You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/content/en/changelog/changelog.md
+23-5Lines changed: 23 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,6 +8,24 @@ Here are the release notes for **DefectDojo Pro (Cloud Version)**. These release
8
8
9
9
For Open Source release notes, please see the [Releases page on GitHub](https://github.com/DefectDojo/django-DefectDojo/releases), or alternatively consult the Open Source [upgrade notes](/en/open_source/upgrading/upgrading_guide/).
10
10
11
+
## August 2025: v2.49
12
+
13
+
The Pro UI has been significantly reorganized, with changes to page organization.
14
+
15
+
16
+
### August 25: 2.49.3
17
+
18
+
[Integrations](/en/share_your_findings/integrations/) has been added to DefectDojo Pro, adding an Jira-style integrations for Azure DevOps, GitHub and GitLab boards.
19
+
20
+
***(API)** Basic Auth Login has been removed from the swagger form. Only cookieAuth and tokenAuth are accepted.
21
+
***(API)** When MFA is enabled, an MFA code will be required to use the `/api-token-auth` endpoint.
22
+
***(Connectors)** "Location" has been renamed to "Location URL" in Connectors setup form.
23
+
***(Universal Parser)** Fixed an issue where a False value in an Active key still created an Active Finding.
24
+
***(Pro UI)** Unique ID from Tool has been added to the Findings list and Finding view
25
+
***(Pro UI)** Test Status added to Test View.
26
+
***(Pro UI)** Added additional Import/Reimport success messages to confirm successful test creation.
27
+
28
+
11
29
## July 2025: v2.48
12
30
13
31
### July 21/22/28, 2025: v2.48.3 / v2.48.4 / v2.48.5
@@ -37,23 +55,23 @@ For Open Source release notes, please see the [Releases page on GitHub](https://
37
55
38
56
## June 2025: v2.47
39
57
40
-
### July 1, 2025: v2.47.4
58
+
####July 1, 2025: v2.47.4
41
59
42
60
-**(Pro UI)** Products, Engagements, Tests, Findings and Endpoints can be edited directly from their respective tables via a modal.
43
61
-**(Pro UI)** Calendar view now supports additional query parameters for filtering Tests or Engagements.
44
62
-**(Pro UI)** Engagements, Tests and the entire Calendar can be exported as .ics files.
45
63
46
64
47
65
48
-
### June 23, 2025: v2.47.3
66
+
####June 23, 2025: v2.47.3
49
67
50
68
-**(Pro UI)** Finding Templates can now be added in the Pro UI, from **Findings > Finding Templates** on the sidebar.
51
69
-**(Pro UI)** A better error message is displayed when Jira Instance deletion is unsuccessful.
52
70
-**(Pro UI)** Product Types can now be edited through a modal: **"⋮" > Edit Product Type** will open a pop-up modal window instead of taking a user to a new page.
53
71
54
72
55
73
56
-
### June 16, 2025: v2.47.2
74
+
####June 16, 2025: v2.47.2
57
75
58
76
-**(Pro UI)** Endpoint Metadata can now be uploaded to Products. You can now import a .csv list of all endpoints associated with a Product, from **View Product > Endpoints > Import Endpoint Metadata**
59
77
@@ -69,7 +87,7 @@ For Open Source release notes, please see the [Releases page on GitHub](https://
69
87
70
88
71
89
72
-
### June 9, 2025: v2.47.1
90
+
####June 9, 2025: v2.47.1
73
91
74
92
-**(Pro UI)** Vulnerable Endpoints table has now been added to Finding pages.
75
93
@@ -78,7 +96,7 @@ For Open Source release notes, please see the [Releases page on GitHub](https://
78
96
-**(Pro UI)** "Original Finding" link has been added to Finding Metadata table for Duplicate Findings.
79
97
-**(Pro UI)** CI/CD Metadata has been added to Engagement view.
80
98
81
-
### June 2, 2025: v2.47.0
99
+
####June 2, 2025: v2.47.0
82
100
83
101
-**(Pro UI)** Finding review can now be set through the Pro UI. You can now Request Review or clear a Finding review from Finding tables, or from the Finding View.
Copy file name to clipboardExpand all lines: docs/content/en/working_with_findings/finding_deduplication/about_deduplication.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,6 +18,8 @@ By creating and marking Duplicates in this way, DefectDojo ensures that all the
18
18
19
19
By default, these Tests would need to be nested under the same Product for Deduplication to be applied. If you wish, you can further limit the Deduplication scope to a single Engagement.
20
20
21
+
22
+
21
23
Duplicate Findings are set as Inactive by default. This does not mean the Duplicate Finding itself is Inactive. Rather, this is so that your team only has a single active Finding to work on and remediate, with the implication being that once the original Finding is Mitigated, the Duplicates will also be Mitigated.
Copy file name to clipboardExpand all lines: docs/content/en/working_with_findings/findings_workflows/finding_status_definitions.md
+31-20Lines changed: 31 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,45 +8,62 @@ Each Finding created in DefectDojo has a Status which communicates relevant info
8
8
9
9
Each Finding status has a context\-specific meaning which will need to be defined by your own team. These are our suggestions, but your team's usage may vary.
