diff --git a/dev/404.html b/dev/404.html index dbe094e9237..a933a4f7462 100644 --- a/dev/404.html +++ b/dev/404.html @@ -1 +1 @@ -404 Page not found | Documentation

Not found

Oops! This page doesn't exist. Try going back to our home page.

\ No newline at end of file +404 Page not found | Documentation

Not found

Oops! This page doesn't exist. Try going back to our home page.

\ No newline at end of file diff --git a/dev/contributing/branching-model/index.html b/dev/contributing/branching-model/index.html index 62f40a99756..a3958d729cb 100644 --- a/dev/contributing/branching-model/index.html +++ b/dev/contributing/branching-model/index.html @@ -1,4 +1,4 @@ -Branching model | Documentation
+Branching model | Documentation
Edit this page Create child page Create documentation issue

Branching model

How we create releases

Regular releases

The DefectDojo team aims to maintain the following cadence:

  • Minor releases: at least once a month on the first Monday of the month.
  • Patch/Bugfix: releases every week on Monday.
  • Security releases: will be performed outside of our regular cadence depending on severity.

GitHub Actions are the source of truth. The releases are semi-automated. The steps for a regular release are:

  1. Create the release branch from dev or bugfix and prepare a PR against master (details) diff --git a/dev/contributing/documentation/index.html b/dev/contributing/documentation/index.html index f77f41eda73..a36a90ed3df 100644 --- a/dev/contributing/documentation/index.html +++ b/dev/contributing/documentation/index.html @@ -1,4 +1,4 @@ -Documentation | Documentation
    +Documentation | Documentation
    Edit this page Create child page Create documentation issue

    Documentation

    How to amend the documentation

    The documentation is built with Hugo and uses the theme Docsy. diff --git a/dev/contributing/how-to-write-a-parser/index.html b/dev/contributing/how-to-write-a-parser/index.html index 130956acba4..9d3e582bea9 100644 --- a/dev/contributing/how-to-write-a-parser/index.html +++ b/dev/contributing/how-to-write-a-parser/index.html @@ -1,4 +1,4 @@ -Parsers | Documentation

    +Parsers | Documentation
    Edit this page Create child page Create documentation issue

    Parsers

    How to contribute to parsers

    Pre-requisites

    • You have forked https://github.com/DefectDojo/django-DefectDojo and cloned locally.
    • Checkout dev and make sure you’re up to date with the latest changes.
    • It’s advised that you create a dedicated branch for your development, such as git checkout -b parser-name.

    It is easiest to use the docker-compose deployment as it has hot-reload capbility for uWSGI. diff --git a/dev/contributing/index.html b/dev/contributing/index.html index 6665e684cb0..25ab5d9daa2 100644 --- a/dev/contributing/index.html +++ b/dev/contributing/index.html @@ -1,4 +1,4 @@ -Contributing | Documentation

    +Contributing | Documentation
    Edit this page Create child page Create documentation issue

    Contributing

    How you can help to make DefectDojo even better

    You can find further information in the contributing guidelines.

    Parsers

    How to contribute to parsers

    Documentation

    How to amend the documentation

    Branching model

    How we create releases

    Last modified September 21, 2021: WIP - readme cleanup (#5130) (1bd3606df)
    \ No newline at end of file diff --git a/dev/getting_started/architecture/index.html b/dev/getting_started/architecture/index.html index 617b51b7693..e35719a5e8e 100644 --- a/dev/getting_started/architecture/index.html +++ b/dev/getting_started/architecture/index.html @@ -1,4 +1,4 @@ -Architecture | Documentation
    +Architecture | Documentation
    Edit this page Create child page Create documentation issue

    Architecture

    The DefectDojo platform consists of several components that work together closely.

    Architecture

    NGINX

    The webserver NGINX delivers all static content, e.g. diff --git a/dev/getting_started/configuration/index.html b/dev/getting_started/configuration/index.html index 9e355955aec..76378d8e607 100644 --- a/dev/getting_started/configuration/index.html +++ b/dev/getting_started/configuration/index.html @@ -1,4 +1,4 @@ -Configuration | Documentation

    +Configuration | Documentation
    Edit this page Create child page Create documentation issue

    Configuration

    DefectDojo is highly configurable.

    dojo/settings/settings.dist.py

    The main settings are stored in dojo/settings/settings.dist.py. It is great to use this file as a reference for what can be configured, but it shouldn't be edited directly, because changes will be overwritten when updating DefectDojo. There are several methods to change the default settings:

    Environment variables

    Most parameters can be set by environment variables.

    When you deploy DefectDojo via Docker Compose, you can set environment variables in docker-compose.yml. Be aware you have to set the variables for three services: uwsgi, celerybeat and celeryworker.

    When you deploy DefectDojo in a Kubernetes cluster, you can set environment variables as extraConfigs and extraSecrets in helm/defectdojo/values.yaml.

    Environment file (not with Docker Compose or Kubernetes)

    settings.dist.py reads environment variables from a file whose name is specified in the environment variable DD_ENV_PATH. If this variable is not set, the default .env.prod is used. The file must be located in the dojo/settings directory.

