Engines allow you to set the rules governing how Priority and Risk are calculated.
-
-
-
-DefectDojo comes with a built-in Prioritization Engine, which is applied to all Products. However, you can edit this Prioritization Engine to change the weighting of **Finding** and **Product** multipliers, which will adjust how Finding Priority and Risk are assigned.
-
-### Finding Multipliers
-
-Eight contextual factors impact the Priority score of a Finding. Three of these are Finding-specific, and the other five are assigned based on the Product that holds the Finding.
-
-You can tune your Prioritization Engine by adjusting how these factors are applied to the final calculation.
-
-
-
-Select a factor by clicking the button, and adjust this slider allows you to control the percentage a particular factor is applied. As you adjust the slider, you'll see the Risk thresholds change as a result.
-
-#### Finding-Level Multipliers
-
-* **Severity** - a Finding's Severity level
-* **Exploitability** - a Finding's KEV and/or EPSS score
-* **Endpoints** - the amount of Endpoints associated with a Finding
-
-#### Product-Level Multipliers
-
-* **Business Criticality** - the related Product's Business Criticality (None, Very Low, Low, Medium, High, or Very
-High)
-* **User Records** - the related Product's User Records count
-* **Revenue** - the related Product's revenue, relative to the total revenue of the Product Type
-* **External Audience** - whether or not the related Product has an external audience
-* **Internet Accessible** - whether or not the related Product is internet accessible
-
-### Risk Thresholds
-
-Based on the tuning of the Priority Engine, DefectDojo will automatically recommend Risk Thresholds. However, these thresholds can be adjusted as well and set to whatever values you deem appropriate.
-
-
-
-## Creating New Prioritization Engines
-
-You can use multiple Prioritization Engines, which can each be assigned to different Products.
-
-
-
-Creating a new Prioritization Engine will open the Prioritization Engine form. Once this form is submitted, a new Prioritization Engine will be added to the table.
-
-## Assigning Prioritization Engines to Products
-
-Each Product can have a Prioritization Engine currently in use via the **Edit Product** form for a given Product.
-
-
-
-Note that when a Product's Prioritization Engine is changed, or a Prioritization Engine is updated, the Product's Prioritization Engine or the Prioritization Engine itself will be "Locked" until the prioritization calculation has completed.
\ No newline at end of file
diff --git a/docs/content/en/_index.md b/docs/content/get_started/_index.md
similarity index 93%
rename from docs/content/en/_index.md
rename to docs/content/get_started/_index.md
index e288c34b9a2..d2f4ac74f16 100644
--- a/docs/content/en/_index.md
+++ b/docs/content/get_started/_index.md
@@ -1,5 +1,5 @@
---
-title: "Index"
+title: "Get Started"
date: 2021-02-02T20:46:29+01:00
draft: false
type: docs
diff --git a/docs/content/get_started/about/OS__new_user_checklist.md b/docs/content/get_started/about/OS__new_user_checklist.md
new file mode 100644
index 00000000000..ebf29ec20f8
--- /dev/null
+++ b/docs/content/get_started/about/OS__new_user_checklist.md
@@ -0,0 +1,28 @@
+---
+title: "☑️ New User Checklist"
+description: "Get Started With DefectDojo"
+draft: "false"
+weight: 3
+audience: opensource
+---
+
+Here's a quick reference you can use to ensure successful implementation, from a blank canvas to a fully functional app. This article assumes you have **DefectDojo Community Edition** installed and running in your environment.
+
+The essence of DefectDojo is to import security data, organize it, and present it to the folks who need to know. Here are ways to achieve those things in DefectDojo Open-Source:
+
+### DefectDojo Open-Source
+
+1. Open-Source users can start by creating their first [Product Type and Product](/asset_modelling/hierarchy/product_hierarchy/). Once those are created, they can [import a file](/import_data/import_scan_files/os__import_scan_ui/) to one of those Products using the UI.
+
+2. Now that you have data in DefectDojo, consider expanding your Product layout [Product Hierarchy Overview](/asset_modelling/hierarchy/product_hierarchy/). The Product Hierarchy creates a working inventory of your apps, which helps you divide your data up into logical categories. These categories can be used to apply access control rules, or to segment your reports to the correct team.
+
+3. Use the [Report Builder](/metrics_reports/reports/using_the_report_builder/#opening-the-report-builder) to summarize the data you've imported. Reports can be used to quickly share Findings with stakeholders such as Product Owners.
+
+This is the essence of DefectDojo - import security data, organize it, and present it to the folks who need to know.
+
+All of these features can be automated, and because DefectDojo can handle over 200 tools (at time of writing) you should be all set to create a functional security inventory of your entire organizational output.
+
+### Open-Source Features
+- Does your organization use Jira? Learn how to use our [Jira integration](/issue_tracking/jira/jira_guide/) to create Jira tickets from the data you ingest.
+- Are you expecting to share DefectDojo with many users in your organization? Check out our guides to [user management](/admin/user_management/about_perms_and_roles/) and set up role-based access control (RBAC).
+- Ready to dive into automation? Learn how to use the [DefectDojo API](/import_data/import_scan_files/api_pipeline_modelling/) to automatically import new data, and build a robust CI/CD pipeline.
\ No newline at end of file
diff --git a/docs/content/get_started/about/PRO__new_user_checklist.md b/docs/content/get_started/about/PRO__new_user_checklist.md
new file mode 100644
index 00000000000..bb321882b24
--- /dev/null
+++ b/docs/content/get_started/about/PRO__new_user_checklist.md
@@ -0,0 +1,26 @@
+---
+title: "☑️ New User Checklist"
+description: "Get Started With DefectDojo"
+draft: "false"
+weight: 3
+audience: pro
+---
+
+The essence of DefectDojo is to import security data, organize it, and present it to the folks who need to know. Here's a quick reference you can use to ensure successful implementation, from a blank canvas to a fully functional app.
+
+### Discover DefectDojo
+
+1. Start by [importing a file](/import_data/import_scan_files/pro__import_scan_ui/) using the UI. This is generally the quickest way to see how your data fits into the DefectDojo model.
+
+2. Now that you have data in DefectDojo, learn more about how to organize it with the [Product Hierarchy Overview](/asset_modelling/hierarchy/product_hierarchy/). The Product Hierarchy creates a working inventory of your apps, which helps you divide your data into logical categories, apply access control rules, sort Findings by [Priority and Risk](/asset_modelling/hierarchy/pro__priority_sla/) or to segment your reports to the correct team.
+
+3. Check out your [Metrics pages](/metrics_reports/pro_metrics/pro__overview/) which can be used to quickly share Finding reports with key stakeholders.
+
+This is the essence of DefectDojo - import security data, organize it, and present it to the folks who need to know.
+
+All of these features can be automated, and because DefectDojo can handle over 200 tools (at time of writing) you should be all set to create a functional security inventory of your entire organizational output.
+
+### Pro Features
+- If your organization uses Jira, ServiceNow, AzureDevops, GitHub or GitLab for issue tracking, check out our [documentation](/issue_tracking/intro/intro/) on those integrations.
+- Customize your [main Dashboard](/metrics_reports/dashboards/introduction_dashboard/) with filtered tiles to view your environment at a glance.
+- Learn how to rapidly import data and mirror your team's existing security environment with [Connectors](/import_data/pro/connectors/about_connectors/).
diff --git a/docs/content/get_started/about/_index.md b/docs/content/get_started/about/_index.md
new file mode 100644
index 00000000000..c6e4d60e318
--- /dev/null
+++ b/docs/content/get_started/about/_index.md
@@ -0,0 +1,5 @@
+---
+title: "About DefectDojo"
+date: 2021-02-02T20:46:29+01:00
+weight: 1
+---
diff --git a/docs/content/en/about_defectdojo/about_docs.md b/docs/content/get_started/about/about_defectdojo.md
similarity index 79%
rename from docs/content/en/about_defectdojo/about_docs.md
rename to docs/content/get_started/about/about_defectdojo.md
index ddc1baf94d2..d86ae4c646a 100644
--- a/docs/content/en/about_defectdojo/about_docs.md
+++ b/docs/content/get_started/about/about_defectdojo.md
@@ -1,5 +1,5 @@
---
-title: "About Our Documentation"
+title: "About DefectDojo"
date: 2021-02-02T20:46:29+01:00
draft: false
type: docs
@@ -58,8 +58,8 @@ For teams managing a smaller volume of Findings, DefectDojo Open-Source is a gre
There are a few supported ways to install DefectDojo’s Open-Source edition ([available on Github](https://github.com/DefectDojo/django-DefectDojo)):
[Docker Compose](https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/DOCKER.md) is the easiest method to install the core program and services required to run DefectDojo.
-Our [Architecture](https://docs.defectdojo.com/en/open_source/installation/architecture/) guide gives you an overview of each service and component used by DefectDojo.
-[Running In Production](https://docs.defectdojo.com/en/open_source/installation/running-in-production/) lists system requirements, performance tweaks and maintenance processes for running DefectDojo on a production server (with Docker Compose).
+Our [Architecture](https://docs.defectdojo.com/open_source/installation/architecture/) guide gives you an overview of each service and component used by DefectDojo.
+[Running In Production](https://docs.defectdojo.com/open_source/installation/running-in-production/) lists system requirements, performance tweaks and maintenance processes for running DefectDojo on a production server (with Docker Compose).
Kubernetes is not fully supported at the Open-Source level, but this guide can be referenced and used as a starting point to integrate DefectDojo into Kubernetes architecture.
@@ -71,12 +71,12 @@ If you run into trouble with an Open-Source install, we highly recommend asking
DefectDojo Inc. hosts a Pro edition of this software for commercial purposes. Along with a sleek, modern UI, DefectDojo Pro includes:
-* [Connectors](/en/connecting_your_tools/connectors/about_connectors/): out-of-the-box API integrations with enterprise-level scanners (such as Checkmarx One, BurpSuite, Semgrep and more)
-* **Configurable Import Methods**: [Universal Parser](/supported_tools/parsers/universal_parser/), [Smart Upload](/en/connecting_your_tools/import_scan_files/smart_upload/)
-* **[CLI Tools](/en/connecting_your_tools/external_tools/)** for rapid integration with your systems
-* **[Additional Project Tracking Integrations](/en/share_your_findings/integrations/)**: ServiceNow, Azure DevOps, GitHub and GitLab
-* **[Improved Metrics](/en/customize_dojo/dashboards/pro_dashboards/)** for executive reporting and high-level analysis
-* **[Priority And Risk](/en/working_with_findings/finding_priority/)** to identify the Findings of highest urgency, system-wide
+* [Connectors](/import_data/pro/connectors/about_connectors/): out-of-the-box API integrations with enterprise-level scanners (such as Checkmarx One, BurpSuite, Semgrep and more)
+* **Configurable Import Methods**: [Universal Parser](/supported_tools/parsers/universal_parser/), [Smart Upload](/import_data/pro/specialized_import/smart_upload/)
+* **[CLI Tools](/import_data/pro/specialized_import/external_tools/)** for rapid integration with your systems
+* **[Additional Project Tracking Integrations](/issue_tracking/intro/intro/)**: ServiceNow, Azure DevOps, GitHub and GitLab
+* **[Improved Metrics](/metrics_reports/pro_metrics/pro__overview/)** for executive reporting and high-level analysis
+* **[Priority And Risk](/asset_modelling/hierarchy/pro__priority_sla/)** to identify the Findings of highest urgency, system-wide
* **Premium Support** and implementation guidance for your organization
The Pro edition is available as a cloud-hosted SaaS offering, and is also available for installation on-premises.
@@ -105,8 +105,7 @@ A running example of DefectDojo Pro is available at
Whether you’re a Pro or an Open-Source user, we have many resources to help you get started with DefectDojo.
-* Our [New User Checklist](/en/about_defectdojo/new_user_checklist/) covers the fundamentals of setting up your DefectDojo environment and establishing your import, triage and reporting workflows.
-* Review our supported [security tool integrations](/en/connecting_your_tools/parsers/) to help fit DefectDojo in your DevSecOps program.
+* Review our supported [security tool integrations](/supported_tools/) to help fit DefectDojo in your DevSecOps program.
* Our team maintains a [YouTube Channel](https://www.youtube.com/@defectdojo) which hosts tutorials, archived Office Hours events, and other content.
## Connect With Us
diff --git a/docs/content/get_started/about/defectdojo_versions.md b/docs/content/get_started/about/defectdojo_versions.md
new file mode 100644
index 00000000000..550dfa1eba0
--- /dev/null
+++ b/docs/content/get_started/about/defectdojo_versions.md
@@ -0,0 +1,30 @@
+---
+title: "Feature comparison"
+date: 2021-02-02T20:46:29+01:00
+draft: false
+type: docs
+weight: 1
+---
+
+**DefectDojo Open-Source** is a powerful, free vulnerability management platform with core importing, deduplication, basic dashboards, API access, and essential reporting — ideal for smaller teams or those wanting to self-host and extend the tool using community resources.
+
+**DefectDojo Pro** builds on that foundation with enterprise-oriented features such as advanced dashboards and reporting, automation and scripting via rules engine, connectors to many security tools, optimized import workflows, unified SOC & AppSec support, improved UI/UX, AI integration, enhanced security (SSO/MFA), and premium support options.
+
+| Feature / Capability | DefectDojo Open-Source | DefectDojo Pro |
+|---------------------|------------------------|----------------|
+| Core vulnerability management | ✔️ Import, track, and manage findings from 200+ security tools | ✔️ Everything in open-source, optimized for scale |
+| Finding deduplication | ✔️ Standard deduplication | ✔️ Advanced, configurable deduplication |
+| REST API | ✔️ Full REST API | ✔️ Full REST API |
+| Authentication & access control | ✔️ Local auth and basic RBAC | ✔️ SSO (SAML/OAuth), MFA, advanced RBAC |
+| User interface | ✔️ Community UI | ✔️ Modern Pro UI with performance improvements |
+| Dashboards & reporting | ✔️ Basic dashboards and reports | ✔️ Advanced, customizable dashboards and executive reporting |
+| Automation & workflows | ❌ Not included | ✔️ Rules Engine and automated workflows |
+| Import enhancements | ❌ Standard imports only | ✔️ Background imports, Smart Upload, Universal Parser, CLI uploads |
+| Tool integrations | ❌ Manual/API-driven | ✔️ Built-in **API Connectors** for popular AppSec and cloud tools |
+| Jira integration | ✔️ Included | ✔️ Included |
+| Project management integrations | ❌ Not included | ✔️ integrate with **Azure Devops**, **GitHub**, **GitLab** and **ServiceNow** |
+| Finding enhancements | ❌ Not included | ✔️ Automatic KEV, EPSS scoring and Ransomware tracking |
+| SOC & AppSec unification | ❌ AppSec-focused only | ✔️ Unified AppSec and SOC findings |
+| AI & next-generation features | ❌ Not included | ✔️ AI-assisted workflows, reporting and MCP support |
+| Support | Community support (GitHub, Slack, forums) | Commercial support with SLAs |
+| Hosting options | Self-hosted | Self-hosted or cloud-hosted |
\ No newline at end of file
diff --git a/docs/content/get_started/about/demo.md b/docs/content/get_started/about/demo.md
new file mode 100644
index 00000000000..4f945ff5905
--- /dev/null
+++ b/docs/content/get_started/about/demo.md
@@ -0,0 +1,20 @@
+---
+title: "Online Demo"
+description: "There is DefectDojo demo site running the latest officially released version"
+draft: false
+weight: 6
+---
+
+Two online demos are available for DefectDojo. Both come pre-loaded with data and are fully functional, running the latest version of DefectDojo.
+
+Demo servers are reset on a daily basis, and are publicly accessible; do not put sensitive data in the demo.
+
+### 🔸 DefectDojo Pro Demo
+DefectDojo Pro can be tested at [pro.demo.defectdojo.org](https://pro.demo.defectdojo.org)
+
+Log in with `admin / 1Defectdojo@demo#appsec`.
+
+### 🔹 DefectDojo Community Edition Demo
+Our community edition can be tested at [demo.defectdojo.org](https://demo.defectdojo.org)
+
+Log in with `admin / 1Defectdojo@demo#appsec`.
diff --git a/docs/content/en/about_defectdojo/faq.md b/docs/content/get_started/about/faq.md
similarity index 55%
rename from docs/content/en/about_defectdojo/faq.md
rename to docs/content/get_started/about/faq.md
index f94ebceab3d..4f668222763 100644
--- a/docs/content/en/about_defectdojo/faq.md
+++ b/docs/content/get_started/about/faq.md
@@ -12,7 +12,7 @@ Here are some frequently asked questions about working with DefectDojo - both in
### How should I organize my security testing in DefectDojo?
-While DefectDojo can support any security or testing environment, everyone’s security team and operations look different, so there’s no one-size-fits-all approach to using it. We have a very detailed article on [common use cases](/en/about_defectdojo/examples_of_use) that has examples of how different organizations apply RBAC and the DefectDojo data model to support their needs.
+While DefectDojo can support any security or testing environment, everyone’s security team and operations look different, so there’s no one-size-fits-all approach to using it. We have a very detailed article on [common use cases](/get_started/common_use_cases/common_use_cases/) that has examples of how different organizations apply RBAC and the DefectDojo data model to support their needs.
### What are the recommended workflows for security testing in DefectDojo?
@@ -20,9 +20,9 @@ DefectDojo is meant to be the central source of truth for your organization's se
- Allowing users to identify duplicate findings across scans and tools, minimizing alert fatigue.
- Enforcing SLAs on vulnerabilities, ensuring that your organization handles each Finding within an appropriate timeframe.
-- Sending tickets to [Jira](/en/share_your_findings/jira_guide/), ServiceNow or other Project Tracking software, allowing your development team to integrate issue remediation into their standard release process without requiring them to learn another project management tool.
-- Integrating into automated [CI/CD pipelines](/en/connecting_your_tools/import_scan_files/api_pipeline_modelling/) to automatically ingest report data from repositories, even down to the branch level.
-- Creating [reports](/en/share_your_findings/pro_reports/using_the_report_builder/) on any set of vulnerabilities or software context, to quickly share scan results or status updates with stakeholders.
+- Sending tickets to [Jira](/issue_tracking/jira/jira_guide/), ServiceNow or other Project Tracking software, allowing your development team to integrate issue remediation into their standard release process without requiring them to learn another project management tool.
+- Integrating into automated [CI/CD pipelines](/import_data/import_scan_files/api_pipeline_modelling/) to automatically ingest report data from repositories, even down to the branch level.
+- Creating [reports](/metrics_reports/reports/using_the_report_builder/) on any set of vulnerabilities or software context, to quickly share scan results or status updates with stakeholders.
- Establishing acceptance and mitigation workflows, supporting formal risk-management tracking.
@@ -32,36 +32,34 @@ DefectDojo is designed to support and standardize your current security workflow
DefectDojo Pro expands on the above workflows further, adding:
-- An [improved UI](/en/about_defectdojo/ui_pro_vs_os/) designed for speed and efficiency when navigating through enterprise-level data volumes. It also includes a dark mode.
-- The ability to [pre-triage your Findings](/en/working_with_findings/finding_priority/) by Priority and Risk, allowing your team to identify and fix your most critical issues first.
-- A [Rules Engine](/en/customize_dojo/rules_engine/) to script automated bulk actions and build custom workflows to handle Findings and other objects, no programming experience required.
-- [Enhanced report and metrics generation capabilities](/en/about_defectdojo/ui_pro_vs_os/#new-dashboards) to easily share the security posture of your apps and repos.
-- [Advanced deduplication settings](/en/working_with_findings/finding_deduplication/tune_deduplication/) to fine-tune how DefectDojo identifies and manages duplicate findings.
+- An [improved UI](/get_started/about/ui_pro_vs_os/) designed for speed and efficiency when navigating through enterprise-level data volumes. It also includes a dark mode.
