You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/content/supported_tools/parsers/universal_parser.md
+17-3Lines changed: 17 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -164,11 +164,25 @@ You can edit the Test_Type associated with your Universal Parser to change:
164
164
165
165
### Current limitations: editing and deleting a Universal Parser
166
166
167
-
The field-mapping configuration of an existing Universal Parser cannot be modified after it is created — only the associated Test_Type (above) is editable. There is also no in-UI option to delete a Universal Parser.
167
+
A Universal Parser's lifecycle is **create-only**. The field-mapping configuration of an existing Universal Parser cannot be modified after it is created — only the associated Test_Type (above) is editable. There is also no in-UI option to delete a Universal Parser. This is by design: Universal Parser configurations are tied to Test_Type records that may already be referenced by Findings, Tests, and import history.
168
+
169
+
What you **can** do from the UI:
170
+
171
+
***Deactivate** a parser to hide it from the "Scan Type" drop-down on import. Open **Import → Universal Parser** in the sidebar to see all of your Universal Parsers, and toggle "Active" off (or edit the underlying Test_Type and uncheck "active"). Existing Tests already imported under this parser are unaffected.
172
+
***Reactivate** a deactivated parser from the same screen.
168
173
169
174
The current workaround for both cases is:
170
175
171
-
***To change a parser's field mappings:** create a new Universal Parser with the desired mappings (using a representative sample file as in Step 1), and switch new imports to use the new parser. Existing Tests already imported under the old parser are unaffected.
172
-
***To "retire" a parser you no longer want to use:**mark its associated Test_Type as inactive (uncheck "active" on the Test_Type). It will stop appearing in the "Scan Type" drop-down on the Add Findings page. The parser configuration itself will remain in the database.
176
+
***To change a parser's field mappings:** create a new Universal Parser with the desired mappings (using a representative sample file as in Step 1), and switch new imports to use the new parser. Existing Tests already imported under the old parser are unaffected. Then deactivate the old parser so it stops appearing in the Scan Type drop-down.
177
+
***To "retire" a parser you no longer want to use:**deactivate it as described above. The parser configuration itself will remain in the database for the benefit of historical Tests.
173
178
174
179
If you need a parser configuration permanently removed (for example, because it contains sensitive field names), contact [DefectDojo Support](mailto:support@defectdojo.com).
180
+
181
+
### A note about severity mapping
182
+
183
+
The Universal Parser does not have a configurable severity-mapping field. Severity values from your scan file are mapped automatically:
184
+
185
+
* Any case variation of a DefectDojo severity is accepted — `CRITICAL`, `Critical`, `cRiTiCaL`, `critical` all map to **Critical**. The same applies to `High`, `Medium`, `Low`, and `Info`.
186
+
* Any value that does not match one of DefectDojo's five severities is mapped to **Info**.
187
+
188
+
This is the same behavior as the rest of DefectDojo's parsers. If your scanner emits severity labels that don't line up with DefectDojo's (e.g. "warning", "note", numeric CVSS scores), the recommended workaround is to **transform the severity values upstream** — in your CI pipeline before uploading — so the values DefectDojo receives are already one of the five DefectDojo severity names.
0 commit comments