    An example can be found in template_env.

    local_settings.py (not with Kubernetes)

    local_settings.py can contain more complex customizations such as adding MIDDLEWARE or INSTALLED_APP entries. diff --git a/dev/getting_started/demo/index.html b/dev/getting_started/demo/index.html index 7b0c9ed6033..f2db5bda6b4 100644 --- a/dev/getting_started/demo/index.html +++ b/dev/getting_started/demo/index.html @@ -1,4 +1,4 @@ -Demo | Documentation

    +Demo | Documentation
    Edit this page Create child page Create documentation issue

    Demo

    There is DefectDojo demo site running the latest officially released version

    Demo

    Try out the demo sever at demo.defectdojo.org

    Log in with admin / 1Defectdojo@demo#appsec. Please note that the demo is publicly accessable and regularly reset. Do not put sensitive data in the demo.

    Last modified March 17, 2023: Docs update master (#7837) (33370295f)
    \ No newline at end of file diff --git a/dev/getting_started/index.html b/dev/getting_started/index.html index dea0a3b19c9..89fcefa59a2 100644 --- a/dev/getting_started/index.html +++ b/dev/getting_started/index.html @@ -1,4 +1,4 @@ -Getting started | Documentation
    +Getting started | Documentation
    Edit this page Create child page -Create documentation issue

    Getting started

    How to install and configure DefectDojo
    Architecture

    The DefectDojo platform consists of several components that work together closely.

    Installation

    DefectDojo supports various installation options.

    Configuration

    DefectDojo is highly configurable.

    Running in production

    For use in Produciton environments, performance tweaks and backups are recommended.

    Upgrading

    Release specific upgrading instructions

    Demo

    There is DefectDojo demo site running the latest officially released version

    Last modified May 7, 2021: Documentation Update (#4468) (5488c9325)
    \ No newline at end of file +Create documentation issue

    Getting started

    How to install and configure DefectDojo
    Architecture

    The DefectDojo platform consists of several components that work together closely.

    Installation

    DefectDojo supports various installation options.

    Configuration

    DefectDojo is highly configurable.

    Running in production

    For use in Production environments, performance tweaks and backups are recommended.

    Upgrading

    Release specific upgrading instructions

    Demo

    There is DefectDojo demo site running the latest officially released version

    Last modified May 7, 2021: Documentation Update (#4468) (5488c9325)
    \ No newline at end of file diff --git a/dev/getting_started/installation/index.html b/dev/getting_started/installation/index.html index 130a6cde40f..3311f209faa 100644 --- a/dev/getting_started/installation/index.html +++ b/dev/getting_started/installation/index.html @@ -1,4 +1,4 @@ -Installation | Documentation
    +Installation | Documentation
    Edit this page Create child page Create documentation issue

    Installation

    DefectDojo supports various installation options.

    Docker Compose

    See instructions in DOCKER.md

    SaaS (Includes Support & Supports the Project)

    SaaS link

    AWS AMI (Supports the Project)

    Marketplace link, and complete walkthrough

    Options for the brave (not officially supported)

    Kubernetes

    See instructions in KUBERNETES.md

    Local install with godojo

    See instructions in README.md diff --git a/dev/getting_started/running-in-production/index.html b/dev/getting_started/running-in-production/index.html index e0e6945221f..c0b716a1aaf 100644 --- a/dev/getting_started/running-in-production/index.html +++ b/dev/getting_started/running-in-production/index.html @@ -1,7 +1,7 @@ -Running in production | Documentation

    +Running in production | Documentation
    Edit this page Create child page -Create documentation issue

    Running in production

    For use in Produciton environments, performance tweaks and backups are recommended.

    Production use with docker-compose

    The docker-compose.yml file in this repository is fully functional to evaluate DefectDojo in your local environment.

    Although Docker Compose is one of the supported installation methods to deploy a containerized DefectDojo in a production environment, the docker-compose.yml file is not intended for production use without first customizing it to your particular situation.

    See Running with Docker Compose for more information how to run DefectDojo with Docker Compose.

    Database performance and backup

    It is recommended to use a dedicated database server and not the preconfigured PostgreSQL database. This will improve the performance of DefectDojo.

    In both cases (dedicated DB or containerized), if you are self-hosting, it is recommended that you implement and create periodic backups of your data.

    Backup of Media files

    Media files for uploaded files, including threat models and risk acceptance, are stored in a docker volume. This volume needs to be backed up regularly.

    Instance size

    With a separate database, the minimum recommendations +Create documentation issue

    Running in production

    For use in Production environments, performance tweaks and backups are recommended.

    Production use with docker-compose

    The docker-compose.yml file in this repository is fully functional to evaluate DefectDojo in your local environment.

    Although Docker Compose is one of the supported installation methods to deploy a containerized DefectDojo in a production environment, the docker-compose.yml file is not intended for production use without first customizing it to your particular situation.

    See Running with Docker Compose for more information how to run DefectDojo with Docker Compose.

    Database performance and backup

    It is recommended to use a dedicated database server and not the preconfigured PostgreSQL database. This will improve the performance of DefectDojo.