+- The ability to [pre-triage your Findings](/asset_modelling/hierarchy/pro__priority_sla/) by Priority and Risk, allowing your team to identify and fix your most critical issues first.
+- A [Rules Engine](/automation/rules_engine/about) to script automated bulk actions and build custom workflows to handle Findings and other objects, no programming experience required.
+- [Enhanced report and metrics generation capabilities](/get_started/about/ui_pro_vs_os/#new-dashboards) to easily share the security posture of your apps and repos.
+- [Advanced deduplication settings](/triage_findings/finding_deduplication/pro__deduplication_tuning/) to fine-tune how DefectDojo identifies and manages duplicate findings.
- Streamlined import capabilities, such as:
- An optimized upload method which processes Findings in the background.
- - The ability to quickly build a [command-line pipeline](/en/connecting_your_tools/external_tools/) using our Universal Importer and DefectDojo CLI apps, allowing you to easily import, reimport, and export data to your DefectDojo Pro instance.
- - A [Universal Parser](/en/connecting_your_tools/parsers/universal_parser/) to turn any .json or .csv report into an actional set of Findings and have DefectDojo Pro will parse the data however you like.
- - [Connectors](/en/connecting_your_tools/connectors/about_connectors/), which provide an instant connection to supported tools to import new Finding data so you can get an automated Import pipeline established without the need to set up any API calls or cron jobs.
-
-Further information regarding DefectDojo Pro’s capabilities can be found [here](/en/about_defectdojo/pro_features/).
+ - The ability to quickly build a [command-line pipeline](/import_data/pro/specialized_import/external_tools/) using our Universal Importer and DefectDojo CLI apps, allowing you to easily import, reimport, and export data to your DefectDojo Pro instance.
+ - A [Universal Parser](/import_data/pro/specialized_import/universal_parser/) to turn any .json or .csv report into an actional set of Findings and have DefectDojo Pro will parse the data however you like.
+ - [Connectors](/import_data/pro/connectors/about_connectors/), which provide an instant connection to supported tools to import new Finding data so you can get an automated Import pipeline established without the need to set up any API calls or cron jobs.
### How does DefectDojo handle access control?
-DefectDojo can be used by large teams, and setting up [RBAC (Rule Based Access Control)](/en/customize_dojo/user_management/about_perms_and_roles/) is highly recommended, both to properly establish context for each team member, and to control access to certain parts of Infrastructure.
+DefectDojo can be used by large teams, and setting up [RBAC (Rule Based Access Control)](/admin/user_management/about_perms_and_roles/) is highly recommended, both to properly establish context for each team member, and to control access to certain parts of Infrastructure.
-Role and permission assignment generally happens at the Product Type / Product level. Each team member can be assigned to one or more Products or Product Types, and can be given a role which governs how they can interact with the vulnerability data within (read only, read-write, or full control). For more information, see our [RBAC guide](/en/customize_dojo/user_management/about_perms_and_roles/).
+Role and permission assignment generally happens at the Product Type / Product level. Each team member can be assigned to one or more Products or Product Types, and can be given a role which governs how they can interact with the vulnerability data within (read only, read-write, or full control). For more information, see our [RBAC guide](/admin/user_management/about_perms_and_roles/).
### How does DefectDojo handle access control for a team of users?
-Whether you’re a one-person security team for a small organization or a CISO overseeing a swath of software projects,you can easily organize [Role-Based Access Control (RBAC)](/en/customize_dojo/user_management/about_perms_and_roles/) in order to properly establish context for each team member and control access to certain parts of Infrastructure.
+Whether you’re a one-person security team for a small organization or a CISO overseeing a swath of software projects,you can easily organize [Role-Based Access Control (RBAC)](/admin/user_management/about_perms_and_roles/) in order to properly establish context for each team member and control access to certain parts of Infrastructure.
-Generally, role and permission assignment happens at the [Product Type/Product level](/en/working_with_findings/organizing_engagements_tests/product_hierarchy/). Each team member can be given a role pertaining to one or more Products or Product Types that governs how they can interact with the vulnerability data within (e.g., read only, read-write, or full control).
+Generally, role and permission assignment happens at the [Product Type/Product level](/asset_modelling/hierarchy/product_hierarchy/). Each team member can be given a role pertaining to one or more Products or Product Types that governs how they can interact with the vulnerability data within (e.g., read only, read-write, or full control).
## Import Workflows
### What tools are supported by DefectDojo?
-DefectDojo supports reports from [over 200](/en/connecting_your_tools/parsers/) commercial and open-source security security tools.
+DefectDojo supports reports from [over 200](/supported_tools/) commercial and open-source security security tools.
If you're looking to add a new tool to your suite, we have a list of recommended Open-Source tools which you can check out [here](https://defectdojo.com/blog/announcing-the-defectdojo-open-source-security-awards).
@@ -69,8 +67,8 @@ If you're looking to add a new tool to your suite, we have a list of recommended
There are two different methods to import a single report from a security tool:
-- **[Import](/en/connecting_your_tools/import_scan_files/import_scan_ui/)** handles the report as a single point-in-time record. Importing a report creates a Test containing the resulting Findings.
-- **[Reimport](/en/connecting_your_tools/import_scan_files/using_reimport/)** is used to update an existing Test with a new set of results. If you have a more open-ended approach to your testing process, you can continuously Reimport the latest version of your report to an existing Test. DefectDojo will compare the results of the incoming report to your existing data, record any changes, and then adjust the Findings in the Test to match the latest report.
+- **Import** handles the report as a single point-in-time record. Importing a report creates a Test containing the resulting Findings.
+- **[Reimport](/import_data/import_intro/import_vs_reimport/)** is used to update an existing Test with a new set of results. If you have a more open-ended approach to your testing process, you can continuously Reimport the latest version of your report to an existing Test. DefectDojo will compare the results of the incoming report to your existing data, record any changes, and then adjust the Findings in the Test to match the latest report.
To understand the difference, it’s helpful to think of Import as recording a single instance of a scan event, and Reimport as updating a continual record of scanning.
@@ -82,11 +80,11 @@ Generally speaking, if a point-in-time report is what you need, Import is the be
### How can I troubleshoot Import errors?
-DefectDojo supports a wide variety of tools. If you’re seeing inconsistent behavior when importing a report, we recommend checking if the file structure matches what the tool is expecting. See our [Parser List](/en/connecting_your_tools/parsers/) to confirm that your tool is supported, and check to make sure that the file format matches what the tool expects. You can also compare the structure to our Unit Tests.
+DefectDojo supports a wide variety of tools. If you’re seeing inconsistent behavior when importing a report, we recommend checking if the file structure matches what the tool is expecting. See our [Parser List](/supported_tools/) to confirm that your tool is supported, and check to make sure that the file format matches what the tool expects. You can also compare the structure to our Unit Tests.
DefectDojo Pro has a Universal Parser import method which allows you to handle any JSON, CSV or XML file. DefectDojo OS users can write custom parsers for the same purpose.
-Finally, third-party report formats have been known to change without warning: Our OS community greatly appreciates [PRs and contributions](/en/open_source/contributing/how-to-write-a-parser/) to keep our parsers up to date.
+Finally, third-party report formats have been known to change without warning: Our OS community greatly appreciates [PRs and contributions](/open_source/contributing/how-to-write-a-parser/) to keep our parsers up to date.
### How should I handle large scan files?
@@ -98,9 +96,9 @@ DefectDojo Pro can process reports in the background. However, files still need
### How do I connect a CI/CD pipeline to DefectDojo?
-Many of DefectDojo's core features can be completely automated. CI/CD (or any kind of automated import) can be handled by calling the [DefectDojo REST API](/en/connecting_your_tools/import_scan_files/api_pipeline_modelling/).
+Many of DefectDojo's core features can be completely automated. CI/CD (or any kind of automated import) can be handled by calling the [DefectDojo REST API](/import_data/import_scan_files/api_pipeline_modelling/).
-**DefectDojo Pro** users also have access to the **Universal Importer / DefectDojo CLI** [command-line tools](/en/connecting_your_tools/external_tools/), which can be installed to run in many automated environments.
+**DefectDojo Pro** users also have access to the **Universal Importer / DefectDojo CLI** [command-line tools](/import_data/pro/specialized_import/external_tools/), which can be installed to run in many automated environments.
## Finding Management
@@ -108,14 +106,14 @@ Many of DefectDojo's core features can be completely automated. CI/CD (or any k
Findings can have many statuses. A status of Active or Inactive is always set on a Finding, while other statuses such as Verified, False Positive, or Out Of Scope can be applied at your discretion.
-These statuses are described in more detail in our [Finding Status Definitions](/en/working_with_findings/findings_workflows/finding_status_definitions/) guide, along with information about how they can be used.
+These statuses are described in more detail in our [Finding Status Definitions](/triage_findings/findings_workflows/finding_status_definitions/) guide, along with information about how they can be used.
### How can I delete Findings from DefectDojo?
Generally speaking, we recommend retaining Closed Findings as ‘Inactive’ rather than deleting them outright, as it’s important to maintain historical records in AppSec work. Deleting a Finding will remove all notes and metric-tracking from that Finding outright, which can lead to inaccurate reports or an incomplete archive.
Findings from DefectDojo can be deleted in a few ways:
-- By running a [Bulk Delete](/en/working_with_findings/findings_workflows/editing_findings/#bulk-delete-findings) action on the Findings that you want to delete
+- By running a [Bulk Delete](/triage_findings/findings_workflows/editing_findings/#bulk-delete-findings) action on the Findings that you want to delete
- By calling `DELETE /findings/{id}` through the API
- By deleting a parent object, such as a Test, Engagement, Product Type or Product.
- Note that subclasses are not preserved independently of their parent object: Deleting a parent object such as a Product Type will delete any Products, Engagements, Tests, Findings, and Endpoints within the Product Type. Conversely, deleting an Engagement will preserve the Products, and Product Types that precede it.
@@ -124,12 +122,12 @@ Findings from DefectDojo can be deleted in a few ways:
### How can I generate a report in DefectDojo?
-You can quickly create a customized report in DefectDojo using the [Report Builder](/en/share_your_findings/pro_reports/using_the_report_builder/).
+You can quickly create a customized report in DefectDojo using the [Report Builder](/metrics_reports/reports/using_the_report_builder/).
-DefectDojo Pro users also have access to [executive-level Metrics dashboards](/en/about_defectdojo/ui_pro_vs_os/#new-dashboards) that can report on Product Types, Products or other data in real-time.
+DefectDojo Pro users also have access to [executive-level Metrics dashboards](/get_started/about/ui_pro_vs_os/#new-dashboards) that can report on Product Types, Products or other data in real-time.
### How can I integrate a project management tool with DefectDojo?
-In both Pro and Open-Source editions of DefectDojo, Findings in DefectDojo can be pushed to Jira as Issues, which allows you to integrate issue remediation with your development team. We have a [complete guide to Jira](/en/share_your_findings/jira_guide/) written which describes the process in detail.
+In both Pro and Open-Source editions of DefectDojo, Findings in DefectDojo can be pushed to Jira as Issues, which allows you to integrate issue remediation with your development team. We have a [complete guide to Jira](/issue_tracking/jira/jira_guide/) written which describes the process in detail.
-DefectDojo Pro adds support for [Additional Project Tracking Integrations](/en/share_your_findings/integrations/)**: ServiceNow, Azure DevOps, GitHub and GitLab.
\ No newline at end of file
+DefectDojo Pro adds support for [Additional Project Tracking Integrations](/issue_tracking/intro/intro/)**: ServiceNow, Azure DevOps, GitHub and GitLab.
\ No newline at end of file
diff --git a/docs/content/en/about_defectdojo/ui_pro_vs_os.md b/docs/content/get_started/about/ui_pro_vs_os.md
similarity index 64%
rename from docs/content/en/about_defectdojo/ui_pro_vs_os.md
rename to docs/content/get_started/about/ui_pro_vs_os.md
index 99378ee987b..93bb7204886 100644
--- a/docs/content/en/about_defectdojo/ui_pro_vs_os.md
+++ b/docs/content/get_started/about/ui_pro_vs_os.md
@@ -3,7 +3,7 @@ title: "🎨 Pro UI Changes"
description: "Working with different UIs in DefectDojo"
draft: "false"
weight: 5
-pro-feature: true
+audience: pro
---
In late 2023, DefectDojo Inc. released a new UI for DefectDojo Pro, which is now the default UI for this edition.
@@ -12,7 +12,7 @@ The Pro UI brings the following enhancements to DefectDojo:
- Modern and sleek design using Vue.js.
- Optimized data delivery and load times, especially for large datasets.
-- Access to new Pro features, including [API Connectors](/en/connecting_your_tools/connectors/about_connectors/), [Universal Importer](/en/connecting_your_tools/external_tools/), and [Pro Metrics](https://docs.defectdojo.com/en/customize_dojo/dashboards/pro_dashboards/) views.
+- Access to new Pro features, including [API Connectors](/import_data/pro/connectors/about_connectors/), [Universal Importer](/import_data/pro/specialized_import/external_tools/), and [Pro Metrics](https://docs.defectdojo.com/metrics_reports/pro_metrics/pro__overview/) views.
- Improved UI workflows: better filtering, dashboards, and navigation.
## Switching To The Pro UI
@@ -27,17 +27,17 @@ To access the Pro UI, open your User Options menu from the top-right hand corner
1. The **Sidebar** has been reorganized into four parent categories: Dashboards, Import, Manage, and Settings.
-2. The Homepage, [AI-powered native API connection capabilities](/en/ai/mcp_server_pro/), Pro Metrics, and the Calendar view are all accessible under Dashboards.
+2. The Homepage, [AI-powered native API connection capabilities](/metrics_reports/ai/mcp_server_pro/), Pro Metrics, and the Calendar view are all accessible under Dashboards.
-4. Import methods can be found in the Import section: set up [API Connectors](/en/connecting_your_tools/connectors/about_connectors/), use the [Import Scan](/en/connecting_your_tools/import_scan_files/import_scan_ui/) form to Add Findings, use [Smart Upload](/en/connecting_your_tools/import_scan_files/smart_upload/) to handle infrastructure scanning tools, or use our external tools—[Universal Importer and DefectDojo CLI](/en/connecting_your_tools/external_tools/)—to streamline both the import and reimport processes of Findings and associated objects.
+4. Import methods can be found in the Import section: set up [API Connectors](/import_data/pro/connectors/about_connectors/), use the [Add Findings](/import_data/import_scan_files/pro__import_scan_ui/) form to Add Findings, use [Smart Upload](/import_data/pro/specialized_import/smart_upload/) to handle infrastructure scanning tools, or use our external tools—[Universal Importer and DefectDojo CLI](/import_data/pro/specialized_import/external_tools/)—to streamline both the import and reimport processes of Findings and associated objects.
-5. The **Manage** section allows you to view different objects in the [Product Hierarchy](/en/working_with_findings/organizing_engagements_tests/product_hierarchy/), with views for Product Types, Products, Engagements, Tests, Findings, Risk Acceptances, Endpoints, and Components. There are additional sections for generating reports (Report Builder), using surveys (Surveys), as well as a [Rules Engine](/en/customize_dojo/rules_engine/).
+5. The **Manage** section allows you to view different objects in the [Product Hierarchy](/asset_modelling/hierarchy/product_hierarchy/), with views for Product Types, Products, Engagements, Tests, Findings, Risk Acceptances, Endpoints, and Components. There are additional sections for generating reports (Report Builder), using surveys (Surveys), as well as a [Rules Engine](/automation/rules_engine/about/).
5. The **Settings** section allows you to configure your DefectDojo instance, including your Integrations, License, Cloud Settings, Users, Feature Configuration and admin-level Enterprise Settings.
6. The **Pro Settings** section contains the System Settings, Banner Settings, Notification Settings, Jira Instances, Deduplication Settings, and Authentication Settings, including SAML, OIDC, OAuth, Login, and MFA forms.
-7. The Pro UI also has a **new table format**, used in the [Product Hierarchy](/en/working_with_findings/organizing_engagements_tests/product_hierarchy/) to help with navigation. Each column can be clicked on to apply a relevant filter, and columns can be reordered to present data however you like.
+7. The Pro UI also has a **new table format**, used in the [Product Hierarchy](/asset_modelling/hierarchy/product_hierarchy/) to help with navigation. Each column can be clicked on to apply a relevant filter, and columns can be reordered to present data however you like.
8. The table also has a **"Toggle Columns"** menu which can add or remove columns from the table.
diff --git a/docs/content/get_started/common_use_cases/_index.md b/docs/content/get_started/common_use_cases/_index.md
new file mode 100644
index 00000000000..d5fc6b6ba1e
--- /dev/null
+++ b/docs/content/get_started/common_use_cases/_index.md
@@ -0,0 +1,5 @@
+---
+title: "Common Use Cases"
+date: 2021-02-02T20:46:29+01:00
+weight: 8
+---
diff --git a/docs/content/en/about_defectdojo/examples_of_use.md b/docs/content/get_started/common_use_cases/common_use_cases.md
similarity index 90%
rename from docs/content/en/about_defectdojo/examples_of_use.md
rename to docs/content/get_started/common_use_cases/common_use_cases.md
index 450d28304b7..de2d3c143e5 100644
--- a/docs/content/en/about_defectdojo/examples_of_use.md
+++ b/docs/content/get_started/common_use_cases/common_use_cases.md
@@ -1,5 +1,5 @@
---
-title: "💡 Common Use Cases"
+title: "Common Use Cases"
description: "Use Cases and examples"
draft: "false"
weight: 2
@@ -15,7 +15,6 @@ DefectDojo is designed to handle any security implementation, no matter your sec
### Large Enterprise: RBAC and Engagements
-
‘BigCorp’ is a large multinational enterprise, with a Chief Information Security Officer (CISO) and a centralized IT security group that includes AppSec.
Security at BigCorp is highly centralized. Certain things are delegated out to Business Information Security Officers (BISO).
@@ -38,14 +37,14 @@ Each of these report categories can be handled by a separate Engagement, with a

- If a Product has a CI/CD pipeline, all of the results from that pipeline can be continually imported into a single open-ended Engagement. Each tool used will create a separate Test within the CI/CD Engagement, which can be continuously updated with new data.
-(See our guide to [Reimport](/en/connecting_your_tools/import_scan_files/using_reimport/))
+(See our guide to [Reimport](/import_data/import_intro/import_vs_reimport/))
- Each Pen Test effort can have a separate Engagement created to contain all of the results: e.g. "Q1 Pen Test 2024," "Q2 Pen Test 2024," etc.
- BigCorp will likely want to run their own mock PCI audit so that they're prepared for the real thing. The results of those audits can also be stored as a separate Engagement.
#### RBAC Model
- Each BISO has Reader access assigned for each business unit (Product Type) that they're in charge of.
-- Each Product Owner has Writer access for the Product that they're in charge of. Within their Product, Product Owners can interact with DefectDojo by keeping notes, setting up [CI/CD pipelines](/en/connecting_your_tools/import_scan_files/api_pipeline_modelling/), creating Risk Acceptances and using other features.
+- Each Product Owner has Writer access for the Product that they're in charge of. Within their Product, Product Owners can interact with DefectDojo by keeping notes, setting up [CI/CD pipelines](/import_data/import_scan_files/api_pipeline_modelling/), creating Risk Acceptances and using other features.
- Developers at BigCorp have no access to DefectDojo at all, and they don't need it. The Product Owner can push Jira tickets directly from DefectDojo which contain all of the relevant vulnerability information. The developers are already using Jira, so they don't have to track remediation any differently than a different development task.
### Embedded Systems: Version-Controlled Reporting
@@ -100,13 +99,13 @@ Key Concerns for Kate's Cloud Service:
#### Tagging Shared Services
-Because Kate's model contains many shared services that can impact other Products, the team [Tags](/en/working_with_findings/organizing_engagements_tests/tagging_objects/) their Products to indicate which cloud offerings rely on those services. This allows any issues with shared services to be filtered across Products and reported to the relevant teams. Each of these shared services are in a single Product Type that separates them from the main cloud offerings.
