docs(connectors): add Cobalt.io and Nuclei tool references (#15280)

* docs(connectors): add Cobalt.io, Coverity, and Nuclei tool references

Adds Tool-Specific Connector Setup sections for three new Pro
connectors, matching the existing per-tool format (Prerequisites +
Connector Mappings + records mapping):

- Cobalt.io — whole-account PtaaS sync; asset -> Record; personal API
  token, optional org token.
- Coverity — Coverity Connect SAST; project -> Record; username +
  password/auth-key, saved view (notes the required view columns).
- Nuclei (ProjectDiscovery Cloud) — PDCP scan results; scan -> Record;
  API key, optional team id.

Sections placed alphabetically in connectors_tool_reference.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(connectors): drop Coverity section, keep Cobalt.io + Nuclei

Coverity's connector remains in draft, so it is removed from this docs
update; the Cobalt.io and Nuclei (ProjectDiscovery Cloud) tool
references (both targeted for 3.1.200) remain.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: devGregA <greg-agent-2@defectdojo.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>

Author: 4 people

docs/content/import_data/pro/connectors/connectors_tool_reference.md

@@ -281,6 +281,22 @@ You will need a Cloudflare **API token** (not the legacy Global API Key). Create
 
 DefectDojo auto-discovers the accounts and zones the token can access — no account ID is required. Only open (active, non-dismissed) insights are imported, so insights you resolve or dismiss in Cloudflare are automatically mitigated in DefectDojo on the next sync.
 
+## **Cobalt.io**
+
+The Cobalt.io connector uses the Cobalt.io API (v2) to pull pentest findings from your Cobalt.io organization. DefectDojo discovers every organization your API token can access and creates a separate Record for each **asset** (the unit Cobalt pentests).
+
+#### Prerequisites
+
+You will need a Cobalt.io **personal API token**. We recommend creating a dedicated service account for DefectDojo to clearly distinguish automated activity from manual team actions. Generate a token from **Settings \> API Tokens** in the Cobalt.io UI. Organization tokens are discovered automatically \- you do not need to supply them.
+
+#### Connector Mappings
+
+1. Enter the Cobalt.io API base URL in the **Location** field: `https://api.cobalt.io` (or your regional host, for example `https://api.us.cobalt.io`).
+2. Enter your **personal API token** in the **Secret** field.
+3. Optionally, enter an **Organization Token** to pin the sync to a single organization. When left blank, DefectDojo syncs every organization the personal API token can access.
+
+DefectDojo maps each Cobalt.io **asset** as a separate Record. Findings are imported for each mapped asset, with their Cobalt.io state (for example `valid_fix`, `wont_fix`, `invalid`) driving the finding status in DefectDojo.
+
 ## **Contrast**
 
 The Contrast connector uses the Contrast Assess REST API to import application vulnerabilities. DefectDojo discovers the applications in your Contrast organization and creates a Record for each one.
@@ -658,6 +674,23 @@ Unlike the device\-based Microsoft Defender connector, no API permissions or adm
 
 Each enabled Azure subscription becomes a Record. Findings are read through Azure Resource Graph, so they surface promptly once Defender for Cloud has scanned your resources — but the scans themselves run on Microsoft's schedule: container\-registry images are usually scanned within an hour of being pushed, while a VM's first agentless vulnerability scan can take several hours. A newly enabled subscription will legitimately Sync zero findings until its resources have been scanned.
 
+## **Nuclei (ProjectDiscovery Cloud)**
+
+The Nuclei connector uses the ProjectDiscovery Cloud Platform (PDCP) REST API to pull [nuclei](https://github.com/projectdiscovery/nuclei) scan results from your PDCP account. DefectDojo discovers every scan in the account and creates a separate Record for each **scan**.
+
+#### Prerequisites
+
+You will need a ProjectDiscovery Cloud **API key**. We recommend creating a dedicated service account for DefectDojo to clearly distinguish automated activity from manual team actions. Generate a key from **Settings \> API Key** in the ProjectDiscovery Cloud UI ([cloud.projectdiscovery.io](https://cloud.projectdiscovery.io)). Results reach PDCP either from hosted scans or from the nuclei CLI run with `-dashboard`.
+
+#### Connector Mappings
+
+1. Enter the PDCP API base URL in the **Location** field: `https://api.projectdiscovery.io`.
+2. Enter your **API key** in the **Secret** field.
+3. Optionally, enter a **Team ID** to scope the sync to a team workspace (found under **Settings \> Team**). When left blank, DefectDojo syncs your personal workspace.
+4. Optionally, set a **Minimum Severity** to limit which findings are imported.
+
+DefectDojo maps each PDCP **scan** as a separate Record and imports that scan's findings across every severity, including informational.
+
 ## **OpenVAS / Greenbone**
 
 The OpenVAS / Greenbone connector imports **network vulnerability findings** from a Greenbone (Greenbone Community Edition or Greenbone Enterprise) instance. It talks to `gvmd` over **GMP (Greenbone Management Protocol)** — an XML protocol over a TLS socket, not HTTP — and syncs the whole instance: it enumerates scan **tasks** and creates a DefectDojo product for each, importing the results of each task's latest report.