    In both cases (dedicated DB or containerized), if you are self-hosting, it is recommended that you implement and create periodic backups of your data.

    Backup of Media files

    Media files for uploaded files, including threat models and risk acceptance, are stored in a docker volume. This volume needs to be backed up regularly.

    Instance size

    With a separate database, the minimum recommendations are:

    • 2 vCPUs
    • 8 GB of RAM
    • 10 GB of disk space (remember, your database is not here -- so what you have for your O/S should do). You could allocate a different disk than your OS's for potential performance @@ -13,8 +13,8 @@ (default solo)

    When you enable prefork, the variables below have to be used. see the Dockerfile.django-* for in-file references.

    • DD_CELERY_WORKER_AUTOSCALE_MIN defaults to 2.
    • DD_CELERY_WORKER_AUTOSCALE_MAX defaults to 8.
    • DD_CELERY_WORKER_CONCURRENCY defaults to 8.
    • DD_CELERY_WORKER_PREFETCH_MULTIPLIER defaults to 128.

    You can execute the following command to see the configuration:

    docker-compose exec celerybeat bash -c "celery -A dojo inspect stats" -and see what is in effect.

    Asynchronous Imports

    Import and Re-Import can also be configured to handle uploads asynchronously to aid in +and see what is in effect.

    Asynchronous Import

    Please note: Asynchronous Import is currently an experimental feature. Please exercise caution with this method as results may be inconsistent.

    Import and Re-Import can also be configured to handle uploads asynchronously to aid in processing especially large scans. It works by batching Findings and Endpoints by a configurable amount. Each batch will be be processed in separate celery tasks.

    The following variables impact async imports.

    • DD_ASYNC_FINDING_IMPORT defaults to False
    • DD_ASYNC_FINDING_IMPORT_CHUNK_SIZE defaults to 100

    When using asynchronous imports with dynamic scanners, Endpoints will continue to “trickle” in even after the import has returned a successful response. This is because processing continues -to occur after the Findings have already been imported.

    To determine if an import has been fully completed, please see the progress bar in the appropriate test.

    Last modified May 19, 2023: Make PostgreSQL database the default for containerized deploys (#8119) (300128b76)
    \ No newline at end of file +to occur after the Findings have already been imported.

    To determine if an import has been fully completed, please see the progress bar in the appropriate test.

    Last modified September 28, 2023: [documentation] mark async-imports as experimental (#8710) (2e176549d)
    \ No newline at end of file diff --git a/dev/getting_started/upgrading/index.html b/dev/getting_started/upgrading/index.html index 19ebbb52621..48fac4276db 100644 --- a/dev/getting_started/upgrading/index.html +++ b/dev/getting_started/upgrading/index.html @@ -1,4 +1,4 @@ -Upgrading | Documentation
    +Upgrading | Documentation
    Edit this page Create child page Create documentation issue

    Upgrading

    Release specific upgrading instructions

    Docker-compose

    When you deploy a vanilla docker-compose, it will create a persistent diff --git a/dev/index.html b/dev/index.html index 9669783d81d..1bbd310eeb8 100644 --- a/dev/index.html +++ b/dev/index.html @@ -1,4 +1,4 @@ -Documentation

    +Documentation
    Edit this page Create child page Create documentation issue

    DefectDojo's Documentation

    image

    About DefectDojo

    What is DefectDojo?

    DefectDojo is a DevSecOps platform. DefectDojo streamlines DevSecOps by serving as an aggregator and single pane of glass for your security tools. DefectDojo has smart features to enhance and tune the results from your security tools including the ability to merge findings, remember false positives, and distill duplicates. DefectDojo also integrates with JIRA, provides metrics / reports, and can also be used for traditional pen test management.

    What does DefectDojo do?

    While automation and efficiency are the ultimate end goals, DefectDojo is diff --git a/dev/integrations/api-v2-docs/index.html b/dev/integrations/api-v2-docs/index.html index a4189352bc3..ee28aec3885 100644 --- a/dev/integrations/api-v2-docs/index.html +++ b/dev/integrations/api-v2-docs/index.html @@ -1,4 +1,4 @@ -DefectDojo API v2 | Documentation

    +DefectDojo API v2 | Documentation
    Edit this page Create child page Create documentation issue

    DefectDojo API v2

    DefectDojo’s API lets you automate tasks, e.g. uploading scan reports in CI/CD pipelines.

    DefectDojo's API is created using Django Rest diff --git a/dev/integrations/burp-plugin/index.html b/dev/integrations/burp-plugin/index.html index 0f9ea9a692f..79fc49c1319 100644 --- a/dev/integrations/burp-plugin/index.html +++ b/dev/integrations/burp-plugin/index.html @@ -1,4 +1,4 @@ -Defect Dojo Burp plugin | Documentation

    +Defect Dojo Burp plugin | Documentation
    Edit this page Create child page Create documentation issue

    Defect Dojo Burp plugin

    Export findings directly from Burp to DefectDojo.

    This is Burp Plugin to export findings directly to DefectDojo.