+Because Kate's model contains many shared services that can impact other Products, the team [Tags](/asset_modelling/tags/tagging_objects/) their Products to indicate which cloud offerings rely on those services. This allows any issues with shared services to be filtered across Products and reported to the relevant teams. Each of these shared services are in a single Product Type that separates them from the main cloud offerings.

Because the company is rapidly growing and tech leads are changing frequently, Kate can use Tags to track which tech lead is currently responsible for each cloud product, avoiding the need for constant manual updates to their DefectDojo system. These tech lead associations are tracked by a service that’s external to DefectDojo and can govern the import pipelines or call the DefectDojo API.
-For more information on Tagging, see our guide to [Tags](/en/working_with_findings/organizing_engagements_tests/tagging_objects/).
+For more information on Tagging, see our guide to [Tags](/asset_modelling/tags/tagging_objects/).
#### RBAC Model
@@ -140,7 +139,7 @@ To assist with onboarding new applications, SaaSy software has a standard approa
Each of these Products is further subdivided into Engagements, one for the main branch and one for each branch of development. Tests within these Engagements are used to categorize the testing efforts. Development branches have separate Tests which store the results of CI/CD and SCA scans. The Main branch has those as well, but also adds Tests which store Manual Code Review and Threat Model reports.
-All of these Tests are open-ended and can be updated on a regular basis using Reimport. [Deduplication](/en/working_with_findings/finding_deduplication/about_deduplication/) is only handled at the Engagement level, which prevents Findings in one Code branch from closing Findings in another.
+All of these Tests are open-ended and can be updated on a regular basis using Reimport. [Deduplication](/triage_findings/finding_deduplication/about_deduplication/) is only handled at the Engagement level, which prevents Findings in one Code branch from closing Findings in another.
By applying this model consistently, SaaSy has a model that they can apply to any new software acquisition, and the AppSec team can quickly begin monitoring the data to ensure compliance.
diff --git a/docs/content/get_started/open_source/_index.md b/docs/content/get_started/open_source/_index.md
new file mode 100644
index 00000000000..c2a35d75419
--- /dev/null
+++ b/docs/content/get_started/open_source/_index.md
@@ -0,0 +1,6 @@
+---
+title: "🔹 DefectDojo Community Edition"
+date: 2021-02-02T20:46:29+01:00
+weight: 3
+audience: opensource
+---
diff --git a/docs/content/en/open_source/installation/architecture.md b/docs/content/get_started/open_source/architecture.md
similarity index 96%
rename from docs/content/en/open_source/installation/architecture.md
rename to docs/content/get_started/open_source/architecture.md
index d3085609844..e34e29d089c 100644
--- a/docs/content/en/open_source/installation/architecture.md
+++ b/docs/content/get_started/open_source/architecture.md
@@ -1,8 +1,9 @@
---
-title: "Architecture (Open-Source)"
+title: "System Architecture"
description: "The DefectDojo platform consists of several components that work together closely."
draft: false
weight: 1
+audience: opensource
---

diff --git a/docs/content/en/open_source/installation/configuration.md b/docs/content/get_started/open_source/configuration.md
similarity index 98%
rename from docs/content/en/open_source/installation/configuration.md
rename to docs/content/get_started/open_source/configuration.md
index a06d3fe02be..e97709392e4 100644
--- a/docs/content/en/open_source/installation/configuration.md
+++ b/docs/content/get_started/open_source/configuration.md
@@ -1,8 +1,9 @@
---
-title: "Configuration (Open Source)"
+title: "Configuration"
description: "DefectDojo is highly configurable."
draft: false
-weight: 3
+weight: 2
+audience: opensource
---
## dojo/settings/settings.dist.py
diff --git a/docs/content/en/open_source/installation/installation.md b/docs/content/get_started/open_source/installation.md
similarity index 93%
rename from docs/content/en/open_source/installation/installation.md
rename to docs/content/get_started/open_source/installation.md
index 76345a3801d..105ac4f119a 100644
--- a/docs/content/en/open_source/installation/installation.md
+++ b/docs/content/get_started/open_source/installation.md
@@ -1,8 +1,9 @@
---
-title: "Installation (Open-Source)"
+title: "Installation"
description: "DefectDojo supports various installation options."
draft: false
-weight: 2
+weight: 1
+audience: opensource
---
## **Recommended Options**
diff --git a/docs/content/en/open_source/installation/running-in-production.md b/docs/content/get_started/open_source/running-in-production.md
similarity index 98%
rename from docs/content/en/open_source/installation/running-in-production.md
rename to docs/content/get_started/open_source/running-in-production.md
index 30404e74046..ef96670d11b 100644
--- a/docs/content/en/open_source/installation/running-in-production.md
+++ b/docs/content/get_started/open_source/running-in-production.md
@@ -1,8 +1,9 @@
---
-title: "Running in Production (Open Source)"
+title: "Running in Production"
description: "For use in Production environments, performance tweaks and backups are recommended."
draft: false
weight: 4
+audience: opensource
---
## Production Use (with Docker compose)
diff --git a/docs/content/get_started/pro/cloud/_index.md b/docs/content/get_started/pro/cloud/_index.md
new file mode 100644
index 00000000000..8cc4620d4a0
--- /dev/null
+++ b/docs/content/get_started/pro/cloud/_index.md
@@ -0,0 +1,7 @@
+---
+title: "🔸 DefectDojo Pro (Cloud)"
+date: 2021-02-02T20:46:29+01:00
+weight: 3
+collapsed: true
+audience: pro
+---
diff --git a/docs/content/en/cloud_management/additional-cloud-instance.md b/docs/content/get_started/pro/cloud/additional-cloud-instance.md
similarity index 99%
rename from docs/content/en/cloud_management/additional-cloud-instance.md
rename to docs/content/get_started/pro/cloud/additional-cloud-instance.md
index df9d5785564..806fc9cb9b2 100644
--- a/docs/content/en/cloud_management/additional-cloud-instance.md
+++ b/docs/content/get_started/pro/cloud/additional-cloud-instance.md
@@ -1,7 +1,8 @@
---
title: "Set up an additional Cloud instance"
description: "Add a test, dev, or other DefectDojo instance to your account"
-weight: 2
+weight: 3
+audience: pro
---
The process for adding a second Cloud instance is more or less the same as adding your first instance. This guide assumes you've already set up your initial DefectDojo server, and have an agreement with our Sales team to add another instance.
diff --git a/docs/content/en/cloud_management/connectivity-troubleshooting.md b/docs/content/get_started/pro/cloud/connectivity-troubleshooting.md
similarity index 99%
rename from docs/content/en/cloud_management/connectivity-troubleshooting.md
rename to docs/content/get_started/pro/cloud/connectivity-troubleshooting.md
index 03d423785e4..ed38ce94939 100644
--- a/docs/content/en/cloud_management/connectivity-troubleshooting.md
+++ b/docs/content/get_started/pro/cloud/connectivity-troubleshooting.md
@@ -2,6 +2,7 @@
title: "Connectivity Troubleshooting"
description: "Reconnect to your DefectDojo Instance"
weight: 2
+audience: pro
---
If you have difficulty accessing your DefectDojo instance, here are some steps you can follow to get reconnected:
diff --git a/docs/content/en/cloud_management/using-cloud-manager.md b/docs/content/get_started/pro/cloud/using-cloud-manager.md
similarity index 96%
rename from docs/content/en/cloud_management/using-cloud-manager.md
rename to docs/content/get_started/pro/cloud/using-cloud-manager.md
index 575505bba50..73fe4eca735 100644
--- a/docs/content/en/cloud_management/using-cloud-manager.md
+++ b/docs/content/get_started/pro/cloud/using-cloud-manager.md
@@ -2,6 +2,8 @@
title: "Using the Cloud Manager"
description: "Manage your subscription and account settings"
weight: 1
+collapsed: true
+audience: pro
---
Logging into DefectDojo's Cloud Manager allows you to configure your account settings and manage your subscription with DefectDojo Cloud.
@@ -43,7 +45,7 @@ The Resources page contains a Contact Us form, which you can use to get in touch
## Tools
-The Tools page is one of the places where you can download external Pro tools, such as Universal Importer or DefectDojo CLI. These tools are external add-ons which can be used to quickly build a command-line import pipeline in your network. For more information about these tools, see the [External Tools](../../connecting_your_tools/external_tools/) documentation.
+The Tools page is one of the places where you can download external Pro tools, such as Universal Importer or DefectDojo CLI. These tools are external add-ons which can be used to quickly build a command-line import pipeline in your network. For more information about these tools, see the [External Tools](/import_data/pro/specialized_import/external_tools/) documentation.

diff --git a/docs/content/get_started/pro/onprem/_index.md b/docs/content/get_started/pro/onprem/_index.md
new file mode 100644
index 00000000000..bd18768e7f3
--- /dev/null
+++ b/docs/content/get_started/pro/onprem/_index.md
@@ -0,0 +1,6 @@
+---
+title: "🔸 DefectDojo Pro (On-Premise)"
+date: 2021-02-02T20:46:29+01:00
+weight: 3
+audience: pro
+---
\ No newline at end of file
diff --git a/docs/content/get_started/pro/onprem/installation_options.md b/docs/content/get_started/pro/onprem/installation_options.md
new file mode 100644
index 00000000000..cc4ae95cde1
--- /dev/null
+++ b/docs/content/get_started/pro/onprem/installation_options.md
@@ -0,0 +1,10 @@
+---
+title: "Self-Hosting DefectDojo Pro"
+date: 2021-02-02T20:46:29+01:00
+weight: 4
+audience: pro
+---
+
+DefectDojo Pro can be fully self-hosted in your own environment, giving you complete control over your infrastructure, data, and security posture. This deployment option is ideal for organizations with strict compliance, data residency, or internal security requirements, while still delivering all the advanced capabilities of DefectDojo Pro.
+
+For more information about self-hosting DefectDojo Pro, contact us at [hello@defectdojo.com](mailto:hello@defectdojo.com).
diff --git a/docs/content/en/about_defectdojo/pro_features.md b/docs/content/get_started/pro/pro_features.md
similarity index 77%
rename from docs/content/en/about_defectdojo/pro_features.md
rename to docs/content/get_started/pro/pro_features.md
index 46eaccb9f0d..afdacfb3e71 100644
--- a/docs/content/en/about_defectdojo/pro_features.md
+++ b/docs/content/get_started/pro/pro_features.md
@@ -5,6 +5,7 @@ draft: "false"
weight: 4
chapter: true
exclude_search: true
+audience: pro
---
Here is a list of DefectDojo Pro’s many additional features, along with links to documentation to see them in action:
@@ -20,20 +21,20 @@ See our [Pro UI Guide](../ui_pro_vs_os) for more information.
### Assets/Organizations
-DefectDojo Pro allows for improved organizational visualization for large lists of repositories or other business structures. See [Assets/Organizations documentation](/en/working_with_findings/organizing_engagements_tests/pro_assets_organizations/) for details.
+DefectDojo Pro allows for improved organizational visualization for large lists of repositories or other business structures. See [Assets/Organizations documentation](/asset_modelling/hierarchy/pro__assets_organizations/) for details.

### Finding Priority
DefectDojo Pro can pre-triage your Findings by Priority and Risk, allowing your team to identify and fix your most critical issues first.
-See our [Finding Priority Guide](/en/working_with_findings/finding_priority/) for more details.
+See our [Finding Priority Guide](/asset_modelling/hierarchy/pro__priority_sla/) for more details.
### Rules Engine
DefectDojo Pro's Rules Engine allows you to script automated bulk actions and build custom workflows to handle Findings and other objects, no programming experience required.
-See our [Rules Engine Guide](/en/customize_dojo/rules_engine) for more info.
+See our [Rules Engine Guide](/automation/rules_engine/about) for more info.

@@ -43,13 +44,13 @@ Generate [instant reports and metrics](../ui_pro_vs_os/#new-dashboards) to share
The graphics on the landing page can be exported as SVG files, and the data used to create the graphics can also be exported as a table.
-Additionally, DefectDojo Pro includes several new [insights dashboards](/en/about_defectdojo/ui_pro_vs_os/#new-dashboards), offering enhanced metrics for various audiences of your security program.
+Additionally, DefectDojo Pro includes several new [insights dashboards](/metrics_reports/pro_metrics/pro__overview/), offering enhanced metrics for various audiences of your security program.
### Deduplication Tuning
Advanced Deduplication settings allow you to fine-tune how DefectDojo identifies and manages duplicate findings. Adjust same-tool, **cross-tool**, and reimport Deduplication for precision matching between all your chosen security tools and vulnerability findings.
-See our [Deduplication Tuning Guide](/en/working_with_findings/finding_deduplication/tune_deduplication/) for more information.
+See our [Deduplication Tuning Guide](/triage_findings/finding_deduplication/pro__deduplication_tuning/) for more information.

@@ -57,7 +58,7 @@ See our [Deduplication Tuning Guide](/en/working_with_findings/finding_deduplica
### More Import Options
-DefectDojo Pro includes four additional import methods: [Universal Importer](/en/connecting_your_tools/external_tools/), [API Connectors](/en/connecting_your_tools/connectors/about_connectors/), [Universal Parser](/supported_tools/parsers/universal_parser/), and [Smart Upload](/en/connecting_your_tools/import_scan_files/smart_upload/).
+DefectDojo Pro includes four additional import methods: [Universal Importer](/import_data/pro/specialized_import/external_tools/), [API Connectors](/import_data/pro/connectors/about_connectors/), [Universal Parser](/supported_tools/parsers/universal_parser/), and [Smart Upload](/import_data/pro/specialized_import/smart_upload/).

@@ -70,13 +71,13 @@ For enterprise-level reports, DefectDojo Pro offers an optimized upload method w
Quickly build a command-line pipeline to import, reimport, and export data to your DefectDojo Pro instance using our Universal Importer and DefectDojo-CLI apps; no API scripting necessary (available for Windows, Macintosh, or Linux).
-See our [External Tools Guide](/en/connecting_your_tools/external_tools/) for more information.
+See our [External Tools Guide](/import_data/pro/specialized_import/external_tools/) for more information.
### Connectors
DefectDojo can instantly connect to enterprise-level scanning tools to import new Finding data, creating an automated Import pipeline that works out-of-the-box without the need to set up any API calls or cron jobs.
-See our [Connectors Guide](/en/connecting_your_tools/connectors/about_connectors/) for more information.
+See our [Connectors Guide](/import_data/pro/connectors/about_connectors/) for more information.

@@ -98,7 +99,7 @@ Supported tools for Connectors include:
If you’re using an unsupported/customized scanning tool, or just wish that DefectDojo handled a report slightly differently, use DefectDojo Pro's Universal Parser to turn any .json or .csv report into an actionable set of Findings. Your parser will parse and map the data however you like.
-See our [Universal Parser Guide](/en/connecting_your_tools/universal_parser/) for more information.
+See our [Universal Parser Guide](/import_data/pro/specialized_import/universal_parser//) for more information.

diff --git a/docs/content/en/about_defectdojo/request_a_trial.md b/docs/content/help/contact_sales.md
similarity index 99%
rename from docs/content/en/about_defectdojo/request_a_trial.md
rename to docs/content/help/contact_sales.md
index 18cc2094a93..310b262528e 100644
--- a/docs/content/en/about_defectdojo/request_a_trial.md
+++ b/docs/content/help/contact_sales.md
@@ -1,5 +1,5 @@
---
-title: "Request a DefectDojo Pro Trial"
+title: "Contact Sales"
description: "How to request and work with a trial of DefectDojo Cloud"
draft: "false"
weight: 6
diff --git a/docs/content/en/about_defectdojo/contact_defectdojo_support.md b/docs/content/help/contact_support.md
similarity index 98%
rename from docs/content/en/about_defectdojo/contact_defectdojo_support.md
rename to docs/content/help/contact_support.md
index 521c2c47c4a..02d8d8c8d9d 100644
--- a/docs/content/en/about_defectdojo/contact_defectdojo_support.md
+++ b/docs/content/help/contact_support.md
@@ -1,5 +1,5 @@
---
-title: "Get Support"
+title: "Contact Support"
description: "For Pro users: support@defectdojo.com + other options"
draft: "false"
pro-feature: true
diff --git a/docs/content/help/glossary.md b/docs/content/help/glossary.md
new file mode 100644
index 00000000000..45198c57f43
--- /dev/null
+++ b/docs/content/help/glossary.md
@@ -0,0 +1,75 @@
+---
+title: "Glossary"
+weight: 1
+---
+
+Below is a simple glossary to help understand DefectDojo's various capabilities, along with an indication of whether each defined feature is present/applicable in the Pro version of DefectDojo, the OS version, or both.
+
+## Product Hierarchy (Both)
+The structural model used to organize security data within DefectDojo, consisting of Organizations → Assets → Engagements → Tests → Findings.
+## Organization (Both)
+A top-level hierarchical object that serves as the parent object of Assets in DefectDojo Pro. It provides a shared context for governance, access control, and reporting across all child Assets.
+## Asset (Both)
+A first-class object representing a deployable or logical system entity (e.g., application, host, environment) within Organizations. Assets support parent-child relationships and richer business metadata in the Pro version, but do not support parent-child relationships in the OS version.
+### Asset Hierarchy (Pro)
+A parent-child relationship model between Assets that enables inheritance of context and aggregation of Findings.
+## Engagement (Both)
+A scoped security activity representing a testing window, pipeline, or assessment context.
+## Test (Both)
+A single execution of a scanner or manual assessment within an Engagement. Tests store execution metadata and act as the ingestion point for Findings.
+## Service (Both)
+An optional sub-object used to attribute Findings to a specific component or interface within an Asset. Services are most useful in OS DefectDojo, as their functionality is replicated and enhanced by Asset Hierarchy in the Pro version.
+## Finding (Both)
+The most granular vulnerability object in DefectDojo's Product Hierarchy that represents a discrete security issue.
+### Finding Status (Both)
+The current lifecycle state of a Finding (e.g., Active, Verified, Inactive/Mitigated, Under Review, Risk Accepted, False Positive, Out Of Scope). Finding Status determines inclusion in metrics and dashboards.
+### Finding Priority/Risk (Pro)
+A calculated or derived value that represents remediation urgency by combining severity with contextual factors such as asset criticality or exploitability. Priority is distinct from raw severity and is used for risk-based decision-making.
+### Finding Groups (Both)
+A mechanism for grouping related Findings across Organizations, Assets, or tools. Finding Groups enable consolidated analysis and higher-level reporting.
+## Endpoint (Both)
+A network-reachable location (URL, IP, port) associated with a Finding. Endpoints provide technical exploit context.
+## Import (Both)
+The process of ingesting scan results or manual findings into DefectDojo, typically by uploading a file or submitting data via the API. During import, DefectDojo parses, normalizes, deduplicates, and associates findings with the appropriate Asset, Engagement, Test, and related objects.
+## Reimport (Both)
+The action of ingesting new scan results into an existing Test. Reimporting updates Finding states based on presence or absence in new data.
+## Deduplication (Both)
+The process of correlating incoming Findings with existing ones using hashes and matching logic, enabling historical tracking across scan executions.
+## False Positive (Both)
+A Finding state indicating the issue is invalid or non-exploitable. False positives are retained for auditability but excluded from risk calculations.
+## Risk Acceptance (Both)
+A workflow state indicating an acknowledged but unresolved Finding. Accepted risks remain visible but are excluded from SLA enforcement.
+## Metadata (Both)
+Key data attached to Tests or Findings, such as branch name or build ID, commonly supplied via CI/CD pipelines.
+## CI/CD Integration (Both)
+Automated ingestion of scan results during build or deployment workflows. Integrations typically rely on the API and importer framework.
