Skip to content

Commit 3268318

Browse files
author
Paul Osinski
committed
Add triageless info to import-scan article
1 parent 2ad779f commit 3268318

1 file changed

Lines changed: 22 additions & 4 deletions

File tree

docs/content/en/connecting_your_tools/import_scan_files/import_scan_ui.md

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,9 +65,27 @@ This option is especially relevant when using the API to import data. If uploadi
6565
* **Source Code Management URI** can also be specified. This form option must be a valid URI.
6666
* **Group By:** if you want to create Finding Groups out of this File, you can specify the grouping method here.
6767

68-
### Next Steps
68+
### Triage-less scanners: "Do Not Reactivate"
6969

70-
Once your upload has completed, you should be redirected to the Test Page which contains the Findings found in the scan file. You can start working with those results right away, but feel free to consult the following articles:
70+
Some scanners might not include triage information in their reports (e.g. tfsec). They simply scan code or dependencies, flag issues, and return everything, regardless of whether a vulnerability has already been triaged or not.
7171

72-
* Learn how to organize your Product Hierarchy to manage different contexts for your Findings and Tests: [Product Hierarchy Overview](/en/working_with_findings/organizing_engagements_tests/product_hierarchy/).
73-
* Learn how to extend a Test with additional Findings and reports: [Reimport Guide](../using_reimport/)
72+
To handle this case, DefectDojo also includes a "Do not reactivate" checkbox in uploading reports (also in the reimport API), so you can use DefectDojo as the source of truth for triage, instead of reactivating your triaged Findings on each import / reimport.
73+
74+
### Using the Scan Completion Date (API: `scan_date`) field
75+
76+
DefectDojo offers a plethora of supported scanner reports, but not all of them contain the
77+
information most important to a user. The `scan_date` field is a flexible smart feature that
78+
allows users to set the completion date of the a given scan report, and have it propagate
79+
down to all the findings imported. This field is **not** mandatory, but the default value for
80+
this field is the date of import (whenever the request is processed and a successful response is returned).
81+
82+
Here are the following use cases for using this field:
83+
84+
1. The report **does not** set the date, and `scan_date` is **not** set at import
85+
- Finding date will be the default value of `scan_date`
86+
2. The report **sets** the date, and the `scan_date` is **not** set at import
87+
- Finding date will be whatever the report sets
88+
3. The report **does not** set the date, and the `scan_date` is **set** at import
89+
- Finding date will be whatever the user set for `scan_date`
90+
4. The report **sets** the date, and the `scan_date` is **set** at import
91+
- Finding date will be whatever the user set for `scan_date`

0 commit comments

Comments
 (0)