    Installation

    In order for the plugin to work , you will need to have Jython set up in diff --git a/dev/integrations/exporting/index.html b/dev/integrations/exporting/index.html index 7e8d80b432a..a6e1afe7bbb 100644 --- a/dev/integrations/exporting/index.html +++ b/dev/integrations/exporting/index.html @@ -1,4 +1,4 @@ -Exporting | Documentation

    +Exporting | Documentation
    Edit this page Create child page Create documentation issue

    Exporting

    DefectDojo has the ability to export findings.

    Export Findings

    Pages that show a list of findings or a list of engagements have a CSV and Excel Export functionality in the top right dropdown menu.

    Export findings

    The list of engagements can be exported as CSV/Excel.

    Export engagements

    Last modified December 7, 2021: Revert "Release: Merge release into master from: release/2.5.0 (#5564)" (#5567) (bb083584b)
    \ No newline at end of file diff --git a/dev/integrations/google-sheets-sync/index.html b/dev/integrations/google-sheets-sync/index.html index 77f34f06345..20a1547dc3f 100644 --- a/dev/integrations/google-sheets-sync/index.html +++ b/dev/integrations/google-sheets-sync/index.html @@ -1,4 +1,4 @@ -Google Sheets synchronisation | Documentation
    +Google Sheets synchronisation | Documentation
    Edit this page Create child page Create documentation issue

    Google Sheets synchronisation

    Export finding details to Google Sheets and upload changes from Google Sheets.

    With the Google Sheets sync feature, DefectDojo allow the users to diff --git a/dev/integrations/importing/index.html b/dev/integrations/importing/index.html index 924ad750724..3aabb29a244 100644 --- a/dev/integrations/importing/index.html +++ b/dev/integrations/importing/index.html @@ -1,4 +1,4 @@ -Importing | Documentation

    +Importing | Documentation
    Edit this page Create child page Create documentation issue

    Importing

    How DefectDojo imports and reimports security tool reports.

    Import

    The importers analyze each report and create new Findings for each item diff --git a/dev/integrations/index.html b/dev/integrations/index.html index 9c85cec5549..5f3b4d4804b 100644 --- a/dev/integrations/index.html +++ b/dev/integrations/index.html @@ -1,4 +1,4 @@ -Integrations | Documentation

    +Integrations | Documentation
    Edit this page Create child page Create documentation issue

    Integrations

    A lot of integrations help to fit DefectDojo in your environment
    Importing

    How DefectDojo imports and reimports security tool reports.

    Supported reports

    DefectDojo has the ability to import scan reports from a large number of security tools.

    DefectDojo API v2

    DefectDojo’s API lets you automate tasks, e.g. uploading scan reports in CI/CD pipelines.

    Authentication via OAuth2/SAML2

    OAuth2/SAML2 let users authenticate against enterprise directories.

    Authentication via LDAP

    Authenticate users using LDAP

    JIRA integration

    Bidirectional integration of DefectDojo findings with Jira issues.

    Source code repositories

    Integration of repositories to navigate to the locaction of findings in the source code.

    Notifications

    DefectDojo can inform you about changes on different channels.

    Google Sheets synchronisation

    Export finding details to Google Sheets and upload changes from Google Sheets.

    Defect Dojo Burp plugin

    Export findings directly from Burp to DefectDojo.

    Languages and lines of code

    You can import an analysis of languages used in a project, including lines of code.

    Rate Limiting

    Configurable rate limiting on the login page to mitigate brute force attacks

    Exporting

    DefectDojo has the ability to export findings.

    Last modified May 7, 2021: Documentation Update (#4468) (5488c9325)
    \ No newline at end of file diff --git a/dev/integrations/jira/index.html b/dev/integrations/jira/index.html index efd70459dda..0ab0dd919d7 100644 --- a/dev/integrations/jira/index.html +++ b/dev/integrations/jira/index.html @@ -1,4 +1,4 @@ -JIRA integration | Documentation
    +JIRA integration | Documentation
    Edit this page Create child page Create documentation issue

    JIRA integration

    Bidirectional integration of DefectDojo findings with Jira issues.

    DefectDojo's JIRA integration is bidirectional. You may push findings diff --git a/dev/integrations/languages/index.html b/dev/integrations/languages/index.html index 56156626665..34e380760c1 100644 --- a/dev/integrations/languages/index.html +++ b/dev/integrations/languages/index.html @@ -1,4 +1,4 @@ -Languages and lines of code | Documentation

    +Languages and lines of code | Documentation
    Edit this page Create child page Create documentation issue

    Languages and lines of code

    You can import an analysis of languages used in a project, including lines of code.

    Import of languages for a project

    You can import JSON reports generated by the cloc tool via the API:

    Import of cloc JSON file

    When importing a file, all language information for the respective project will be deleted first and then populated with the content of the file. diff --git a/dev/integrations/ldap-authentication/index.html b/dev/integrations/ldap-authentication/index.html index 0a854397109..70133560673 100644 --- a/dev/integrations/ldap-authentication/index.html +++ b/dev/integrations/ldap-authentication/index.html @@ -1,4 +1,4 @@ -Authentication via LDAP | Documentation

    +Authentication via LDAP | Documentation
    Edit this page Create child page Create documentation issue

    Authentication via LDAP

    Authenticate users using LDAP

    LDAP Authentication

    Out of the box Defect Dojo does not support LDAP authentication.