+## API (Both)
+A RESTful interface used to programmatically manage DefectDojo objects. The API is the primary mechanism for automation and pipeline integration.
+## Webhook (Pro)
+An outbound HTTP callback triggered by specific events (e.g., Finding creation). Webhooks enable real-time integration with external systems.
+## SLA Configuration (Pro)
+Policy definitions that assign remediation deadlines based on severity or risk attributes. SLAs enable enforcement and performance measurement.
+## User Role (Both)
+A permission set defining allowed actions within DefectDojo. Roles enforce access control across Assets and Engagements.
+## Universal Importer (Pro)
+A flexible ingestion mechanism that allows scan data to be imported without a tool-specific importer. It relies on normalized field mapping rather than predefined scanner schemas.
+## DefectDojo-CLI (Pro)
+A command-line interface used to interact with DefectDojo programmatically. The CLI is commonly used in CI/CD pipelines to automate scan uploads and object management.
+## API Connectors (Pro)
+Prebuilt, managed integrations that connect DefectDojo with external platforms (e.g., ticketing, messaging, or DevOps tools). API Connectors reduce the need for custom scripting.
+## Universal Parser (Pro)
+A generalized parsing engine used by the Universal Importer to interpret incoming scan data. It applies consistent normalization and deduplication logic across unsupported formats.
+## Smart Upload (Pro)
+An intelligent ingestion workflow that automatically determines how scan results should be mapped to Assets or Engagements, reducing manual configuration during import.
+## Executive Insights (Pro)
+High-level, business-oriented analytics designed for leadership audiences, focusing on trends, exposure, and program health rather than individual Findings.
+## Priority Insights (Pro)
+Analytical views that surface the most critical risks based on priority scoring rather than severity alone, supporting risk-based remediation planning.
+## Program Insights (Pro)
+Metrics and visualizations that evaluate the effectiveness and maturity of a security program over time. Program Insights emphasize trends, coverage, and operational performance.
+## Tool Insights (Pro)
+Analytics focused on scanner performance, coverage, and contribution to Findings, helping teams optimize tool usage and reduce noise.
+## Rules Engine (Pro)
+A policy-driven automation system that applies conditional logic to Findings during ingestion or lifecycle events, automating severity changes, assignments, or workflows.
+## Integrations (Both)
+Connections between DefectDojo and external tools or platforms for data ingestion, notification, or workflow automation. Pro includes deeper, managed integrations beyond basic importers and API usage.
diff --git a/docs/content/en/connecting_your_tools/_index.md b/docs/content/import_data/_index.md
similarity index 100%
rename from docs/content/en/connecting_your_tools/_index.md
rename to docs/content/import_data/_index.md
diff --git a/docs/content/en/cloud_management/_index.md b/docs/content/import_data/import_intro/_index.md
similarity index 73%
rename from docs/content/en/cloud_management/_index.md
rename to docs/content/import_data/import_intro/_index.md
index 6c620388cfc..1e3dadb4c45 100644
--- a/docs/content/en/cloud_management/_index.md
+++ b/docs/content/import_data/import_intro/_index.md
@@ -1,11 +1,11 @@
---
-title: "☁️ DefectDojo Cloud"
-description: "Manage Your DefectDojo subscription"
+title: "Introduction"
+description: "Use DefectDojo's Import / Reimport to ingest data and build a pipeline"
summary: ""
date: 2023-09-07T16:06:50+02:00
lastmod: 2023-09-07T16:06:50+02:00
draft: false
-weight: 6
+weight: 1
chapter: true
seo:
title: "" # custom title (optional)
diff --git a/docs/content/en/connecting_your_tools/import_intro.md b/docs/content/import_data/import_intro/comparison.md
similarity index 60%
rename from docs/content/en/connecting_your_tools/import_intro.md
rename to docs/content/import_data/import_intro/comparison.md
index 44eb8fd2b44..3135fc227e5 100644
--- a/docs/content/en/connecting_your_tools/import_intro.md
+++ b/docs/content/import_data/import_intro/comparison.md
@@ -12,46 +12,27 @@ When DefectDojo receives a vulnerability report from a security tool, it will cr
There are two main ways that DefectDojo can upload Finding reports.
-* Via direct **import** through the UI: [Import Scan Form](../import_scan_files/import_scan_ui)
-* Via **API** endpoint (allowing for automated data ingestion): See [API Docs](https://docs.defectdojo.com/en/api/api-v2-docs/)
+* Via direct **import** through the UI
+* Via **API** endpoint (allowing for automated data ingestion): See [API Docs](/automation/api/api-v2-docs/)
#### DefectDojo Pro Methods
DefectDojo Pro users have an additional three methods to handle reports and data:
-* Via **Universal Importer** or **DefectDojo CLI**, command line tools which leverage the DefectDojo API: See [External Tools](../external_tools/)
-* Via **Connectors** for certain tools, an ‘out of the box’ data integration: See [Connectors Guide](../connectors/about_connectors/)
-* Via **Smart Upload** for certain tools, an importer designed to handle infrastructure scans: See [Smart Upload Guide](../import_scan_files/smart_upload/)
+* Via **Universal Importer** or **DefectDojo CLI**, command line tools which leverage the DefectDojo API: See [Universal Importer & DefectDojo-CLI guides](/import_data/pro/specialized_import/external_tools/)
+* Via **Connectors** for certain tools, an ‘out of the box’ data integration: See [Connectors Guide](/import_data/pro/connectors/about_connectors/)
+* Via **Smart Upload** for certain tools, an importer designed to handle infrastructure scans: See [Smart Upload Guide](/import_data/pro/specialized_import/smart_upload/)
### Comparing Upload Methods
| | **UI Import** | **API** | **Connectors** (Pro) | **Smart Upload** (Pro)|
| --- | --- | --- | --- | --- |
| **Supported Scan Types** | All: see [Supported Tools](/supported_tools/) | All: see [Supported Tools](/supported_tools/) | Anchore, AWS Security Hub, BurpSuite, Checkmarx ONE, Dependency-Track, Probely, Semgrep, SonarQube, Snyk, Tenable, Wiz | Nexpose, NMap, OpenVas, Qualys, Tenable |
-| **Automation?** | Available via API: `/reimport` `/import` endpoints | Triggered from [CLI Importer](../external_tools) or external code | Connectors is an inherently automated feature | Available via API: `/smart_upload_import` endpoint |
+| **Automation?** | Available via API: `/reimport` `/import` endpoints | Triggered from [CLI Tools](/import_data/pro/specialized_import/external_tools/) or external code | Connectors is an inherently automated feature | Available via API: `/smart_upload_import` endpoint |
### Product Hierarchy and organization
Each of these methods can create Product Hierarchy on the spot. Product Hierarchy refers to DefectDojo’s Product Types, Products, Engagements or Tests: objects in DefectDojo which help organize your data into relevant context.
* **Vulnerability data can be imported into an existing Product Hierarchy**. Product Types, Products, Engagements and Tests can all be created in advance, and then data can be imported to that location in DefectDojo.
-* **The contextual Product Hierarchy can be created at the time of import.** When importing a report, you can create a new Product Type, Product, Engagement and/or Test. This is handled by DefectDojo through the ‘auto\-create context’ option.
-
-## Using Import Methods (Pro UI)
-
-In DefectDojo Pro, all of these methods can be accessed from the **Import** section of the sidebar.
-
-
-
-The Pro UI allows you to create Product Types, Products and Engagements directly from the Import Scan form, so these objects are not required.
-
-## Using Import Methods (Classic UI / Open Souce)
-
-In DefectDojo OS, you can access the [Import Scan Form](../import_scan_files/import_scan_ui) from two locations:
-
-* The Tests section of an Engagement:
- 
-* The Findings section of the navigation bar on a Product:
- 
-
-DefectDojo OS requires you to set up one or more Products / Product Types before you can import data through the UI. See our article on [Product Hierarchy](/en/working_with_findings/organizing_engagements_tests/product_hierarchy/) for more information.
+* **The contextual Product Hierarchy can be created at the time of Import.** When importing a report, you can create a new Product Type, Product, Engagement and/or Test. This is handled by DefectDojo through the ‘auto-create context’ option. In DefectDojo OS, this option can only be accessed through the API. UI imports in DefectDojo OS will require Product Hierarchy to be created first.
diff --git a/docs/content/en/connecting_your_tools/import_scan_files/using_reimport.md b/docs/content/import_data/import_intro/import_vs_reimport.md
similarity index 96%
rename from docs/content/en/connecting_your_tools/import_scan_files/using_reimport.md
rename to docs/content/import_data/import_intro/import_vs_reimport.md
index c702099f7bc..c73e84c86dd 100644
--- a/docs/content/en/connecting_your_tools/import_scan_files/using_reimport.md
+++ b/docs/content/import_data/import_intro/import_vs_reimport.md
@@ -1,6 +1,6 @@
---
-title: "Add new Findings to a Test via Reimport"
-description: ""
+title: "Import vs Reimport"
+description: "Learn how to import data manually, through the API, or via a connector"
weight: 2
---
@@ -83,4 +83,4 @@ This header indicates the actions taken by an Import/Reimport.
Note that the /reimport API endpoint can both **extend an existing Test** (apply the method in this article) **or create a new Test** with new data \- an initial call to `/import`, or setting up a Test in advance is not required.
-To learn more about creating an automated CI/CD pipeline using DefectDojo, see our guide [here](../api_pipeline_modelling).
+To learn more about creating an automated CI/CD pipeline using DefectDojo, see our guide [here](/automation/api/api-v2-docs/).
diff --git a/docs/content/import_data/import_scan_files/OS__create_findings_manually.md b/docs/content/import_data/import_scan_files/OS__create_findings_manually.md
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/docs/content/import_data/import_scan_files/OS__import_scan_ui.md b/docs/content/import_data/import_scan_files/OS__import_scan_ui.md
new file mode 100644
index 00000000000..b3f07b6d5ab
--- /dev/null
+++ b/docs/content/import_data/import_scan_files/OS__import_scan_ui.md
@@ -0,0 +1,71 @@
+---
+title: "Import Scan form"
+description: ""
+weight: 1
+audience: opensource
+---
+
+Once you have your Product Hierarchy set up with at least one Product Type, Product, Test and Engagement, you can import a scan file to DefectDojo and create Findings.
+
+It’s easy to reorganize your Product Hierarchy in DefectDojo, so it’s ok if you’re not sure how to set things up yet.
+
+For now, it’s good to know that **Engagements** can store data from multiple tools, which can be useful if you’re running different tools concurrently as part of a single testing effort.
+
+## Accessing the Import Scan Form (Classic UI / Open Source)
+
+In DefectDojo OS, you can access this form from two locations:
+
+* The Tests section of an Engagement:
+ 
+* The Findings section of the navigation bar on a Product:
+ 
+
+## Completing the Import Scan Form
+
+
+The Import Scan form will create a new Test nested under an Engagement, which will contain a unique Finding for each vulnerability contained within your scan file.
+
+The Test will be created with a name that matches the Scan Type: e.g. a Tenable scan will be titled ‘Tenable Scan’.
+
+### Form Options
+
+* **Scan File:** by clicking on the Choose button, you can select a file from your computer to upload.
+* **Scan Date (optional):** if you want to select a single Scan Date to be applied to all Findings that result from this import, you can select the date in this field.
+If you do not select a Scan Date, Findings created from this report will use the date specified by the tool. SLAs for each Finding will be calculated based on their date.
+* **Scan Type:** select the tool used to create this data.
+* **Environment:** select an Environment that corresponds to the data you’re uploading.
+* **Tags:** if you want to use tags to further organize your Test data, you can add Tags using this form. Type in the name of the tag you want to create, and press Enter on your keyboard to add it to the list of tags.
+
+### Optional Fields
+
+* **Minimum Severity**: If you only want to create Findings for a particular Severity level and above, you can select the minimum Severity level here. All vulnerabilities with lower severity than this field will be ignored.
+* **Active**: if you want to set all of the incoming Findings to either Active or Inactive, you can specify that here. Otherwise, DefectDojo will use the tool’s vulnerability data to determine whether the Finding is Active or Inactive. This option is relevant if you need your team to manually triage and verify Findings from a particular tool.
+* **Verified**: as with Active you can set the new set of Findings to either Verified or Unverified by default. This depends on your workflow preferences. For example, if your team prefers to assume Findings are verified unless proven otherwise, you can set this field to True.
+* **Version, Branch Tag, Commit Hash, Build ID, Service** can all be specified if you want to include these details in the Test.
+* **Source Code Management URI** can also be specified. This form option must be a valid URI.
+* **Group By:** if you want to create Finding Groups out of this File, you can specify the grouping method here.
+
+### Triage-less scanners: Do Not Reactivate field
+
+Some scanners might not include triage information in their reports (e.g. tfsec). They simply scan code or dependencies, flag issues, and return everything, regardless of whether a vulnerability has already been triaged or not.
+
+To handle this case, DefectDojo also includes a "Do not reactivate" checkbox in uploading reports (also in the reimport API), so you can use DefectDojo as the source of truth for triage, instead of reactivating your triaged Findings on each import / reimport.
+
+### Using the Scan Completion Date (API: `scan_date`) field
+
+DefectDojo offers a plethora of supported scanner reports, but not all of them contain the
+information most important to a user. The `scan_date` field is a flexible smart feature that
+allows users to set the completion date of the a given scan report, and have it propagate
+down to all the findings imported. This field is **not** mandatory, but the default value for
+this field is the date of import (whenever the request is processed and a successful response is returned).
+
+Here are the following use cases for using this field:
+
+1. The report **does not** set the date, and `scan_date` is **not** set at import
+ - Finding date will be the default value of `scan_date`
+2. The report **sets** the date, and the `scan_date` is **not** set at import
+ - Finding date will be whatever the report sets
+3. The report **does not** set the date, and the `scan_date` is **set** at import
+ - Finding date will be whatever the user set for `scan_date`
+4. The report **sets** the date, and the `scan_date` is **set** at import
+ - Finding date will be whatever the user set for `scan_date`
diff --git a/docs/content/import_data/import_scan_files/PRO__create_findings_manually.md b/docs/content/import_data/import_scan_files/PRO__create_findings_manually.md
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/docs/content/en/connecting_your_tools/import_scan_files/import_scan_ui.md b/docs/content/import_data/import_scan_files/PRO__import_scan_ui.md
similarity index 93%
rename from docs/content/en/connecting_your_tools/import_scan_files/import_scan_ui.md
rename to docs/content/import_data/import_scan_files/PRO__import_scan_ui.md
index dac6195a6d3..741f850c6fa 100644
--- a/docs/content/en/connecting_your_tools/import_scan_files/import_scan_ui.md
+++ b/docs/content/import_data/import_scan_files/PRO__import_scan_ui.md
@@ -1,7 +1,8 @@
---
-title: "Import Scan Form"
+title: "Add Findings form"
description: ""
weight: 1
+audience: pro
---
If you have a brand new DefectDojo instance, the Import Scan Form is a logical first step to learn the software and set up your environment. From this form, you upload a scan file from a supported tool, which will create Findings to represent those vulnerabilities. While filling out the form, you can decide whether to:
@@ -17,22 +18,12 @@ For now, it’s good to know that **Engagements** can store data from multiple t
The Import Scan form can be accessed from multiple locations:
-1. Via the **Import \> Add Findings** menu option on the sidebar
+1. Via the **Import > Add Findings** menu option on the sidebar
2. From a **Product’s** **‘⋮’ (horizontal dots) Menu**, from a **Products Table**
3. From the **⚙️Gear Menu** on a **Product Page**
-## Accessing the Import Scan Form (Classic UI / Open Source)
-
-In DefectDojo OS, you can access this form from two locations:
-
-* The Tests section of an Engagement:
- 
-* The Findings section of the navigation bar on a Product:
- 
-
## Completing the Import Scan Form
-
The Import Scan form will create a new Test nested under an Engagement, which will contain a unique Finding for each vulnerability contained within your scan file.
The Test will be created with a name that matches the Scan Type: e.g. a Tenable scan will be titled ‘Tenable Scan’.
@@ -48,7 +39,7 @@ If you do not select a Scan Date, Findings created from this report will use the
* **Tags:** if you want to use tags to further organize your Test data, you can add Tags using this form. Type in the name of the tag you want to create, and press Enter on your keyboard to add it to the list of tags.
* **Process Findings Asynchronously**: this field is enabled by default, but it can be disabled if you wish. See explanation below.
-### Process Findings Asynchronously (Pro)
+### Process Findings Asynchronously
When this field is enabled, DefectDojo will use a background process to populate your Test file with Findings. This allows you to continue working with DefectDojo while Findings are being created from your scan file.
@@ -58,6 +49,11 @@ This option is especially relevant when using the API to import data. If uploadi
### Optional Fields
+To open Optional Fields, click the button labelled **"Optional Fields +"** above the **Submit** button
+
+
+
+#### Optional Fields descriptions
* **Minimum Severity**: If you only want to create Findings for a particular Severity level and above, you can select the minimum Severity level here. All vulnerabilities with lower severity than this field will be ignored.
* **Active**: if you want to set all of the incoming Findings to either Active or Inactive, you can specify that here. Otherwise, DefectDojo will use the tool’s vulnerability data to determine whether the Finding is Active or Inactive. This option is relevant if you need your team to manually triage and verify Findings from a particular tool.
* **Verified**: as with Active you can set the new set of Findings to either Verified or Unverified by default. This depends on your workflow preferences. For example, if your team prefers to assume Findings are verified unless proven otherwise, you can set this field to True.
diff --git a/docs/content/en/connecting_your_tools/import_scan_files/_index.md b/docs/content/import_data/import_scan_files/_index.md
similarity index 88%
rename from docs/content/en/connecting_your_tools/import_scan_files/_index.md
rename to docs/content/import_data/import_scan_files/_index.md
index b8ddf6a0847..bff91782153 100644
--- a/docs/content/en/connecting_your_tools/import_scan_files/_index.md
+++ b/docs/content/import_data/import_scan_files/_index.md
@@ -1,5 +1,5 @@
---
-title: "How To Import Data"
+title: "Importing Data"
description: "Use DefectDojo's Import / Reimport to ingest data and build a pipeline"
summary: ""
date: 2023-09-07T16:06:50+02:00
@@ -7,8 +7,6 @@ lastmod: 2023-09-07T16:06:50+02:00
draft: false
weight: 3
chapter: true
-sidebar:
- collapsed: true
seo:
title: "" # custom title (optional)
description: "" # custom description (recommended)
diff --git a/docs/content/en/connecting_your_tools/import_scan_files/api_pipeline_modelling.md b/docs/content/import_data/import_scan_files/api_pipeline_modelling.md
similarity index 87%
rename from docs/content/en/connecting_your_tools/import_scan_files/api_pipeline_modelling.md
rename to docs/content/import_data/import_scan_files/api_pipeline_modelling.md
index 750d29f0464..dd8e01ed410 100644
--- a/docs/content/en/connecting_your_tools/import_scan_files/api_pipeline_modelling.md
+++ b/docs/content/import_data/import_scan_files/api_pipeline_modelling.md
@@ -1,5 +1,5 @@
---
-title: "Create an automated import pipeline via API"
+title: "Import from API"
description: ""
---
@@ -10,14 +10,6 @@ DefectDojo’s API allows for robust pipeline solutions, which automatically ing
These pipelines can be created by directly calling our API **/reimport** endpoint with an attached scan file in a way that closely resembles our **Import Scan Form**.
-#### Universal Importer: out of the box automation
-
-DefectDojo Inc. maintains a **Universal Importer** which can be set up with existing CI/CD pipelines, triggered via GitHub actions, or run in any other automated context.
-
-This external tool is a useful way to build a pipeline directly from the command line: a much faster solution than writing your own code.
-
-See our guide to [external tools](../../external_tools) to learn more. External tools are available for **DefectDojo Pro** users only.