10
10
11
-
## **Active****Findings**
11
+
Please note that Open/Closed are not **explicit** Status types for Findings. Certain aspects of the Classic UI (the "All Open Findings" table, for example) may refer to Open or Closed Findings: this is meant as a catchall for
12
+
13
+
* Active and/or Verified Findings, in the case of "Open Findings"
14
+
* Inactive and/or Risk Accepted, Under Review, Out Of Scope, False Positive Findings, in the case of "Closed Findings"
15
+
16
+
## **Open Finding Statuses**
17
+
18
+
Once a Finding is **Active**, it will be labeled as an **Open** Finding, regardless of whether or not it has been **Verified.**
19
+
20
+
Open Findings can be seen from the **Findings \> Open Findings** view of DefectDojo.
21
+
22
+
### **Active Findings**
12
23
13
24
‘This Finding has been discovered by a scanning tool.’
14
25
15
26
By default, any new Finding created in DefectDojo will be labeled as **Active**. Active in this case means ‘this is a new Finding that DefectDojo has not recorded on a past import’. If a Finding has been Mitigated in the past, but appears in a scan again in the future, the status of that Finding will reopen to reflect that the vulnerability has returned.
16
27
17
-
## **Verified Findings**
28
+
###**Verified Findings**
18
29
19
30
‘This Finding has been confirmed by our team to exist.’
20
31
21
32
Just because a tool records a problem does not necessarily mean the Finding requires engineering attention. Therefore, new Findings are also labeled as **Unverified** by default.
22
33
23
34
If you’re able to confirm that the Finding does exist, you can mark it as **Verified**.
24
35
25
-
If you don’t need to manually verify each Finding, you can automatically mark them as Verified during import, or disregard this Status.
36
+
Certain DefectDojo functions require Findings to be Active and Verified. If you don’t need to manually verify each Finding, you can deactivate the Verified requirement for any or all of these functions from the **System Settings** page (**Classic UI: Configuration > System Settings**, **Pro UI: Settings > Pro Settings > System Settings**).
26
37
27
-
## **Open Findings**
38
+
28
39
29
-
‘There is work to be done on these Findings.’
40
+
These Verified Statuses are required for
30
41
31
-
Once a Finding is **Active**, it will be labeled as an **Open** Finding, regardless of whether or not it has been **Verified.**
32
-
33
-
Open Findings can be seen from the **Findings \> Open Findings** view of DefectDojo.
42
+
* Pushing Jira Issues
43
+
* Applying Grading to Products
44
+
* Calculating Metrics
34
45
35
-
## **Closed Findings**
46
+
## **Closed Finding Statuses**
36
47
37
48
'The Vulnerability recorded here is no longer active’.
38
49
39
-
Once the work on a Finding is complete, you can manually Close it from the Close Findings option. Alternatively, if a scan is re\-imported into DefectDojo which does not contain a previously\-recorded Finding, the previously\-recorded Finding will automatically close.
50
+
Once the work on a Finding is complete, you can manually Close it from the Close Findings option. Alternatively, if a scan is re-imported into DefectDojo which does not contain a previously-recorded Finding, the previously-recorded Finding will automatically close.
40
51
41
-
## **Under Review**
52
+
## **Inactive**
53
+
54
+
‘This Finding was discovered previously but it was either mediated or does not require immediate attention.’
55
+
56
+
If a Finding is marked as Inactive, this means that the issue currently has no impact on the software environment and does not need to be addressed. This status does not necessarily mean that the issue has been resolved, as active Risk Acceptances also label Findings as Inactive.
57
+
58
+
### **Under Review**
42
59
43
60
‘I have sent this Finding to one or more team members to look at.’
44
61
45
62
When a Finding is Under Review, it needs to be reviewed by a team member. You can put a Finding under review by Selecting **Request Peer Review** from the Finding’s drop\-down menu.
46
63
47
64
48
65
49
-
## **Risk Accepted**
66
+
###**Risk Accepted**
50
67
51
68
‘Our team has evaluated the risk associated with this Finding, and we’ve agreed that we can safely delay fixing it.’
52
69
@@ -56,24 +73,18 @@ Risk Acceptances have expiry dates, at which time you can reevaluate the impact
56
73
57
74
For more information on Risk Acceptances, see our [Guide](../risk_acceptances).
58
75
59
-
## **Out Of Scope**
76
+
###**Out Of Scope**
60
77
61
78
‘This Finding was discovered by our scanning tool, but detecting this kind of vulnerability was not the direct goal of our test.’
62
79
63
80
When you mark a Finding as Out Of Scope, you are indicating that it is not directly relevant to the Engagement or Test it is contained within.
64
81
65
82
If you have a testing and remediation effort related to a specific aspect of your software, you can use this Status to indicate that this Finding is not part of your effort.
66
83
67
-
## **False Positive**
84
+
###**False Positive**
68
85
69
86
‘This Finding was discovered by our scanning tool, but after reviewing the Finding we have discovered that this reported vulnerability does not exist.’
70
87
71
88
Once you’ve reviewed a Finding, you might discover that the vulnerability reported does not actually exist. The False Positive status will be maintained by reimport and prevent matching findings from being opened or closed, which assists with noise reduction.
72
89
73
90
If a different scanning tool finds a similar Finding, it will not be recorded as a False Positive. DefectDojo can only compare Findings within the same tool to determine if a Finding has already been recorded.
74
-
75
-
## **Inactive**
76
-
77
-
‘This Finding was discovered previously but it was either mediated or does not require immediate attention.’
78
-
79
-
If a Finding is marked as Inactive, this means that the issue currently has no impact on the software environment and does not need to be addressed. This status does not necessarily mean that the issue has been resolved.
0 commit comments