    However, since Defect Dojo is built using Django, it isn’t too difficult to add support for LDAP. diff --git a/dev/integrations/notifications/index.html b/dev/integrations/notifications/index.html index 956ce5411fc..c049c8e7d88 100644 --- a/dev/integrations/notifications/index.html +++ b/dev/integrations/notifications/index.html @@ -1,4 +1,4 @@ -Notifications | Documentation

    +Notifications | Documentation
    Edit this page Create child page Create documentation issue

    Notifications

    DefectDojo can inform you about changes on different channels.

    Notifications

    Notification settings

    DefectDojo can inform you of different events in a variety of ways. You diff --git a/dev/integrations/parsers/api/blackduck/index.html b/dev/integrations/parsers/api/blackduck/index.html index 151713fb743..1622045bd15 100644 --- a/dev/integrations/parsers/api/blackduck/index.html +++ b/dev/integrations/parsers/api/blackduck/index.html @@ -4,7 +4,7 @@ In Tool Configuration, select Tool Type to “BlackDuck API” and Authentication Type “API Key”. Paste your BlackDuck API token in the API Key field. In Add API Scan Configuration provide the ID of the project from which to import findings in the field Service key 1. Provide the version of the project from which to import findings in the field Service key 2.">

    +In Add API Scan Configuration provide the ID of the project from which to import findings in the field Service key 1. Provide the version of the project from which to import findings in the field Service key 2.">
    Edit this page Create child page Create documentation issue

    Blackduck API

    All parsers which using API have common basic configuration step but with different values. Please, read these steps at first.

    In Tool Configuration, select Tool Type to “BlackDuck API” and Authentication Type “API Key”. diff --git a/dev/integrations/parsers/api/bugcrowd/index.html b/dev/integrations/parsers/api/bugcrowd/index.html index 13637a93422..2480ea4d34a 100644 --- a/dev/integrations/parsers/api/bugcrowd/index.html +++ b/dev/integrations/parsers/api/bugcrowd/index.html @@ -4,7 +4,7 @@ In Tool Configuration, select Tool Type to “Bugcrowd API” and Authentication Type “API Key”. Paste your BlackDuck API token in the API Key field. Set your API key directly in the format username:password in the API Token input, it will be added to the header 'Authorization': 'Token {}'.format(self.api_token), For each product, you can configure 2 things:">

    +For each product, you can configure 2 things:">
    Edit this page Create child page Create documentation issue

    Bugcrowd API

    All parsers which using API have common basic configuration step but with different values. Please, read these steps at first.

    In Tool Configuration, select Tool Type to “Bugcrowd API” and Authentication Type “API Key”. diff --git a/dev/integrations/parsers/api/cobalt/index.html b/dev/integrations/parsers/api/cobalt/index.html index daf2c52a851..8bbedd05d5a 100644 --- a/dev/integrations/parsers/api/cobalt/index.html +++ b/dev/integrations/parsers/api/cobalt/index.html @@ -4,7 +4,7 @@ In Tool Configuration, select Tool Type to “Cobalt.io” and Authentication Type “API Key”. Paste your Cobalt.io API token in the API Key field and the desired org token in the Extras field. In Add API Scan Configuration provide the ID of the asset from which to import findings in the field Service key 1.">

    +In Add API Scan Configuration provide the ID of the asset from which to import findings in the field Service key 1.">
    Edit this page Create child page Create documentation issue

    Cobalt.io API Import

    All parsers which using API have common basic configuration step but with different values. Please, read these steps at first.

    In Tool Configuration, select Tool Type to “Cobalt.io” and Authentication Type “API Key”. diff --git a/dev/integrations/parsers/api/edgescan/index.html b/dev/integrations/parsers/api/edgescan/index.html index 4098d49174e..6ea75b882c1 100644 --- a/dev/integrations/parsers/api/edgescan/index.html +++ b/dev/integrations/parsers/api/edgescan/index.html @@ -7,7 +7,7 @@ In Add API Scan Configuration and select the previously added Edgescan Tool Configuration. Provide the edgescan asset ID(s) that you wish to import the findings for in the field Service key 1.">

    +In Add API Scan Configuration and select the previously added Edgescan Tool Configuration. Provide the edgescan asset ID(s) that you wish to import the findings for in the field Service key 1.">
    Edit this page Create child page Create documentation issue

    Edgescan

    Import Edgescan vulnerabilities by API or JSON file

    All parsers which using API have common basic configuration step but with different values. Please, read these steps at first.

    In Tool Configuration, select Tool Type to “Edgescan” and Authentication Type “API Key”. diff --git a/dev/integrations/parsers/api/index.html b/dev/integrations/parsers/api/index.html index a0d8df49f69..9f3a5a4b267 100644 --- a/dev/integrations/parsers/api/index.html +++ b/dev/integrations/parsers/api/index.html @@ -1,4 +1,4 @@ -API Pull | Documentation

    +API Pull | Documentation
    Edit this page Create child page Create documentation issue

    API Pull

    Report pulled to DefectDojo via API exposed by scanning service

    All parsers that use API pull have common basic configuration steps, but with different values.