-
## DefectDojo’s API
DefectDojo’s API is documented in\-app using the OpenAPI framework. You can access this documentation from the User Menu in the top right\-hand corner, under **‘API v2 OpenAPI3’**.
diff --git a/docs/content/en/connecting_your_tools/connectors/_index.md b/docs/content/import_data/pro/connectors/_index.md
similarity index 85%
rename from docs/content/en/connecting_your_tools/connectors/_index.md
rename to docs/content/import_data/pro/connectors/_index.md
index 47c05dfcfaf..c77f1f3a4eb 100644
--- a/docs/content/en/connecting_your_tools/connectors/_index.md
+++ b/docs/content/import_data/pro/connectors/_index.md
@@ -1,5 +1,5 @@
---
-title: "Connectors (Pro)"
+title: "Connectors"
description: "Seamlessly connect DefectDojo to your security tools suite"
summary: ""
date: 2023-09-07T16:06:50+02:00
@@ -7,13 +7,11 @@ lastmod: 2023-09-07T16:06:50+02:00
draft: false
weight: 4
chapter: true
-sidebar:
- collapsed: true
seo:
title: "" # custom title (optional)
description: "" # custom description (recommended)
canonical: "" # custom canonical URL (optional)
robots: "" # custom robot tags (optional)
-pro-feature: true
+audience: pro
exclude_search: true
---
diff --git a/docs/content/en/connecting_your_tools/connectors/about_connectors.md b/docs/content/import_data/pro/connectors/about_connectors.md
similarity index 100%
rename from docs/content/en/connecting_your_tools/connectors/about_connectors.md
rename to docs/content/import_data/pro/connectors/about_connectors.md
diff --git a/docs/content/en/connecting_your_tools/connectors/add_edit_connectors.md b/docs/content/import_data/pro/connectors/add_edit_connectors.md
similarity index 100%
rename from docs/content/en/connecting_your_tools/connectors/add_edit_connectors.md
rename to docs/content/import_data/pro/connectors/add_edit_connectors.md
diff --git a/docs/content/en/connecting_your_tools/connectors/connectors_tool_reference.md b/docs/content/import_data/pro/connectors/connectors_tool_reference.md
similarity index 100%
rename from docs/content/en/connecting_your_tools/connectors/connectors_tool_reference.md
rename to docs/content/import_data/pro/connectors/connectors_tool_reference.md
diff --git a/docs/content/en/connecting_your_tools/connectors/manage_operations.md b/docs/content/import_data/pro/connectors/manage_operations.md
similarity index 97%
rename from docs/content/en/connecting_your_tools/connectors/manage_operations.md
rename to docs/content/import_data/pro/connectors/manage_operations.md
index 17e830e77ee..a5652aed310 100644
--- a/docs/content/en/connecting_your_tools/connectors/manage_operations.md
+++ b/docs/content/import_data/pro/connectors/manage_operations.md
@@ -66,7 +66,7 @@ Whenever Sync runs, it will compare the latest scan data against the existing li
* If there are new Findings detected, they will be added to the Test as new Findings.
* If there are any Findings which aren’t detected in the latest scan, they will be marked as Inactive in the Test.
-To learn more about Products, Engagements, Tests and Findings, see our [Product Hierarchy Overview](/en/working_with_findings/organizing_engagements_tests/product_hierarchy).
+To learn more about Products, Engagements, Tests and Findings, see our [Product Hierarchy Overview](/asset_modelling/hierarchy/product_hierarchy/).
### Running Sync Manually
diff --git a/docs/content/en/connecting_your_tools/connectors/manage_records.md b/docs/content/import_data/pro/connectors/manage_records.md
similarity index 98%
rename from docs/content/en/connecting_your_tools/connectors/manage_records.md
rename to docs/content/import_data/pro/connectors/manage_records.md
index 711959988a5..8da74053483 100644
--- a/docs/content/en/connecting_your_tools/connectors/manage_records.md
+++ b/docs/content/import_data/pro/connectors/manage_records.md
@@ -57,7 +57,7 @@ Once a Record is Mapped, DefectDojo will be ready to import your tool’s scans
This makes it possible to send scan data from multiple Connectors to the same Product. All of the data will be stored in the same Engagement, but each Connector will store data in a separate Test.
-To learn more about Products, Engagements and Tests, see our [Product Hierarchy Overview](/en/working_with_findings/organizing_engagements_tests/product_hierarchy/).
+To learn more about Products, Engagements and Tests, see our [Product Hierarchy Overview](/asset_modelling/hierarchy/product_hierarchy/).
## Record States - Glossary
diff --git a/docs/content/en/share_your_findings/_index.md b/docs/content/import_data/pro/specialized_import/_index.md
similarity index 73%
rename from docs/content/en/share_your_findings/_index.md
rename to docs/content/import_data/pro/specialized_import/_index.md
index 5443a7dd0b7..8813d06eaf2 100644
--- a/docs/content/en/share_your_findings/_index.md
+++ b/docs/content/import_data/pro/specialized_import/_index.md
@@ -1,6 +1,6 @@
---
-title: "📤 Share Your Findings"
-description: "Create Reports or Push To Jira"
+title: "Specialized Import"
+description: "Seamlessly connect DefectDojo to your security tools suite"
summary: ""
date: 2023-09-07T16:06:50+02:00
lastmod: 2023-09-07T16:06:50+02:00
@@ -12,5 +12,6 @@ seo:
description: "" # custom description (recommended)
canonical: "" # custom canonical URL (optional)
robots: "" # custom robot tags (optional)
+audience: pro
exclude_search: true
----
\ No newline at end of file
+---
diff --git a/docs/content/en/connecting_your_tools/external_tools.md b/docs/content/import_data/pro/specialized_import/external_tools.md
similarity index 99%
rename from docs/content/en/connecting_your_tools/external_tools.md
rename to docs/content/import_data/pro/specialized_import/external_tools.md
index 18f39813091..625d12e5070 100644
--- a/docs/content/en/connecting_your_tools/external_tools.md
+++ b/docs/content/import_data/pro/specialized_import/external_tools.md
@@ -1,8 +1,9 @@
---
-title: "External Tools: Universal Importer & DefectDojo-CLI (Pro)"
+title: "Universal Importer & DefectDojo-CLI"
description: "Import files to DefectDojo from the command line"
draft: false
weight: 2
+audience: pro
---
Note: The following external tools are DefectDojo Pro-only features. These binaries will not work unless they are connected to an instance with a DefectDojo Pro license.
diff --git a/docs/content/en/connecting_your_tools/import_scan_files/smart_upload.md b/docs/content/import_data/pro/specialized_import/smart_upload.md
similarity index 98%
rename from docs/content/en/connecting_your_tools/import_scan_files/smart_upload.md
rename to docs/content/import_data/pro/specialized_import/smart_upload.md
index 191f757be65..97e6201ccb2 100644
--- a/docs/content/en/connecting_your_tools/import_scan_files/smart_upload.md
+++ b/docs/content/import_data/pro/specialized_import/smart_upload.md
@@ -1,7 +1,8 @@
---
-title: "Smart Upload for infrastructure scans (Pro)"
+title: "Infrastructure scans / Smart Upload"
description: "Automatically route incoming Findings to the correct Product"
weight: 3
+audience: pro
---
Note: Smart Upload is only available in DefectDojo Pro.
diff --git a/docs/content/en/connecting_your_tools/universal_parser.md b/docs/content/import_data/pro/specialized_import/universal_parser.md
similarity index 99%
rename from docs/content/en/connecting_your_tools/universal_parser.md
rename to docs/content/import_data/pro/specialized_import/universal_parser.md
index 476f088d716..24043d5de20 100644
--- a/docs/content/en/connecting_your_tools/universal_parser.md
+++ b/docs/content/import_data/pro/specialized_import/universal_parser.md
@@ -3,7 +3,7 @@ title: "🌐 Universal Parser (Pro)"
description: ""
draft: "false"
weight: 1
-pro-feature: true
+audience: pro
---
Note: The Universal Parser is only available in DefectDojo Pro.
diff --git a/docs/content/issue_tracking/_index.md b/docs/content/issue_tracking/_index.md
new file mode 100644
index 00000000000..72c1c5ce15e
--- /dev/null
+++ b/docs/content/issue_tracking/_index.md
@@ -0,0 +1,16 @@
+---
+title: "Issue Tracking"
+description: ""
+summary: ""
+date: 2023-09-07T16:06:50+02:00
+lastmod: 2023-09-07T16:06:50+02:00
+draft: false
+weight: 3
+chapter: true
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ robots: "" # custom robot tags (optional)
+exclude_search: true
+---
\ No newline at end of file
diff --git a/docs/content/issue_tracking/intro/_index.md b/docs/content/issue_tracking/intro/_index.md
new file mode 100644
index 00000000000..8452f739bba
--- /dev/null
+++ b/docs/content/issue_tracking/intro/_index.md
@@ -0,0 +1,16 @@
+---
+title: "Intro"
+description: ""
+summary: ""
+date: 2023-09-07T16:06:50+02:00
+lastmod: 2023-09-07T16:06:50+02:00
+draft: false
+weight: 3
+chapter: true
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ robots: "" # custom robot tags (optional)
+exclude_search: true
+---
\ No newline at end of file
diff --git a/docs/content/issue_tracking/intro/intro.md b/docs/content/issue_tracking/intro/intro.md
new file mode 100644
index 00000000000..f307850524d
--- /dev/null
+++ b/docs/content/issue_tracking/intro/intro.md
@@ -0,0 +1,26 @@
+---
+title: "Issue Tracking Integration"
+description: "Sync DefectDojo findings with your issue tracking system to streamline remediation and accountability."
+weight: 1
+---
+
+## Overview
+
+The DefectDojo issue tracking integrations connect your vulnerability management workflows with your existing issue tracking system. By automatically creating and updating issues from security findings, DefectDojo helps ensure vulnerabilities are visible, owned, and addressed within the same tools your development and operations teams already use.
+
+| Edition | Supported Issue Tracking Integrations |
+|--------------|---------------------------------------|
+| Community Edition | * Jira |
+| Pro | * Jira * Azure DevOps * GitHub * GitLab Boards * ServiceNow |
+
+
+When enabled, DefectDojo can create issues automatically, or selectively from Products or Engagement. As Findings are updated in DefectDojo—resolved, mitigated, or reactivated—the corresponding issues can be kept in sync, ensuring both systems reflect the current state of risk.
+
+## What Gets Tracked
+
+Each issue can include key vulnerability details such as severity, description, evidence, and remediation guidance. Links between DefectDojo and the issue tracking system provide traceability from discovery through resolution, supporting reporting, audits, and continuous improvement.
+
+## Why Issue Tracking Integrations Matter
+
+Security findings are most effective when they are actionable. Integrating DefectDojo with an issue tracking system bridges the gap between detection and remediation by embedding security work directly into established engineering workflows. This reduces context switching, improves accountability, and helps teams remediate issues faster.
+
diff --git a/docs/content/issue_tracking/jira/_index.md b/docs/content/issue_tracking/jira/_index.md
new file mode 100644
index 00000000000..1d5c21c3546
--- /dev/null
+++ b/docs/content/issue_tracking/jira/_index.md
@@ -0,0 +1,16 @@
+---
+title: "Jira"
+description: ""
+summary: ""
+date: 2023-09-07T16:06:50+02:00
+lastmod: 2023-09-07T16:06:50+02:00
+draft: false
+weight: 3
+chapter: true
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ robots: "" # custom robot tags (optional)
+exclude_search: true
+---
\ No newline at end of file
diff --git a/docs/content/en/share_your_findings/jira_guide.md b/docs/content/issue_tracking/jira/jira_guide.md
similarity index 100%
rename from docs/content/en/share_your_findings/jira_guide.md
rename to docs/content/issue_tracking/jira/jira_guide.md
diff --git a/docs/content/en/share_your_findings/troubleshooting_jira.md b/docs/content/issue_tracking/jira/troubleshooting_jira.md
similarity index 100%
rename from docs/content/en/share_your_findings/troubleshooting_jira.md
rename to docs/content/issue_tracking/jira/troubleshooting_jira.md
diff --git a/docs/content/issue_tracking/pro_integration/_index.md b/docs/content/issue_tracking/pro_integration/_index.md
new file mode 100644
index 00000000000..9a96558647c
--- /dev/null
+++ b/docs/content/issue_tracking/pro_integration/_index.md
@@ -0,0 +1,17 @@
+---
+title: "Pro Integrations"
+description: ""
+summary: ""
+date: 2023-09-07T16:06:50+02:00
+lastmod: 2023-09-07T16:06:50+02:00
+draft: false
+weight: 3
+chapter: true
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ robots: "" # custom robot tags (optional)
+exclude_search: true
+audience: pro
+---
\ No newline at end of file
diff --git a/docs/content/en/share_your_findings/integrations.md b/docs/content/issue_tracking/pro_integration/integrations.md
similarity index 89%
rename from docs/content/en/share_your_findings/integrations.md
rename to docs/content/issue_tracking/pro_integration/integrations.md
index e2dd663a9f4..28244d9bfa2 100644
--- a/docs/content/en/share_your_findings/integrations.md
+++ b/docs/content/issue_tracking/pro_integration/integrations.md
@@ -1,15 +1,16 @@
---
-title: "Integrations Guide (Pro)"
+title: "Pro Integrations"
weight: 1
+audience: pro
---
DefectDojo Pro's Integrations let you push your Findings and Finding Groups to ticket tracking systems to easily integrate security remediation with your teams existing development workflow.
Supported Integrations:
-- [Azure Devops](/en/share_your_findings/integrations_toolreference/#azure-devops-boards)
-- [GitHub](/en/share_your_findings/integrations_toolreference/#github)
-- [GitLab Boards](/en/share_your_findings/integrations_toolreference/#gitlab)
-- [ServiceNow](/en/share_your_findings/integrations_toolreference/#servicenow)
+- [Azure Devops](/issue_tracking/pro_integration/integrations/#azure-devops-boards)
+- [GitHub](/issue_tracking/pro_integration/integrations/#github)
+- [GitLab Boards](/issue_tracking/pro_integration/integrations/#gitlab)
+- [ServiceNow](/issue_tracking/pro_integration/integrations/#servicenow)
## Opening the Integrations page
@@ -64,9 +65,9 @@ Project Integrations will have varying requirements for how DefectDojo will need
For the complete list of requirements, please open the vendor specific pages below:
-- [Azure Devops](/en/share_your_findings/integrations_toolreference/#azure-devops-boards)
-- [GitHub](/en/share_your_findings/integrations_toolreference/#github)
-- [GitLab Boards](/en/share_your_findings/integrations_toolreference/#gitlab)
+- [Azure Devops](/issue_tracking/pro_integration/integrations/#azure-devops-boards)
+- [GitHub](/issue_tracking/pro_integration/integrations/#github)
+- [GitLab Boards](/issue_tracking/pro_integration/integrations/#gitlab)
- ServiceNow (Coming Soon)
## Error Handling and Debugging
diff --git a/docs/content/en/share_your_findings/integrations_toolreference.md b/docs/content/issue_tracking/pro_integration/integrations_toolreference.md
similarity index 99%
rename from docs/content/en/share_your_findings/integrations_toolreference.md
rename to docs/content/issue_tracking/pro_integration/integrations_toolreference.md
index e8c36e4b51c..da74c650acd 100644
--- a/docs/content/en/share_your_findings/integrations_toolreference.md
+++ b/docs/content/issue_tracking/pro_integration/integrations_toolreference.md
@@ -2,6 +2,7 @@
title: "Integrators Tool Reference"
description: "Detailed setup guides for Integrators"
weight: 1
+audience: pro
---
Here are specific instructions detailing how to set up a DefectDojo Integration with a third party Issue Tracker.
diff --git a/docs/content/en/share_your_findings/pro_reports/_index.md b/docs/content/metrics_reports/_index.md
similarity index 94%
rename from docs/content/en/share_your_findings/pro_reports/_index.md
rename to docs/content/metrics_reports/_index.md
index f5ee70a661f..e480c09a66f 100755
--- a/docs/content/en/share_your_findings/pro_reports/_index.md
+++ b/docs/content/metrics_reports/_index.md
@@ -1,5 +1,5 @@
---
-title: "Create A Report"
+title: "Metrics & Reports"
description: "Create Custom Reports and Export Data"
summary: ""
date: 2023-09-07T16:06:50+02:00
diff --git a/docs/content/en/ai/_index.md b/docs/content/metrics_reports/ai/_index.md
similarity index 93%
rename from docs/content/en/ai/_index.md
rename to docs/content/metrics_reports/ai/_index.md
index 20ea8d9581e..31440c0b0ae 100644
--- a/docs/content/en/ai/_index.md
+++ b/docs/content/metrics_reports/ai/_index.md
@@ -5,8 +5,9 @@ summary: ""
date: 2023-09-07T16:06:50+02:00
lastmod: 2023-09-07T16:06:50+02:00
draft: false
-weight: 2
+weight: 3
chapter: true
+audience: pro
seo:
title: "" # custom title (optional)
description: "" # custom description (recommended)
diff --git a/docs/content/en/ai/mcp_server_pro.md b/docs/content/metrics_reports/ai/mcp_server_pro.md
similarity index 100%
rename from docs/content/en/ai/mcp_server_pro.md
rename to docs/content/metrics_reports/ai/mcp_server_pro.md
diff --git a/docs/content/en/customize_dojo/dashboards/Introduction_dashboard.md b/docs/content/metrics_reports/dashboards/Introduction_dashboard.md
similarity index 97%
rename from docs/content/en/customize_dojo/dashboards/Introduction_dashboard.md
rename to docs/content/metrics_reports/dashboards/Introduction_dashboard.md
index 301b19c60a0..62ed14c5421 100644
--- a/docs/content/en/customize_dojo/dashboards/Introduction_dashboard.md
+++ b/docs/content/metrics_reports/dashboards/Introduction_dashboard.md
@@ -69,7 +69,7 @@ This section summarizes the Graded performance of each Product in your instance,
Finding Counts of each severity are calculated by the tile, but note that Product Grade is only assigned based on Active Findings, so there may be Inactive Findings counted in this table which do not contribute to the Grade.
-To understand how grades are calculated, see our guide to **[Product Health Grading](/en/working_with_findings/organizing_engagements_tests/product_health_grade/)**.
+To understand how grades are calculated, see our guide to **[Product Health Grading](/asset_modelling/hierarchy/product_health_grade/)**.
## Dashboard Configuration
diff --git a/docs/content/en/customize_dojo/dashboards/_index.md b/docs/content/metrics_reports/dashboards/_index.md
similarity index 90%
rename from docs/content/en/customize_dojo/dashboards/_index.md
rename to docs/content/metrics_reports/dashboards/_index.md
index 6506f0ca7c4..d46ef3261a9 100644
--- a/docs/content/en/customize_dojo/dashboards/_index.md
+++ b/docs/content/metrics_reports/dashboards/_index.md
@@ -4,10 +4,8 @@ summary: ""
date: 2023-09-07T16:06:50+02:00
lastmod: 2023-09-07T16:06:50+02:00
draft: false
-weight: 7
+weight: 1
chapter: true
-sidebar:
- collapsed: true
seo:
title: "" # custom title (optional)
description: "" # custom description (recommended)
diff --git a/docs/content/en/customize_dojo/dashboards/about_custom_dashboard_tiles.md b/docs/content/metrics_reports/dashboards/about_custom_dashboard_tiles.md
similarity index 98%
rename from docs/content/en/customize_dojo/dashboards/about_custom_dashboard_tiles.md
rename to docs/content/metrics_reports/dashboards/about_custom_dashboard_tiles.md
index 404bece71da..8dd7e0fa3b0 100644
--- a/docs/content/en/customize_dojo/dashboards/about_custom_dashboard_tiles.md
+++ b/docs/content/metrics_reports/dashboards/about_custom_dashboard_tiles.md
@@ -11,7 +11,7 @@ Dashboard Tiles are customizable sets of filters for your DefectDojo instance, w
Tiles can:
* Act as shortcuts for particular sets of Findings, Products, or other objects
-* Visualize relevant metrics related a Product, Engagement or other components of the [Product Hierarchy](/en/working_with_findings/organizing_engagements_tests/product_hierarchy/)
+* Visualize relevant metrics related a Product, Engagement or other components of the [Product Hierarchy](/asset_modelling/hierarchy/product_hierarchy/)
* Provide alerts on particular activity, track SLA Violations, failing imports or new Critical Findings
Tile Filters set a narrower focus for any tile you want to create. Each Tile has a different set of relevant filters which can be selected.