    Follow these steps to set up API importing:

    1. Configure the API authentication details by navigating to diff --git a/dev/integrations/parsers/api/sonarqube/index.html b/dev/integrations/parsers/api/sonarqube/index.html index 3d8386d6bd1..ee12616d875 100644 --- a/dev/integrations/parsers/api/sonarqube/index.html +++ b/dev/integrations/parsers/api/sonarqube/index.html @@ -1,7 +1,7 @@ SonarQube API Import | Documentation

      +In Tool Configuration, select Tool Type to “SonarQube” and Authentication Type “API Key”. Note the url must be in the format of https:///api Paste your SonarQube API token in the “API Key” field. By default the tool will import vulnerabilities issues and security hotspots only, but additional filters can be setup using the Extras field separated by commas (e.">
      Edit this page Create child page Create documentation issue

      SonarQube API Import

      All parsers which using API have common basic configuration step but with different values. Please, read these steps at first.

      In Tool Configuration, select Tool Type to “SonarQube” and Authentication Type “API Key”. diff --git a/dev/integrations/parsers/api/vulners/index.html b/dev/integrations/parsers/api/vulners/index.html index da48805723a..dc1a36e03aa 100644 --- a/dev/integrations/parsers/api/vulners/index.html +++ b/dev/integrations/parsers/api/vulners/index.html @@ -10,7 +10,7 @@ Import Vulners Audit results, no file required. In Tool Configuration, select Tool Type to “Vulners” and add the API Key In the Product settings select Add API Scan Configuration and select the previously added Vulners API Tool Configuration. -After this is done, you can import the findings by selecting “Vulners” as the scan type.">

      +After this is done, you can import the findings by selecting “Vulners” as the scan type.">
      Edit this page Create child page Create documentation issue

      Vulners

      All parsers which using API have common basic configuration step but with different values. Please, read these steps at first.

      Import Vulners Audit results, no file required.

      In Tool Configuration, select Tool Type to “Vulners” and add the API Key

      In the Product settings select Add API Scan Configuration and select the previously added Vulners API Tool Configuration.

      After this is done, you can import the findings by selecting “Vulners” as the scan type.

      Detailed installation steps can be found in vulners documentation.

      Use following instructions to generate Vulners API Key.

      More details about DefectDojo-plugin integration can be found at vulners integrations page.

      Last modified January 16, 2023: Doc: Split doc to files + unittest for missing unittest and doc (#7418) (392bf7099)
      \ No newline at end of file diff --git a/dev/integrations/parsers/file/acunetix/index.html b/dev/integrations/parsers/file/acunetix/index.html index 4688fba950b..4b9b1a7a6f3 100644 --- a/dev/integrations/parsers/file/acunetix/index.html +++ b/dev/integrations/parsers/file/acunetix/index.html @@ -1,4 +1,4 @@ -Acunetix Scanner | Documentation
      +Acunetix Scanner | Documentation
      Edit this page Create child page Create documentation issue

      Acunetix Scanner

      XML format

      Last modified January 16, 2023: Doc: Split doc to files + unittest for missing unittest and doc (#7418) (392bf7099)
      \ No newline at end of file diff --git a/dev/integrations/parsers/file/acunetix360/index.html b/dev/integrations/parsers/file/acunetix360/index.html index 6860ad8b980..0288db5414a 100644 --- a/dev/integrations/parsers/file/acunetix360/index.html +++ b/dev/integrations/parsers/file/acunetix360/index.html @@ -1,4 +1,4 @@ -Acunetix 360 Scanner | Documentation
      +Acunetix 360 Scanner | Documentation
      Edit this page Create child page Create documentation issue

      Acunetix 360 Scanner

      Vulnerabilities List - JSON report

      Last modified January 16, 2023: Doc: Split doc to files + unittest for missing unittest and doc (#7418) (392bf7099)
      \ No newline at end of file diff --git a/dev/integrations/parsers/file/anchore_engine/index.html b/dev/integrations/parsers/file/anchore_engine/index.html index 1bfb8835359..ff4478b36e0 100644 --- a/dev/integrations/parsers/file/anchore_engine/index.html +++ b/dev/integrations/parsers/file/anchore_engine/index.html @@ -7,7 +7,7 @@ { "imageDigest": "sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "vulnerabilities": [ { "feed": "example-feed", "feed_group": "example-feed-group", "fix": "1.">
      +{ "imageDigest": "sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "vulnerabilities": [ { "feed": "example-feed", "feed_group": "example-feed-group", "fix": "1.">
      Edit this page Create child page Create documentation issue

      Anchore-Engine

      File Types

      DefectDojo parser accepts a .json file.

      Using the Anchore CLI is the most reliable way to generate an Anchore report which DefectDojo can parse. When generating a report with the Anchore CLI, please use the following command to ensure complete data: anchore-cli --json image vuln <image:tag> all

      Acceptable JSON Format

      All properties are strings and are required by the parser.

      
diff --git a/dev/integrations/parsers/file/anchore_enterprise/index.html b/dev/integrations/parsers/file/anchore_enterprise/index.html
index ca80fa74177..c29e85f30fd 100644
--- a/dev/integrations/parsers/file/anchore_enterprise/index.html
+++ b/dev/integrations/parsers/file/anchore_enterprise/index.html
@@ -1,4 +1,4 @@
-Anchore Enterprise Policy Check | Documentation
      
+Anchore Enterprise Policy Check | Documentation
      
 
      Edit this page
 Create child page
 Create documentation issue
      Anchore Enterprise Policy Check
      Anchore-CLI JSON policy check report format.
      Last modified January 16, 2023: Doc: Split doc to files + unittest for missing unittest and doc (#7418) (392bf7099)
      
\ No newline at end of file
diff --git a/dev/integrations/parsers/file/anchore_grype/index.html b/dev/integrations/parsers/file/anchore_grype/index.html
index 44aa58ff26d..e9a4d077f30 100644
--- a/dev/integrations/parsers/file/anchore_grype/index.html
+++ b/dev/integrations/parsers/file/anchore_grype/index.html
@@ -1,7 +1,7 @@
 Anchore Grype | Documentation
      
+grype defectdojo/defectdojo-django:1.13.1 -o json > many_vulns.json ">
      
 
      Edit this page
 Create child page
 Create documentation issue
      Anchore Grype
      Anchore Grype JSON report format generated with -o json option.
      grype defectdojo/defectdojo-django:1.13.1 -o json > many_vulns.json
      Last modified January 16, 2023: Doc: Split doc to files + unittest for missing unittest and doc (#7418) (392bf7099)
      
\ No newline at end of file
diff --git a/dev/integrations/parsers/file/anchorectl_policies/index.html b/dev/integrations/parsers/file/anchorectl_policies/index.html
index 35953c7173b..d4ac67e8daf 100644
--- a/dev/integrations/parsers/file/anchorectl_policies/index.html
+++ b/dev/integrations/parsers/file/anchorectl_policies/index.html
@@ -1,4 +1,4 @@
-AnchoreCTL Policies Report | Documentation
      
+AnchoreCTL Policies Report | Documentation
      
 
      Edit this page
 Create child page
 Create documentation issue
      AnchoreCTL Policies Report
      AnchoreCTLs JSON policies report format
      Last modified January 16, 2023: Doc: Split doc to files + unittest for missing unittest and doc (#7418) (392bf7099)
      
\ No newline at end of file
diff --git a/dev/integrations/parsers/file/anchorectl_vulns/index.html b/dev/integrations/parsers/file/anchorectl_vulns/index.html
index f692da29ccb..743fb36ba5c 100644
--- a/dev/integrations/parsers/file/anchorectl_vulns/index.html
+++ b/dev/integrations/parsers/file/anchorectl_vulns/index.html
@@ -1,4 +1,4 @@
-AnchoreCTL Vuln Report | Documentation
      
+AnchoreCTL Vuln Report | Documentation
      
 
      Edit this page
 Create child page
 Create documentation issue
      AnchoreCTL Vuln Report
      AnchoreCTLs JSON vulnerability report format
      Last modified January 16, 2023: Doc: Split doc to files + unittest for missing unittest and doc (#7418) (392bf7099)
      
\ No newline at end of file
diff --git a/dev/integrations/parsers/file/appspider/index.html b/dev/integrations/parsers/file/appspider/index.html
index 573c195a816..6b772ad3df7 100644
--- a/dev/integrations/parsers/file/appspider/index.html
+++ b/dev/integrations/parsers/file/appspider/index.html
@@ -1,4 +1,4 @@
-AppSpider (Rapid7) | Documentation
      
+AppSpider (Rapid7) | Documentation
      
 
      Edit this page
 Create child page
 Create documentation issue
      AppSpider (Rapid7)
      Use the VulnerabilitiesSummary.xml file found in the zipped report
diff --git a/dev/integrations/parsers/file/aqua/index.html b/dev/integrations/parsers/file/aqua/index.html
index e5bfbc8f5ec..9d7475abc83 100644
--- a/dev/integrations/parsers/file/aqua/index.html
+++ b/dev/integrations/parsers/file/aqua/index.html
@@ -1,4 +1,4 @@
-Aqua | Documentation
      
+Aqua | Documentation
      
 
      Edit this page
 Create child page
 Create documentation issue
      Aqua
      JSON report format.
      Last modified January 16, 2023: Doc: Split doc to files + unittest for missing unittest and doc (#7418) (392bf7099)
      
\ No newline at end of file
diff --git a/dev/integrations/parsers/file/arachni/index.html b/dev/integrations/parsers/file/arachni/index.html
index 4afb7887f0b..c41ec92f04e 100644
--- a/dev/integrations/parsers/file/arachni/index.html
+++ b/dev/integrations/parsers/file/arachni/index.html
@@ -4,7 +4,7 @@
 Reports are generated with arachni_reporter tool this way:
 arachni_reporter --reporter 'json' js.com.afr ">
      