@@ -315,7 +315,7 @@ This Tile compares the Product Grade of all Products on your instance, so that y
This tile uses a comparison operator (\<, \=, \<\=, \>\=) to track Products which equal, exceed or fail to meet the Product Grade which you want to monitor.

-For more information on how Product Grades are calculated, see our article on [Product Health Grading](/en/working_with_findings/organizing_engagements_tests/product_health_grade/).
+For more information on how Product Grades are calculated, see our article on [Product Health Grading](/asset_modelling/hierarchy/product_health_grade/).
#### Example: Track Failing Products
diff --git a/docs/content/metrics_reports/pro_metrics/PRO__executive_insights.md b/docs/content/metrics_reports/pro_metrics/PRO__executive_insights.md
new file mode 100644
index 00000000000..2c7a80cd77a
--- /dev/null
+++ b/docs/content/metrics_reports/pro_metrics/PRO__executive_insights.md
@@ -0,0 +1,18 @@
+---
+title: "Executive Insights"
+description: "How to Leverage Metrics in DefectDojo Pro"
+audience: pro
+weight: 3
+---
+
+The **Executive Insights** metrics page provides an aggregated view of application security risk across your organization. As it is design for executive-level consumption, this dashboard focuses exclusively on Organizations and Assets, emphasizing trends and outcomes rather than individual Findings.
+
+
+
+Within Executive Insights, Users may select a timeframe, Organization, Asset, or Tag from the filter list, which will populate an adjoining table with the resulting Findings. It will also change the results in various charts and graphs below.
+
+If no filters are selected, the table will display the status of all Organizations, Assets, and Tags.
+
+The first table provides a birdseye view of your overall security posture. There are also two separate tables for your Organizations and Assets.
+
+Figures will populate within each table depending on the filters applied. Clicking any hyperlinked figure within a cell will open a separate tab with a corresponding Findings Table.
diff --git a/docs/content/metrics_reports/pro_metrics/PRO__overview.md b/docs/content/metrics_reports/pro_metrics/PRO__overview.md
new file mode 100644
index 00000000000..c161154f3e3
--- /dev/null
+++ b/docs/content/metrics_reports/pro_metrics/PRO__overview.md
@@ -0,0 +1,56 @@
+---
+title: "Pro Metrics Overview"
+description: "How to Leverage Metrics in DefectDojo Pro"
+audience: pro
+weight: 2
+---
+
+The DefectDojo Pro UI has various Metrics dashboards to help visualize your current security posture. Each dashboard allows stakeholders at different levels of the organization to make informed decisions without needing to interpret raw data or navigate individual Findings. These dashboards include:
+* [Executive Insights](#executive-insights)
+* [Priority Insights](#priority-insights)
+* [Program Insights](#program-insights)
+* [Remediation Insights](#remediation-insights)
+* [Tool Insights](#tool-insights)
+
+
+
+## Metrics Features
+
+Before elaborating on each particular dashboard, there are some commonalities between all dashboards that are worth reviewing.
+
+### Filtering
+
+All Metrics can be filtered by timeframe, Organization, Asset, and Tag. After adjusting the filter as desired, Apply Filter must be clicked in order for the filter to take effect. If you wish to export a PDF of all charts, tables, and graphs on the dashboard as currently filtered, click Export as PDF.
+
+The filtering timeframe is limited to the past year, but can otherwise be adjusted to include the past 7, 14, 30, 90, or 180 days.
+
+Note that filter parameters are rendered in the URL, so you can bookmark multiple pages with various filter parameters. This can be useful for quick reference, or for consistently generating a particular kind of report.
+
+### Submenus
+
+Each graph has a ⋮ kebab menu in the top right of each view with the following features:
+* Force Refresh — Manually refreshes to incorporate any new updates in the data.
+* Expand Plot — Opens the same chart in a larger pop-up modal.
+* Download Plot as SVG — Downloads the chart as an SVG file.
+* View as Table — Shows the data from the chart in table format.
+ * Each column of the table can be toggled to appear in ascending or descending order when clicked. You can also download each table.
+
+
+
+### Access
+
+The Metrics section will only represent data from the Organizations and Assets that each User has the appropriate permissions to view. A User with access limited to a single Asset will only be able to see Metrics for that particular Asset, but if they don’t have access to the other Assets within the parent Organization, data from those other Assets won't be represented in Metrics.
+
+### Viewing Data Within Charts
+
+The X-axis of line charts will always represent the current timeframe filter. Hovering your cursor over a line chart will cause a modal to appear with a count of the figures on the Y-axis at that point in time.
+
+
+
+### Toggling Results
+
+Users can toggle certain categories of Findings as viewable and nonviewable in the chart by clicking on their respective color/name at the top of each chart.
+
+For example, in the Active Findings by Severity chart below, if you only wanted to see Findings with a High or Critical severity, you would click Medium, Low, and Info at the top to remove those results from the chart. Clicking Medium, Low, and Info again would make those results reappear.
+
+
diff --git a/docs/content/metrics_reports/pro_metrics/PRO__priority_insights.md b/docs/content/metrics_reports/pro_metrics/PRO__priority_insights.md
new file mode 100644
index 00000000000..76f4676e3c5
--- /dev/null
+++ b/docs/content/metrics_reports/pro_metrics/PRO__priority_insights.md
@@ -0,0 +1,19 @@
+---
+title: "Priority Insights"
+description: "How to Leverage Metrics in DefectDojo Pro"
+audience: pro
+weight: 3
+---
+
+The **Priority Insights** metrics page shows the most critical Findings as determined by Risk, Severity, Exploitability, or custom scoring, helping teams understand which vulnerabilities pose the greatest threat at any given moment and focus their efforts accordingly.
+
+Apart from various charts and graphs, Priority Insights includes four clickable modals that will open a separate tab with a table for all of the data those four modals represent:
+
+* Total Urgent Risk Findings
+* Total Needs Action Risk Findings
+* Total Medium Risk Findings
+* Average Finding Priority
+
+It also includes an integrated table of Prioritized Findings arranged either by AppSec or SOC, allowing Users to further filter, interact with, and view the data associated with individual Findings. The contents can be exported as a CSV file or a Quick Report, and other various columns can be added prior to export.
+
+
diff --git a/docs/content/metrics_reports/pro_metrics/PRO__program_insights.md b/docs/content/metrics_reports/pro_metrics/PRO__program_insights.md
new file mode 100644
index 00000000000..6d82d652e4a
--- /dev/null
+++ b/docs/content/metrics_reports/pro_metrics/PRO__program_insights.md
@@ -0,0 +1,12 @@
+---
+title: "Program Insights"
+description: "How to Leverage Metrics in DefectDojo Pro"
+audience: pro
+weight: 3
+---
+
+The **Program Insights** metrics page evaluates the effectiveness and maturity of the application security program as a whole, focusing on program-level performance rather than individual Findings.
+
+
+
+It includes breakdowns of testing efforts, as well as how deduplication and reimport features are affecting noise reduction, efficiency increases, and cumulative cost savings, ensuring that security processes are working as intended.
diff --git a/docs/content/metrics_reports/pro_metrics/PRO__remediation_insights.md b/docs/content/metrics_reports/pro_metrics/PRO__remediation_insights.md
new file mode 100644
index 00000000000..827d6e18f9b
--- /dev/null
+++ b/docs/content/metrics_reports/pro_metrics/PRO__remediation_insights.md
@@ -0,0 +1,16 @@
+---
+title: "Remediation Insights"
+description: "How to Leverage Metrics in DefectDojo Pro"
+audience: pro
+weight: 3
+---
+
+The **Remediation Insights** dashboard focuses on closure performance and remediation accountability, charting SLA adherence, overdue Findings, and Risk Acceptance over time. It relies on EPSS scores to determine a Finding’s exploitability, the database for which DefectDojo Pro updates daily and applies to each of your Findings.
+
+
+
+Similar to Priority Insights, Remediation Insights also includes four clickable modals that will open a separate tab with a table for all of the data those four modals represent:
+* Total Open Findings
+* Critical & High Open Findings
+* Mitigated Within SLA
+* Highly Exploitable Findings
diff --git a/docs/content/metrics_reports/pro_metrics/PRO__tool_insights.md b/docs/content/metrics_reports/pro_metrics/PRO__tool_insights.md
new file mode 100644
index 00000000000..524c447d4e5
--- /dev/null
+++ b/docs/content/metrics_reports/pro_metrics/PRO__tool_insights.md
@@ -0,0 +1,14 @@
+---
+title: "Tool Insights"
+description: "How to Leverage Metrics in DefectDojo Pro"
+audience: pro
+weight: 3
+---
+
+**Tool Insights** tracks the performance of each security tool used in DefectDojo based on the count and severity of Findings that it reports, helping to evaluate the comparative effectiveness of tools over time.
+
+
+
+Specifically, the Severity by Tool (Top 10 Most Findings) modal will provide a radar chart comparing the severity of the Findings your tools reveal.
+
+Severity by Tool Monthly will also provide a table arranged by the total Findings a particular scan type revealed on a particular date. Each column of this table can also be toggled to present in ascending or descending order.
diff --git a/docs/content/metrics_reports/pro_metrics/_index.md b/docs/content/metrics_reports/pro_metrics/_index.md
new file mode 100644
index 00000000000..1e6332bca58
--- /dev/null
+++ b/docs/content/metrics_reports/pro_metrics/_index.md
@@ -0,0 +1,17 @@
+---
+title: "Pro Metrics"
+description: "Performance metrics and insights"
+summary: ""
+date: 2026-01-20T17:33:00+00:00
+lastmod: 2026-01-20T17:33:00+00:00
+draft: false
+weight: 2
+chapter: true
+audience: pro
+seo:
+ title: ""
+ description: ""
+ canonical: ""
+ robots: ""
+exclude_search: true
+---
\ No newline at end of file
diff --git a/docs/content/metrics_reports/reports/_index.md b/docs/content/metrics_reports/reports/_index.md
new file mode 100644
index 00000000000..2ab02bc3710
--- /dev/null
+++ b/docs/content/metrics_reports/reports/_index.md
@@ -0,0 +1,16 @@
+---
+title: "Report Builder"
+description: "Performance metrics and insights"
+summary: ""
+date: 2026-01-20T17:33:00+00:00
+lastmod: 2026-01-20T17:33:00+00:00
+draft: false
+weight: 2
+chapter: true
+seo:
+ title: ""
+ description: ""
+ canonical: ""
+ robots: ""
+exclude_search: true
+---
\ No newline at end of file
diff --git a/docs/content/en/share_your_findings/pro_reports/using_the_report_builder.md b/docs/content/metrics_reports/reports/using_the_report_builder.md
similarity index 100%
rename from docs/content/en/share_your_findings/pro_reports/using_the_report_builder.md
rename to docs/content/metrics_reports/reports/using_the_report_builder.md
diff --git a/docs/content/en/share_your_findings/pro_reports/working_with_generated_reports.md b/docs/content/metrics_reports/reports/working_with_generated_reports.md
similarity index 100%
rename from docs/content/en/share_your_findings/pro_reports/working_with_generated_reports.md
rename to docs/content/metrics_reports/reports/working_with_generated_reports.md
diff --git a/docs/content/en/working_with_findings/organizing_engagements_tests/filter_index.md b/docs/content/navigation/PRO__filter_index.md
similarity index 86%
rename from docs/content/en/working_with_findings/organizing_engagements_tests/filter_index.md
rename to docs/content/navigation/PRO__filter_index.md
index 3fbe8578d8a..168f25bb841 100644
--- a/docs/content/en/working_with_findings/organizing_engagements_tests/filter_index.md
+++ b/docs/content/navigation/PRO__filter_index.md
@@ -2,11 +2,12 @@
title: "Filter Index"
description: "Reference for all filters in DefectDojo"
weight: 5
+
---
**Note: Currently this article only covers Finding Filters available in the DefectDojo Pro UI, but this article will be expanded in the future to govern more object types, along with Open-Source filters.**
-Here is a list of filters that can be applied in the DefectDojo Pro UI to sort lists of Findings. DefectDojo Filters can be used to assist with navigating through lists of Objects, creating custom [Dashboard Tiles](/en/customize_dojo/dashboards/about_custom_dashboard_tiles/), or creating automation via [Rules Engine](/en/customize_dojo/rules_engine/).
+Here is a list of filters that can be applied in the DefectDojo Pro UI to sort lists of Findings. DefectDojo Filters can be used to assist with navigating through lists of Objects, creating custom [Dashboard Tiles](/metrics_reports/dashboards/about_custom_dashboard_tiles/), or creating automation via [Rules Engine](/automation/rules_engine/about).
## Findings
These fields are specific to DefectDojo Findings and are used to organize a Finding. Each of these filters is a separate column in the All Findings table.
@@ -37,7 +38,7 @@ These Filters are assigned at the time of issue creation, and cannot be directly
##### Can be modified
These fields are set when an issue is created, but can be modified as an issue progresses.
-* [Status](/en/working_with_findings/findings_workflows/finding_status_definitions/)
+* [Status](/triage_findings/findings_workflows/finding_status_definitions/)
* Last Status Update (Timestamp)
* Mitigated (True or False)
@@ -47,7 +48,7 @@ These DefectDojo functions can be used to further organize your Findings or trac
* Finding Tags
* Reviewers (Assigned User)
* Has Notes (True/False)
-* Group (refers to the [Finding Group](/en/working_with_findings/findings_workflows/editing_findings/#finding-group-actions), if one exists)
+* Group (refers to the [Finding Group](/triage_findings/findings_workflows/editing_findings/#finding-group-actions), if one exists)
* Risk Acceptance (select one or more existing Risk Acceptances from the list)
### Tool-Specific Metadata
diff --git a/docs/content/navigation/_index.md b/docs/content/navigation/_index.md
new file mode 100644
index 00000000000..0a736fd95cb
--- /dev/null
+++ b/docs/content/navigation/_index.md
@@ -0,0 +1,17 @@
+---
+title: "Navigating DefectDojo"
+description: ""
+summary: ""
+date: 2023-09-07T16:12:03+02:00
+lastmod: 2023-09-07T16:12:03+02:00
+draft: false
+weight: 999
+toc: true
+sidebar:
+ collapsed: true
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ robots: "" # custom robot tags (optional)
+---
\ No newline at end of file
diff --git a/docs/content/en/open_source/_index.md b/docs/content/open_source/_index.md
similarity index 100%
rename from docs/content/en/open_source/_index.md
rename to docs/content/open_source/_index.md
diff --git a/docs/content/en/open_source/archived_docs/_index.md b/docs/content/open_source/archived_docs/_index.md
similarity index 100%
rename from docs/content/en/open_source/archived_docs/_index.md
rename to docs/content/open_source/archived_docs/_index.md
diff --git a/docs/content/en/open_source/archived_docs/burp-plugin.md b/docs/content/open_source/archived_docs/burp-plugin.md
similarity index 100%
rename from docs/content/en/open_source/archived_docs/burp-plugin.md
rename to docs/content/open_source/archived_docs/burp-plugin.md
diff --git a/docs/content/en/open_source/archived_docs/google-sheets-sync.md b/docs/content/open_source/archived_docs/google-sheets-sync.md
similarity index 100%
rename from docs/content/en/open_source/archived_docs/google-sheets-sync.md
rename to docs/content/open_source/archived_docs/google-sheets-sync.md
diff --git a/docs/content/en/open_source/archived_docs/usage/_index.md b/docs/content/open_source/archived_docs/usage/_index.md
similarity index 100%
rename from docs/content/en/open_source/archived_docs/usage/_index.md
rename to docs/content/open_source/archived_docs/usage/_index.md
diff --git a/docs/content/en/open_source/archived_docs/usage/features.md b/docs/content/open_source/archived_docs/usage/features.md
similarity index 99%
rename from docs/content/en/open_source/archived_docs/usage/features.md
rename to docs/content/open_source/archived_docs/usage/features.md
index 51cf295776f..f03d23100cb 100644
--- a/docs/content/en/open_source/archived_docs/usage/features.md
+++ b/docs/content/open_source/archived_docs/usage/features.md
@@ -123,7 +123,7 @@ but at different levels in the data model:
### Tag Inheritance
-When enabled, tags applied to a given product will automatically be applied to all objects under Products in the [Product Hierarchy](/en/working_with_findings/organizing_engagements_tests/product_hierarchy).
+When enabled, tags applied to a given product will automatically be applied to all objects under Products in the [Product Hierarchy](/asset_modelling/hierarchy/product_hierarchy/).
#### Configuration
diff --git a/docs/content/en/open_source/archived_docs/usage/questionnaires.md b/docs/content/open_source/archived_docs/usage/questionnaires.md
similarity index 100%
rename from docs/content/en/open_source/archived_docs/usage/questionnaires.md
rename to docs/content/open_source/archived_docs/usage/questionnaires.md
diff --git a/docs/content/en/open_source/contributing/_index.md b/docs/content/open_source/contributing/_index.md
similarity index 100%
rename from docs/content/en/open_source/contributing/_index.md
rename to docs/content/open_source/contributing/_index.md
diff --git a/docs/content/en/open_source/contributing/branching-model.md b/docs/content/open_source/contributing/branching-model.md
similarity index 100%
rename from docs/content/en/open_source/contributing/branching-model.md
rename to docs/content/open_source/contributing/branching-model.md
diff --git a/docs/content/en/open_source/contributing/documentation.md b/docs/content/open_source/contributing/documentation.md
similarity index 100%
rename from docs/content/en/open_source/contributing/documentation.md
rename to docs/content/open_source/contributing/documentation.md
diff --git a/docs/content/en/open_source/contributing/how-to-write-a-parser.md b/docs/content/open_source/contributing/how-to-write-a-parser.md
similarity index 97%
rename from docs/content/en/open_source/contributing/how-to-write-a-parser.md
rename to docs/content/open_source/contributing/how-to-write-a-parser.md
index 029e6b47a4e..bd00c8abff5 100644
--- a/docs/content/en/open_source/contributing/how-to-write-a-parser.md
+++ b/docs/content/open_source/contributing/how-to-write-a-parser.md
@@ -37,7 +37,7 @@ $ docker compose build --build-arg uid=1000
|`unittests/scans//{many_vulns,no_vuln,one_vuln}.json` | Sample files containing meaningful data for unit tests. The minimal set.
|`unittests/tools/test__parser.py` | Unit tests of the parser.
|`dojo/settings/settings.dist.py` | If you want to use a modern hashcode based deduplication algorithm
-|`docs/content/en/connecting_your_tools/parsers//.md` | Documentation, what kind of file format is required and how it should be obtained
+|`docs/content/supported_tools//.md` | Documentation, what kind of file format is required and how it should be obtained
## Factory contract
@@ -252,7 +252,7 @@ Do not do something like this:
## Deduplication algorithm
-By default a new parser uses the 'legacy' deduplication algorithm documented at https://docs.defectdojo.com/en/open_source/archived_docs/usage/features/#deduplication
+By default a new parser uses the 'legacy' deduplication algorithm documented at https://docs.defectdojo.com/open_source/archived_docs/usage/features/#deduplication
Please use a pre-defined deduplication algorithm where applicable. When using the `unique_id_from_tool` or `vuln_id_from_tool` fields in the hash code configuration, it's important that these are uqniue for the finding and constant over time across subsequent scans. If this is not the case, the values can still be useful to set on the finding model without using them for deduplication.