+arachni_reporter --reporter 'json' js.com.afr ">
      
 
      Edit this page
 Create child page
 Create documentation issue
      Arachni Scanner
      Arachni Web Scanner (https://www.arachni-scanner.com)
      Reports are generated with arachni_reporter tool this way:
      arachni_reporter --reporter 'json' js.com.afr
      Last modified January 16, 2023: Doc: Split doc to files + unittest for missing unittest and doc (#7418) (392bf7099)
      
\ No newline at end of file
diff --git a/dev/integrations/parsers/file/asff/index.html b/dev/integrations/parsers/file/asff/index.html
index 15fb36fc472..d18a40705c4 100644
--- a/dev/integrations/parsers/file/asff/index.html
+++ b/dev/integrations/parsers/file/asff/index.html
@@ -4,7 +4,7 @@
 Reference: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html
 Prowler tool can generate this format with option -M json-asff.">
      
+Prowler tool can generate this format with option -M json-asff.">
      
 
      Edit this page
 Create child page
 Create documentation issue
      AWS Security Finding Format (ASFF)
      AWS Security Hub consumes, aggregates, organizes, and prioritizes findings from AWS security services and from the third-party product integrations. Security Hub processes these findings using a standard findings format called the AWS Security Finding Format (ASFF), which eliminates the need for time-consuming data conversion efforts. Then it correlates ingested findings across products to prioritize the most important ones.
      Reference: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html
      Prowler tool can generate this format with option -M json-asff.
      Last modified April 3, 2023: Add parser for AWS Security Finding Format (ASFF) (#7838) (467f66b1d)
      
\ No newline at end of file
diff --git a/dev/integrations/parsers/file/auditjs/index.html b/dev/integrations/parsers/file/auditjs/index.html
index 1324c1311a1..262723e7884 100644
--- a/dev/integrations/parsers/file/auditjs/index.html
+++ b/dev/integrations/parsers/file/auditjs/index.html
@@ -1,7 +1,7 @@
 AuditJS (OSSIndex) | Documentation
      
+auditjs ossi --json > auditjs_report.json ">
      
 
      Edit this page
 Create child page
 Create documentation issue
      AuditJS (OSSIndex)
      AuditJS scanning tool using OSSIndex database and generated with --json or -j option (https://www.npmjs.com/package/auditjs).
      auditjs ossi --json > auditjs_report.json
      Last modified January 16, 2023: Doc: Split doc to files + unittest for missing unittest and doc (#7418) (392bf7099)
      
\ No newline at end of file
diff --git a/dev/integrations/parsers/file/aws_prowler/index.html b/dev/integrations/parsers/file/aws_prowler/index.html
index 613c7c0a847..b26ea0ce576 100644
--- a/dev/integrations/parsers/file/aws_prowler/index.html
+++ b/dev/integrations/parsers/file/aws_prowler/index.html
@@ -1,4 +1,4 @@
-AWS Prowler Scanner | Documentation
      
+AWS Prowler Scanner | Documentation
      
 
      Edit this page
 Create child page
 Create documentation issue
      AWS Prowler Scanner
      Prowler file can be imported as a CSV (-M csv) or JSON (-M json) file.
      Last modified January 16, 2023: Doc: Split doc to files + unittest for missing unittest and doc (#7418) (392bf7099)
      
\ No newline at end of file
diff --git a/dev/integrations/parsers/file/aws_prowler_v3/index.html b/dev/integrations/parsers/file/aws_prowler_v3/index.html
index b934c6a1311..42603234b2c 100644
--- a/dev/integrations/parsers/file/aws_prowler_v3/index.html
+++ b/dev/integrations/parsers/file/aws_prowler_v3/index.html
@@ -1,4 +1,4 @@
-AWS Prowler V3 | Documentation
      
+AWS Prowler V3 | Documentation
      
 
      Edit this page
 Create child page
 Create documentation issue
      AWS Prowler V3
      AWS Prowler V3 file can be imported as JSON (-M json) file.
      Last modified May 20, 2023: Add support to AWS Prowler V3 json format (#8028) (7601777f3)
      
\ No newline at end of file
diff --git a/dev/integrations/parsers/file/aws_scout2/index.html b/dev/integrations/parsers/file/aws_scout2/index.html
index 28ee5ed8ad4..08872defe74 100644
--- a/dev/integrations/parsers/file/aws_scout2/index.html
+++ b/dev/integrations/parsers/file/aws_scout2/index.html
@@ -1,7 +1,7 @@
 AWS Scout2 Scanner (deprecated) | Documentation
      
+Warning AWS Scout2 Scanner is deprecated and has been replaced with ScoutSuite (https://github.com/nccgroup/ScoutSuite) upstream. Please switch to the new parser for ScoutSuite.  Warning This parser is disactivated by default in releases >= 2.3.1 and will be removed in release >= 3.x.x.  ">
      
 
      Edit this page
 Create child page
 Create documentation issue
      AWS Scout2 Scanner (deprecated)
      JS file in scout2-report/inc-awsconfig/aws_config.js.