The values must be coming from the report directly and must not be something that is calculated by the parser internally.
@@ -383,4 +383,4 @@ Please add a new .md file in [`docs/content/en/connecting_your_tools/parsers`] w
* A link to the relevant unit tests folder so that users can quickly navigate there from Documentation.
* A link to the scanner itself - (e.g. GitHub or vendor link)
-Here is an example of a completed Parser documentation page: [https://github.com/DefectDojo/django-DefectDojo/blob/master/docs/content/en/connecting_your_tools/parsers/file/acunetix.md](https://github.com/DefectDojo/django-DefectDojo/blob/master/docs/content/en/connecting_your_tools/parsers/file/acunetix.md)
+Here is an example of a completed Parser documentation page: [https://github.com/DefectDojo/django-DefectDojo/blob/master/docs/content/supported_tools/file/acunetix.md](https://github.com/DefectDojo/django-DefectDojo/blob/master/docs/content/supported_tools/file/acunetix.md)
diff --git a/docs/content/en/open_source/contributing/parser-documentation-template.md b/docs/content/open_source/contributing/parser-documentation-template.md
similarity index 95%
rename from docs/content/en/open_source/contributing/parser-documentation-template.md
rename to docs/content/open_source/contributing/parser-documentation-template.md
index 34e9586789e..943da145349 100644
--- a/docs/content/en/open_source/contributing/parser-documentation-template.md
+++ b/docs/content/open_source/contributing/parser-documentation-template.md
@@ -6,7 +6,7 @@ weight: 1
This template is designed to document a new or existing parser. Please feel free to improve with any additional information that might help your fellow security professionals.
-* Copy this .md file and add it to `/docs/content/en/connecting_your_tools/parsers/file` in the GitHub repository.
+* Copy this .md file and add it to `/docs/content/supported_tools/file` in the GitHub repository.
* Update the title to match the name of your new or existing parser.
* Fill out all sections listed below. Please remove any instructions or examples found within each section or examples.
diff --git a/docs/content/en/open_source/exporting.md b/docs/content/open_source/exporting.md
similarity index 100%
rename from docs/content/en/open_source/exporting.md
rename to docs/content/open_source/exporting.md
diff --git a/docs/content/en/open_source/languages.md b/docs/content/open_source/languages.md
similarity index 100%
rename from docs/content/en/open_source/languages.md
rename to docs/content/open_source/languages.md
diff --git a/docs/content/en/open_source/ldap-authentication.md b/docs/content/open_source/ldap-authentication.md
similarity index 100%
rename from docs/content/en/open_source/ldap-authentication.md
rename to docs/content/open_source/ldap-authentication.md
diff --git a/docs/content/en/open_source/notification_webhooks/_index.md b/docs/content/open_source/notification_webhooks/_index.md
similarity index 100%
rename from docs/content/en/open_source/notification_webhooks/_index.md
rename to docs/content/open_source/notification_webhooks/_index.md
diff --git a/docs/content/en/open_source/notification_webhooks/engagement_added.md b/docs/content/open_source/notification_webhooks/engagement_added.md
similarity index 100%
rename from docs/content/en/open_source/notification_webhooks/engagement_added.md
rename to docs/content/open_source/notification_webhooks/engagement_added.md
diff --git a/docs/content/en/open_source/notification_webhooks/how_to.md b/docs/content/open_source/notification_webhooks/how_to.md
similarity index 97%
rename from docs/content/en/open_source/notification_webhooks/how_to.md
rename to docs/content/open_source/notification_webhooks/how_to.md
index 759d73bc0db..e4caa61470b 100644
--- a/docs/content/en/open_source/notification_webhooks/how_to.md
+++ b/docs/content/open_source/notification_webhooks/how_to.md
@@ -11,7 +11,7 @@ Webhooks are HTTP requests coming from the DefectDojo instance towards a user-de
It is not unusual that in some cases a webhook can not be delivered. It is usually connected to network issues, server misconfiguration, or running upgrades on the server. DefectDojo needs to react to these outages. It might temporarily or permanently disable related endpoints. The following graph shows how it might change the status of the webhook definition based on HTTP responses (or manual user interaction).
-
+

diff --git a/docs/content/en/open_source/notification_webhooks/ping.md b/docs/content/open_source/notification_webhooks/ping.md
similarity index 100%
rename from docs/content/en/open_source/notification_webhooks/ping.md
rename to docs/content/open_source/notification_webhooks/ping.md
diff --git a/docs/content/en/open_source/notification_webhooks/product_added.md b/docs/content/open_source/notification_webhooks/product_added.md
similarity index 100%
rename from docs/content/en/open_source/notification_webhooks/product_added.md
rename to docs/content/open_source/notification_webhooks/product_added.md
diff --git a/docs/content/en/open_source/notification_webhooks/product_type_added.md b/docs/content/open_source/notification_webhooks/product_type_added.md
similarity index 100%
rename from docs/content/en/open_source/notification_webhooks/product_type_added.md
rename to docs/content/open_source/notification_webhooks/product_type_added.md
diff --git a/docs/content/en/open_source/notification_webhooks/scan_added.md b/docs/content/open_source/notification_webhooks/scan_added.md
similarity index 100%
rename from docs/content/en/open_source/notification_webhooks/scan_added.md
rename to docs/content/open_source/notification_webhooks/scan_added.md
diff --git a/docs/content/en/open_source/notification_webhooks/test_added.md b/docs/content/open_source/notification_webhooks/test_added.md
similarity index 100%
rename from docs/content/en/open_source/notification_webhooks/test_added.md
rename to docs/content/open_source/notification_webhooks/test_added.md
diff --git a/docs/content/en/open_source/notification_webhooks/transition-state b/docs/content/open_source/notification_webhooks/transition-state
similarity index 100%
rename from docs/content/en/open_source/notification_webhooks/transition-state
rename to docs/content/open_source/notification_webhooks/transition-state
diff --git a/docs/content/en/open_source/rate_limiting.md b/docs/content/open_source/rate_limiting.md
similarity index 94%
rename from docs/content/en/open_source/rate_limiting.md
rename to docs/content/open_source/rate_limiting.md
index 691e4401c0d..494a0371d6f 100644
--- a/docs/content/en/open_source/rate_limiting.md
+++ b/docs/content/open_source/rate_limiting.md
@@ -13,7 +13,7 @@ For further information, please visit the package documentation [Django Ratelimi
#### Enable Rate Limiting
-To enable and configure rate limiting, edit the settings (see [Configuration](../../open_source/installation/configuration) and edit/replace the following information:
+To enable and configure rate limiting, edit the settings (see [Configuration](../../get_started/open_source/configuration) and edit/replace the following information:
{{< highlight python >}}
DD_RATE_LIMITER_ENABLED=(bool, True),
diff --git a/docs/content/supported_tools/_index.md b/docs/content/supported_tools/_index.md
index aaa71e1b65e..abe735c1b12 100644
--- a/docs/content/supported_tools/_index.md
+++ b/docs/content/supported_tools/_index.md
@@ -24,14 +24,14 @@ DefectDojo can parse data from 200+ security reports and counting.
**Smart Upload** allows you to split infrastructure-wide scan files up by component or endpoint, and easily combine those results with other Findings from the same location.
-| [Connectors](/en/connecting_your_tools/connectors/about_connectors/): supported tools | [Smart Upload](/en/connecting_your_tools/import_scan_files/smart_upload/): supported tools |
+| [Connectors](/import_data/pro/connectors/about_connectors/): supported tools | [Smart Upload](/import_data/pro/specialized_import/smart_upload/): supported tools |
| --- | --- |
| Anchore, AWS Security Hub, BurpSuite, Checkmarx ONE, Dependency-Track, Probely, Semgrep, SonarQube, Snyk, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable, Wiz |
# All Supported Tools
-All of these listed reports can be ingested via [Import/Reimport](/en/connecting_your_tools/import_intro) methods. This means that they can be imported to both Open-Source and Pro instances using the UI or API.
+All of these listed reports can be ingested via [Import/Reimport](/import_data/import_intro/comparison/) methods. This means that they can be imported to both Open-Source and Pro instances using the UI or API.
If your tool is not in this list, there's a good chance that DefectDojo can still import a report from the tool. Consider the [Generic Findings Import](/supported_tools/parsers/generic_findings_import/) method.
-DefectDojo Pro users can import any JSON or CSV report using the [Universal Parser](/en/connecting_your_tools/universal_parser).
\ No newline at end of file
+DefectDojo Pro users can import any JSON or CSV report using the [Universal Parser](/import_data/pro/specialized_import/universal_parser/).
\ No newline at end of file
diff --git a/docs/content/supported_tools/parsers/_index.md b/docs/content/supported_tools/parsers/_index.md
index d290a5c465c..344ac879c30 100644
--- a/docs/content/supported_tools/parsers/_index.md
+++ b/docs/content/supported_tools/parsers/_index.md
@@ -25,14 +25,14 @@ DefectDojo can parse data from 180+ security reports and counting.
**Smart Upload** allows you to split infrastructure-wide scan files up by component or endpoint, and easily combine those results with other Findings from the same location.
-| [Connectors](/en/connecting_your_tools/connectors/about_connectors/): supported tools | [Smart Upload](/en/connecting_your_tools/import_scan_files/smart_upload/): supported tools |
+| [Connectors](/import_data/pro/connectors/about_connectors/): supported tools | [Smart Upload](/import_data/pro/specialized_import/smart_upload/): supported tools |
| --- | --- |
| AWS Security Hub, BurpSuite, Checkmarx ONE, Dependency-Track, Probely, Semgrep, SonarQube, Snyk, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable, Wiz |
# All Supported Tools
-All of these listed reports can be ingested via [Import/Reimport](/en/connecting_your_tools/import_intro) methods. This means that they can be imported to both Open-Source and Pro instances using the UI or API.
+All of these listed reports can be ingested via [Import/Reimport](/import_data/import_intro/comparison/) methods. This means that they can be imported to both Open-Source and Pro instances using the UI or API.
If your tool is not in this list, there's a good chance that DefectDojo can still import a report from the tool. Consider the [Generic Findings Import](/supported_tools/parsers/generic_findings_import/) method.
-DefectDojo Pro users can import any JSON or CSV report using the [Universal Parser](/en/connecting_your_tools/universal_parser).
+DefectDojo Pro users can import any JSON or CSV report using the [Universal Parser](/import_data/pro/specialized_import/universal_parser/).
diff --git a/docs/content/supported_tools/parsers/file/aws_prowler_v3plus.md b/docs/content/supported_tools/parsers/file/aws_prowler_v3plus.md
index dba7e176293..e8fe00b34a6 100644
--- a/docs/content/supported_tools/parsers/file/aws_prowler_v3plus.md
+++ b/docs/content/supported_tools/parsers/file/aws_prowler_v3plus.md
@@ -5,7 +5,7 @@ toc_hide: true
### File Types
DefectDojo parser accepts a native `json` file produced by prowler v3 with file extension `.json` or a `ocsf-json` file produced by prowler v4 with file extension `.ocsf.json`.
-Please note: earlier versions of AWS Prowler create output data in a different format. See our other [prowler parser documentation](https://docs.defectdojo.com/en/connecting_your_tools/parsers/file/aws_prowler/) if you are using an earlier version of AWS Prowler.
+Please note: earlier versions of AWS Prowler create output data in a different format. See our other [prowler parser documentation](https://docs.defectdojo.com/supported_tools/file/aws_prowler/) if you are using an earlier version of AWS Prowler.
JSON reports can be created from the [AWS Prowler v3 CLI](https://docs.prowler.com/projects/prowler-open-source/en/v3/tutorials/reporting/#json) using the following command: `prowler -M json`
diff --git a/docs/content/supported_tools/parsers/file/burp.md b/docs/content/supported_tools/parsers/file/burp.md
index 970d9f18a49..ffe5a1b0edb 100644
--- a/docs/content/supported_tools/parsers/file/burp.md
+++ b/docs/content/supported_tools/parsers/file/burp.md
@@ -4,7 +4,7 @@ toc_hide: true
---
### File Types
DefectDojo parser accepts Burp Issue data as an .xml file.
-To parse an HTML file instead, use this method: https://docs.defectdojo.com/en/connecting_your_tools/parsers/file/burp_suite_dast/
+To parse an HTML file instead, use this method: https://docs.defectdojo.com/supported_tools/file/burp_suite_dast/
When the Burp report is generated, **the recommended option is Base64
encoding both the request and response fields** - e.g. check the box
diff --git a/docs/content/supported_tools/parsers/file/burp_suite_dast.md b/docs/content/supported_tools/parsers/file/burp_suite_dast.md
index f17f7ef7460..3113895fba5 100644
--- a/docs/content/supported_tools/parsers/file/burp_suite_dast.md
+++ b/docs/content/supported_tools/parsers/file/burp_suite_dast.md
@@ -7,7 +7,7 @@ toc_hide: true
The Burp Suite DAST Scan parser processes HTML reports from Burp Suite DAST and imports the findings into DefectDojo. The parser extracts vulnerability details, severity ratings, descriptions, remediation steps, and other metadata from the HTML report.
## Supported File Types
-The parser accepts a Standard Report as an HTML file. To parse an XML file instead, use the [Burp XML parser](https://docs.defectdojo.com/en/connecting_your_tools/parsers/file/burp/).
+The parser accepts a Standard Report as an HTML file. To parse an XML file instead, use the [Burp XML parser](https://docs.defectdojo.com/supported_tools/file/burp/).
See the Burp documentation for information on how to export a Standard Report: [Burp Suite DAST Downloading reports](https://portswigger.net/burp/documentation/dast/user-guide/work-with-scan-results/generate-reports)
diff --git a/docs/content/supported_tools/parsers/file/wiz.md b/docs/content/supported_tools/parsers/file/wiz.md
index 771d316d062..39f8dd83e36 100644
--- a/docs/content/supported_tools/parsers/file/wiz.md
+++ b/docs/content/supported_tools/parsers/file/wiz.md
@@ -5,7 +5,7 @@ toc_hide: true
The [Wiz](https://www.wiz.io/) parser for DefectDojo supports imports from both Wiz Scanner Standard and SCA (Software Composition Analysis) .csv output from Wiz.io. This document details the parsing of both formats into DefectDojo field mappings, unmapped fields, and location of each field's parsing code for easier troubleshooting and analysis.
-⚠️ **DefectDojo Pro** Users can also automatically create Findings directly from Wiz using the Wiz Connector. See our [Connectors documentation](/en/connecting_your_tools/connectors/about_connectors/) for more details.
+⚠️ **DefectDojo Pro** Users can also automatically create Findings directly from Wiz using the Wiz Connector. See our [Connectors documentation](/import_data/pro/connectors/about_connectors/) for more details.
## Link To Tool
diff --git a/docs/content/en/working_with_findings/finding_deduplication/deduplication_tuning_os.md b/docs/content/triage_findings/finding_deduplication/OS__deduplication_tuning.md
similarity index 91%
rename from docs/content/en/working_with_findings/finding_deduplication/deduplication_tuning_os.md
rename to docs/content/triage_findings/finding_deduplication/OS__deduplication_tuning.md
index d46f9626567..f88b72ed562 100644
--- a/docs/content/en/working_with_findings/finding_deduplication/deduplication_tuning_os.md
+++ b/docs/content/triage_findings/finding_deduplication/OS__deduplication_tuning.md
@@ -1,12 +1,13 @@
---
-title: "Deduplication Tuning (Open Source)"
+title: "Deduplication Tuning"
description: "Configure deduplication in DefectDojo Open Source: algorithms, hash fields, endpoints, and service"
weight: 5
+audience: opensource
---
-This page explains how to tune deduplication in the Open Source (OS) edition of DefectDojo. For a visual, feature-rich tuning UI, see the Pro documentation. The OS edition uses settings files and environment variables.
+The Open Source edition of DefectDojo uses settings files and environment variables tune deduplication.
-See also: [Configuration](/en/open_source/installation/configuration) for details on environment variables and `local_settings.py` overrides.
+See also: [Open Source Configuration](/get_started/open_source/configuration/) for details on environment variables and `local_settings.py` overrides.
## What you can configure
@@ -138,10 +139,3 @@ To help troubleshooting deduplication use the following tools:


-
-## Related documentation
-
-- [Deduplication Algorithms](deduplication_algorithms): conceptual overview and endpoint behavior.
-- [Avoiding duplicates via reimport](avoiding_duplicates_via_reimport).
-
-
diff --git a/docs/content/en/working_with_findings/finding_deduplication/tune_deduplication.md b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md
similarity index 98%
rename from docs/content/en/working_with_findings/finding_deduplication/tune_deduplication.md
rename to docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md
index 675f4cc88f3..9da8005d8a1 100644
--- a/docs/content/en/working_with_findings/finding_deduplication/tune_deduplication.md
+++ b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md
@@ -1,7 +1,8 @@
---
-title: "Deduplication Tuning (Pro)"
+title: "Deduplication Tuning"
description: "Configure how DefectDojo identifies and manages duplicate findings"
weight: 4
+audience: pro
---
Deduplication Tuning is a DefectDojo Pro feature that gives you fine-grained control over how findings are deduplicated, allowing you to optimize duplicate detection for your specific security testing workflow.
diff --git a/docs/content/en/working_with_findings/finding_deduplication/enabling_product_deduplication.md b/docs/content/triage_findings/finding_deduplication/PRO_enabling_product_deduplication.md
similarity index 94%
rename from docs/content/en/working_with_findings/finding_deduplication/enabling_product_deduplication.md
rename to docs/content/triage_findings/finding_deduplication/PRO_enabling_product_deduplication.md
index 7bff087c898..5f2f12e4abc 100644
--- a/docs/content/en/working_with_findings/finding_deduplication/enabling_product_deduplication.md
+++ b/docs/content/triage_findings/finding_deduplication/PRO_enabling_product_deduplication.md
@@ -2,6 +2,7 @@
title: "Enabling Deduplication"
description: "How to enable Deduplication at the Product level"
weight: 2
+audience: pro
---
Deduplication can be implemented at either a Product level or at a more narrow Engagement level.
@@ -26,8 +27,6 @@ Deduplication can be implemented at either a Product level or at a more narrow E
Applying **Delete Deduplicate Findings** will begin a deletion process immediately. DefectDojo will look at each Finding with Duplicates recorded, and will delete old duplicate Findings until the Maximum Duplicate number has been reached.
-For more information on how DefectDojo determines what to delete, see our guide to **[Deleting Deduplicate Findings](../delete_deduplicates/).**
-
## Deduplication for Engagements
Rather than Deduplicating across an entire Product, you can set a deduplication scope to be within a single Engagement exclusively.
diff --git a/docs/content/en/working_with_findings/findings_workflows/_index.md b/docs/content/triage_findings/finding_deduplication/_index.md
similarity index 55%
rename from docs/content/en/working_with_findings/findings_workflows/_index.md
rename to docs/content/triage_findings/finding_deduplication/_index.md
index 454581ccee2..86e6616427e 100644
--- a/docs/content/en/working_with_findings/findings_workflows/_index.md
+++ b/docs/content/triage_findings/finding_deduplication/_index.md
@@ -1,10 +1,8 @@
---
-title: "Finding Workflows & Status"
+title: "Deduplication"
date: 2021-02-02T20:46:29+01:00
draft: false
-weight: 3
type: docs
-sidebar:
- collapsed: true
+weight: 3
exclude_search: true
---
diff --git a/docs/content/triage_findings/finding_deduplication/about_deduplication.md b/docs/content/triage_findings/finding_deduplication/about_deduplication.md
new file mode 100644
index 00000000000..14f203a3afe
--- /dev/null
+++ b/docs/content/triage_findings/finding_deduplication/about_deduplication.md
@@ -0,0 +1,117 @@
+---
+title: "About Deduplication"
+description: "Deduplication fundamentals and key concepts"
+weight: 1
+---
+
+DefectDojo is designed to ingest bulk reports from tools, creating one or more Findings based on the content of the report. When using DefectDojo, you’ll most likely be ingesting reports from the same tool on a regular basis, which means that duplicate Findings are highly likely.
+
+This is where Deduplication comes in, a Smart feature which you can set up to automatically manage duplicate Findings.
+
+## How DefectDojo handles duplicates
+
+1. First, you import **Test 1\.** Your report contains a vulnerability which is recorded as Finding A.
+2. **Later, you import Test 2 which contains the same vulnerability. This will be recorded as Finding B, and Finding B will be marked as a duplicate of Finding A.**
+3. Later still, you import **Test 3** which also contains that vulnerability. This will be recorded as Finding C, which will be marked as a duplicate of Finding A.
+
+By creating and marking Duplicates in this way, DefectDojo ensures that all the work for the ‘original’ vulnerability is centralized on the original Finding page, without creating separate contexts, or giving your team the impression that there are multiple separate vulnerabilities which need to be addressed.
+
+By default, these Tests would need to be nested under the same Product for Deduplication to be applied. If you wish, you can further limit the Deduplication scope to a single Engagement.
+
+
+
+Duplicate Findings are set as Inactive by default. This does not mean the Duplicate Finding itself is Inactive. Rather, this is so that your team only has a single active Finding to work on and remediate, with the implication being that once the original Finding is Mitigated, the Duplicates will also be Mitigated.
+
+## Deduplication vs Reimport
+
+Deduplication and Reimport are similar processes but they have a key difference:
+
+* When you Reimport to a Test, the Reimport process looks at incoming Findings, **filters and** **discards any matches**. Those matches will never be created as Findings or Finding Duplicates.
+* Deduplication is applied 'passively' on Findings that have already been created. It will identify duplicates in scope and **label them**, but it will not delete or discard the Finding unless 'Delete Deduplicate Findings' is enabled.
+* The 'reimport' action of discarding a Finding always happens before deduplication; DefectDojo **cannot deduplicate Findings that are never created** as a result of Reimport's filtering.
+
+## When are duplicates appropriate?
+
+Duplicates are useful when you’re dealing with shared, but discrete Testing contexts. For example, if your Product is uploading Test results for two different repositories, which need to be compared, it’s useful to know which vulnerabilities are shared across those repositories.
+
+However, if DefectDojo is creating excess duplicates, this can also be a sign that you need to adjust your pipelines or import processes.
+
+## What do my duplicates indicate?
+
+* **The same vulnerability, but found in a different context:** this is the appropriate way to use Duplicate Findings. If you have many components which are affected by the same vulnerability, you would likely want to know which components are affected to understand the scope of the problem.
+
+* **The same vulnerability, found in the same context**: better options exist for this case. If the Duplicate Finding does not give you any new context on the vulnerability, or if you find yourself frequently ignoring or deleting your duplicate Findings, this is a sign that your process can be improved. For example, Reimport allows you to effectively manage incoming reports from a CI/CD pipeline. Rather than create a completely new Finding object for each duplicate, Reimport will make a note of the incoming duplicate without creating the Duplicate Finding at all.
+
+## Overview
+
+DefectDojo supports four deduplication algorithms that can be selected per parser (test type):
+
+- **Unique ID From Tool**: Uses the scanner-provided unique identifier.
+- **Hash Code**: Uses a configured set of fields to compute a hash.
+- **Unique ID From Tool or Hash Code**: Prefer the tool’s unique ID; fall back to hash when no matching unique ID is found.
+- **Legacy**: Historical algorithm with multiple conditions; only available in the Open Source version.
+
+## How endpoints are assessed per algorithm
+
+Endpoints can influence deduplication in different ways depending on the algorithm and configuration.
+
+### Unique ID From Tool
+
+- Deduplication uses `unique_id_from_tool` (or `vuln_id_from_tool`).
+- **Endpoints are ignored** for duplicate matching.
+- A finding’s hash may still be calculated for other features, but it does not affect deduplication under this algorithm.
+
+### Hash Code
+
+- Deduplication uses a hash computed from fields specified by `HASHCODE_FIELDS_PER_SCANNER` for the given parser.
+- The hash also includes fields from `HASH_CODE_FIELDS_ALWAYS` (see Service field section below).
+- Endpoints can affect deduplication in two ways:
+ - If the scanner’s hash fields include `endpoints`, they are part of the hash and must match accordingly.
+- If the scanner’s hash fields do not include `endpoints`, optional endpoint-based matching can be enabled via `DEDUPE_ALGO_ENDPOINT_FIELDS` (OS setting). When configured:
+ - Set it to an empty list `[]` to ignore endpoints entirely.
+ - Set it to a list of endpoint attributes (e.g. `["host", "port"]`). If at least one endpoint pair between the two findings matches on all listed attributes, deduplication can occur.
+
+### Unique ID From Tool or Hash Code
+A finding is a duplicate with another if they have the same unique_id_from_tool OR the same hash_code.
+
+The endpoints also have to match for the findings to be considered duplicates, see the Hash Code algorithm above.
+
+### Legacy (Open Source only)
+
+- Deduplication considers multiple attributes including endpoints.
+- Behavior differs for static vs dynamic findings:
+ - **Static findings**: The new finding must contain all endpoints of the original. Extra endpoints on the new finding are allowed.
+ - **Dynamic findings**: Endpoints must strictly match (commonly by host and port); differing endpoints prevent deduplication.
+- If there are no endpoints and both `file_path` and `line` are empty, deduplication typically does not occur.
+
+## Background processing
+
+- Dedupe is triggered on import/reimport and during certain updates run via Celery in the background.
+
+## Service field and its impact
+
+- By default, `HASH_CODE_FIELDS_ALWAYS = ["service"]`, meaning the `service` associated with a finding is appended to the hash for all scanners.
+- Practical implications:
+ - Two otherwise identical findings with different `service` values will produce different hashes and will not deduplicate under Hash-based paths.
+ - During import/reimport, the `Service` field entered in the UI can override the parser-provided service. Changing it can change the hash and therefore affect deduplication outcomes.
+ - If you want service to have no impact on deduplication, configure `HASH_CODE_FIELDS_ALWAYS` accordingly (see the OS tuning page). Removing `service` from the always-included list will stop it from affecting hashes.
+
+## Delete Deduplicate Findings
+
+If you have an excessive amount of duplicate Findings which you want to delete, you can set **Delete Deduplicate Findings** as an option in the **System Settings**.
+
+**Delete Deduplicate Findings**, combined with the **Maximum Duplicates** field allows DefectDojo to limit the amount of Duplicate Findings stored. When this field is enabled, DefectDojo will only keep a certain number of Duplicate Findings.
+
+### Which duplicates will be deleted?
+
+The original Finding will never be deleted automatically from DefectDojo, but once the threshold for Maximum Duplicates is crossed, DefectDojo will automatically delete the oldest Duplicate Finding.
+
+For example, let’s say that you had your Maximum Duplicates field set to ‘1’.
+
+1. First, you import **Test 1\.** Your report contains a vulnerability which is recorded as Finding A.
+2. **Later, you import Test 2 contains the same vulnerability. This will be recorded as Finding B, and Finding B will be marked as a duplicate of Finding A.**
+3. Later still, you import **Test 3** which also contains that vulnerability. This will be recorded as Finding C, which will be marked as a duplicate of Finding A. At this time, Finding B will be deleted from DefectDojo as the threshold for maximum duplicates has been crossed.
+
+### Applying this setting
+
+Applying **Delete Deduplicate Findings** will begin a deletion process immediately. This setting can be applied on the **System Settings** page. See Enabling Deduplication for more information.
diff --git a/docs/content/en/working_with_findings/finding_deduplication/avoiding_duplicates_via_reimport.md b/docs/content/triage_findings/finding_deduplication/avoid_excess_duplicates.md
similarity index 52%
rename from docs/content/en/working_with_findings/finding_deduplication/avoiding_duplicates_via_reimport.md
rename to docs/content/triage_findings/finding_deduplication/avoid_excess_duplicates.md
index 414a16f3ed1..bd144df6dd3 100644
--- a/docs/content/en/working_with_findings/finding_deduplication/avoiding_duplicates_via_reimport.md
+++ b/docs/content/triage_findings/finding_deduplication/avoid_excess_duplicates.md
@@ -1,9 +1,55 @@
---
-title: "Avoid Duplicates: Reimport Recurring Tests"
+title: "Avoiding Excess Duplicates"
description: ""
weight: 4
---
+One of DefectDojo’s strengths is that the data model can accommodate many different use\-cases and applications. You’ll likely change your approach as you master the software and discover ways to optimize your workflow.
+
+By default, DefectDojo does not delete any duplicate Findings that are created. Each Finding is considered to be a separate instance of a vulnerability. So in this case, **Duplicate Findings** can be an indicator that a process change is required to your workflow.
+
+## When are Duplicate Findings acceptable?
+
+Duplicate Findings are not always indicative of a problem. There are many cases where keeping duplicates is the preferred approach. For example:
+
+* If your team uses and reports on Interactive Engagements. If you want to create a discrete report on a single Test specifically, you would want to know if there’s an occurrence of a Finding that was already uncovered earlier.
+* If you have Engagements which are contextually separated (for example, because they cover different repositories) you would want to be able to flag Findings which are occurring in both places.
+
+## Checking for redundant imports
+
+## Step 1: Clean up your excess Duplicates
+
+Fortunately, DefectDojo’s Deduplication settings allow you to mass\-delete duplicates once a certain threshold has been crossed. This feature makes the cleanup process easier. To learn more about this process, see our article on **Finding Deduplication** \<\-link will go here.
+
+### Step 2: Evaluate your Engagements for redundancies
+
+Once you’ve cleaned up your duplicate Findings, it’s a good practice to look at the Product which contained them to see if there’s a clear culprit. You might find that there are Engagements contained within which have a redundant context.
+
+#### Duplicate or Reused Engagements
+
+Engagements store one or more Tests for a particular testing context. That context is ultimately up to you to define for yourself, but if you see a few Engagements within your Product which should share the same context, consider combining them into a single engagement.
+
+### Questions to ask when defining Engagement context:
+
+* If I wanted to make a report on this work, would the Engagement contain all of the relevant information I need?
+* Are we proactively creating Engagements ahead of time or are they being created ‘ad\-hoc’ by my import process?
+* Are we using the right kind of Engagement \- **Interactive** or **CI/CD**?
+* What section of the codebase is being worked on by tests: is each repository a separate context or could multiple repositories make up a shared context for testing?
+* Who are the stakeholders involved with the Productt, and how will I share results with them?
+
+### Step 3: Check for redundant Tests
+
+If you discover that separate Tests have been created which capture the same testing context, this may be an indicator that these tests can be consolidated into a single Reimport.
+
+DefectDojo has two methods for importing test data to create Findings: **Import** and **Reimport**. Both of these methods are very similar, but the key difference between the two is that **Import** always creates a new Test, while **Reimport** can add new data to an existing Test. It’s also worth noting that **Reimport** does not create duplicate Findings within that Test.
+
+Each time you import new vulnerability reports into DefectDojo, those reports will be stored in a Test object. A Test object can be created by a user ahead of time to hold a future **Import**. If a user wants to import data without specifying a Test destination, a new Test will be created to store the incoming report.
+
+Tests are flexible objects, and although they can only hold one *kind* of report, they can handle multiple instances of that same report through the **Reimport** method. To learn more about Reimport, see our **[article](/import_data/import_intro/import_vs_reimport/)** on this topic.
+
+
+## Using Reimport for continual Tests
+
If you have a CI/CD pipeline, a daily scan process or any kind of repeated incoming report, setting up a Reimport process in advance is key to avoiding excessive duplicates. Reimport collapses the context and Findings associated with a recurring test into a single Test page, where you can review import history and track vulnerability changes across scans.
1. Create an Engagement to store the CI/CD results for the object you’re running CI/CD on. This could be a code repository where you have CI/CD actions set up to run. Generally, you want a separate Engagement set up for each pipeline so that you can quickly understand where the Finding results are coming from.
@@ -12,19 +58,19 @@ If you have a CI/CD pipeline, a daily scan process or any kind of repeated incom
3. You do not need to create a new Test each time the CI/CD action runs. Instead, you can **Reimport** data to the same test location.
-## Reimport in action
+### Reimport in action
DefectDojo will compare the incoming scan data with the existing scan data, and then apply changes to the Findings contained within your Test as follows:
-### Create Findings
+#### Create Findings
Any vulnerabilities which were not contained in the previous import will be added to the Test automatically as new Findings.
-### Ignore existing Findings
+#### Ignore existing Findings
If any incoming Findings match Findings that already exist, the incoming Findings will be discarded rather than recorded as Duplicates. These Findings have been recorded already \- no need to add a new Finding object. The Test page will show these Findings as **Left Untouched**.
-### Close Findings
+#### Close Findings
If there are any Findings that already exist in the Test but which are not present in the incoming report, you can choose to automatically set those Findings to Inactive and Mitigated (on the assumption that those vulnerabilities have been resolved since the previous import). The Test page will show these Findings as **Closed**.
@@ -33,7 +79,7 @@ If you don’t want any Findings to be closed, you can disable this behavior on
* Uncheck the **Close Old Findings** checkbox if using the UI
* Set **close\_old\_findings** to **False** if using the API
-### Reopen Findings
+#### Reopen Findings
* If there are any Closed Findings which appear again in a Reimport, they will automatically be Reopened. The assumption is that these vulnerabilities have occurred again, despite previous mitigation. The Test page will track these Findings as **Reactivated**.
@@ -42,13 +88,14 @@ If you’re using a triage\-less scanner, or you don’t otherwise want Closed F
* Set **do\_not\_reactivate** to **True** if using the API
* Check the **Do Not Reactivate** checkbox if using the UI
-## Working with Import History
+### Working with Import History
Import History for a given test is listed under the **Test Overview** header on the **Test** page.
This table shows each Import or Reimport as a single line with a **Timestamp**, along with **Branch Tag, Build ID, Commit Hash** and **Version** columns if those were specified.

+
### Actions
This header indicates the actions taken by an Import/Reimport.
@@ -58,7 +105,7 @@ This header indicates the actions taken by an Import/Reimport.
* **\# left untouched shows the count of Open Findings which were unchanged by a Reimport (because they also existed in the incoming report).**
* **\#** **reactivated** shows any Closed Findings which were reopened by an incoming Reimport.
-## Why not simply use Import?
+### Why not simply use Import?
Although both methods are possible, Import should be reserved for **new occurrences** of Findings and Data, while Reimport should be applied for **further iterations** of the same data.
diff --git a/docs/content/triage_findings/findings_workflows/_index.md b/docs/content/triage_findings/findings_workflows/_index.md
new file mode 100644
index 00000000000..03bc39e3116
--- /dev/null
+++ b/docs/content/triage_findings/findings_workflows/_index.md
@@ -0,0 +1,8 @@
+---
+title: "Findings"
+date: 2021-02-02T20:46:29+01:00
+draft: false
+weight: 1
+type: docs
+exclude_search: true
+---
diff --git a/docs/content/en/working_with_findings/findings_workflows/create_findings_manually.md b/docs/content/triage_findings/findings_workflows/create_findings_manually.md
similarity index 100%
rename from docs/content/en/working_with_findings/findings_workflows/create_findings_manually.md
rename to docs/content/triage_findings/findings_workflows/create_findings_manually.md
diff --git a/docs/content/en/working_with_findings/findings_workflows/editing_findings.md b/docs/content/triage_findings/findings_workflows/editing_findings.md
similarity index 99%
rename from docs/content/en/working_with_findings/findings_workflows/editing_findings.md
rename to docs/content/triage_findings/findings_workflows/editing_findings.md
index 3602779bd8c..adece9325ff 100644
--- a/docs/content/en/working_with_findings/findings_workflows/editing_findings.md
+++ b/docs/content/triage_findings/findings_workflows/editing_findings.md
@@ -1,7 +1,7 @@
---
title: "Editing Findings"
description: "Change a Finding’s Status, or add more metadata as you resolve an issue"
-weight: 1
+weight: 2
---
If you want to add notes or update the language on a Finding to be more relevant to the current situation, you can do so through the Edit Finding form.
diff --git a/docs/content/en/working_with_findings/findings_workflows/finding_status_definitions.md b/docs/content/triage_findings/findings_workflows/finding_status_definitions.md
similarity index 100%
rename from docs/content/en/working_with_findings/findings_workflows/finding_status_definitions.md
rename to docs/content/triage_findings/findings_workflows/finding_status_definitions.md
diff --git a/docs/content/en/working_with_findings/intro_to_findings.md b/docs/content/triage_findings/findings_workflows/intro_to_findings.md
similarity index 95%
rename from docs/content/en/working_with_findings/intro_to_findings.md
rename to docs/content/triage_findings/findings_workflows/intro_to_findings.md
index 8bc26bf21ae..8d455dd4150 100644
--- a/docs/content/en/working_with_findings/intro_to_findings.md
+++ b/docs/content/triage_findings/findings_workflows/intro_to_findings.md
@@ -74,7 +74,7 @@ If you’re in charge of security reporting for many different contexts, softwar
* Each Product in DefectDojo can have a different SLA configuration, so that you can instantly flag Findings that are discovered in Production or other highly sensitive environments.
* You can create a report directly from a **Product Type, Product, Engagement or Test** to ‘zoom in and out’ of your security context. **Tests** contain results from a single tool, **Engagements** can combine multiple Tests, **Products** can contain multiple Engagements, **Product Types** can contain multiple Products.
-For more information on creating a Report, see our guides to **[Custom Reporting](/en/share_your_findings/pro_reports/using_the_report_builder/)**.
+For more information on creating a Report, see our guides to **[Custom Reporting](/metrics_reports/reports/using_the_report_builder)**.
### Triage Vulnerabilities using Finding Status
@@ -102,8 +102,3 @@ Any Appsec team member understands that issue mitigation can’t be prioritized
Sometimes, the exploitability and threat posed by a known vulnerability can change based on new data. To keep your work up to date, DefectDojo Pro has partnered with First.org to maintain a database of the latest EPSS scores related to Findings. Any Findings in DefectDojo Pro will be kept up to date automatically according to their EPSS, which is directly based on the CVE of the Finding.
If a Finding’s EPSS score changes (i.e. the related Finding becomes more exploitable or less exploitable), the Severity of the Finding will adjust accordingly.
-
-# Next Steps:
-
-* Learn how to add or adjust data on your Findings: **[Editing Findings](../findings_workflows/editing_findings)**.
-* Learn how to apply **[Risk Acceptances](../findings_workflows/risk_acceptances/)** to Findings which create a record of sensitive decisions made surrounding risk\-accepted vulnerabilities.
diff --git a/docs/content/en/working_with_findings/findings_workflows/risk_acceptances.md b/docs/content/triage_findings/findings_workflows/risk_acceptances.md
similarity index 100%
rename from docs/content/en/working_with_findings/findings_workflows/risk_acceptances.md
rename to docs/content/triage_findings/findings_workflows/risk_acceptances.md
diff --git a/docs/layouts/_partials/header/header.html b/docs/layouts/_partials/header/header.html
index c76685e5e10..24af9353c0b 100644
--- a/docs/layouts/_partials/header/header.html
+++ b/docs/layouts/_partials/header/header.html
@@ -17,21 +17,6 @@
\ No newline at end of file
diff --git a/docs/layouts/home.html b/docs/layouts/home.html
index 05a254feae1..a491bfad0fd 100644
--- a/docs/layouts/home.html
+++ b/docs/layouts/home.html
@@ -7,29 +7,11 @@
{{ .Title }}
Official documentation for DefectDojo Pro and Open-Source editions, maintained by DefectDojo Inc. and the Open-Source community.