|
| 1 | +--- |
| 2 | +title: "Downstream Connections" |
| 3 | +weight: 1 |
| 4 | +audience: pro |
| 5 | +aliases: |
| 6 | + - /en/share_your_findings/integrations |
| 7 | + - /issue_tracking/pro_integration/integrations/ |
| 8 | +--- |
| 9 | +**Availability:** Downstream Connections are currently in **Beta** and are only available for **Cloud-hosted** DefectDojo Pro instances. If you are an on-premise customer interested in this feature, please contact [support@defectdojo.com](mailto:support@defectdojo.com) for updates on availability. |
| 10 | + |
| 11 | +Downstream Connections let you push your Findings and Finding Groups to ticket tracking systems to easily integrate security remediation with your teams existing development workflow. |
| 12 | + |
| 13 | +Supported Downstream Connections: |
| 14 | +- Azure Devops |
| 15 | +- Bitbucket |
| 16 | +- Freshservice |
| 17 | +- GitHub |
| 18 | +- GitLab Boards |
| 19 | +- Jira |
| 20 | +- ServiceDesk Plus |
| 21 | +- ServiceNow |
| 22 | +- Shortcut |
| 23 | +- Zendesk |
| 24 | + |
| 25 | +## Opening the Downstream Connections page |
| 26 | + |
| 27 | +The Downstream Connections page can be found under **Import > Connections > Downstream Connections** in the sidebar. |
| 28 | + |
| 29 | + |
| 30 | + |
| 31 | +## Setting up a Downstream Connection |
| 32 | + |
| 33 | +A Downstream Connection is configured with three key components: |
| 34 | + |
| 35 | +- **Integration Instance**: This is the primary connection method that DefectDojo will use with a third-party system. The Instance will include details such as a label, location and credentials to connect with, along with any other information that may be required by the vendor. |
| 36 | +- **Issue Tracker Mapping**: This is where mapping information is stored - defining the details required to connect to a given "project" within the vendor. These details include the name or ID of the "project", and mappings from DefectDojo Finding severity and status to the corresponding field in the vendor "ticket". You may have multiple mappings configured if you are trying to push Findings to multiple "project" locations. |
| 37 | +- **Issue Tracker Assignment**: This is where DefectDojo Products and Engagements are assigned to a given Issue Tracker Mapping, with per-Product/Engagement options to to define how a Finding will be pushed to a given vendor system. |
| 38 | + |
| 39 | +These components are hierarchical: Each **Instance** has one or more **Mappings**, which then have one or more **Tracker Assignments**. |
| 40 | + |
| 41 | + |
| 42 | + |
| 43 | +## Pushing Findings and Finding Groups |
| 44 | + |
| 45 | +Once these components are configured, Findings and Finding Groups can be sent to a given Issue Tracker in two ways; manually, or automatically. |
| 46 | + |
| 47 | +- **Manually**: Findings and Finding Groups contained in a Product/Engagement with an assigned **Issue Tracker Mapping** will have an option to "Push to Integrator". This will then create an Issue in the Issue Tracker with the corresponding Finding/Finding Group information. Push to Integrator can also be used to update an existing Issue. |
| 48 | + |
| 49 | +### Automatically Push Findings |
| 50 | + |
| 51 | +Findings can also be pushed automatically, with the **Issue Tracker Assignment** dictating how those objects will be pushed. These are the four options: |
| 52 | + |
| 53 | +- **Only Explicitly Publish Changes to Target**: This option disables any automatic behavior in the assigned Product or Engagement. The only way to push a Finding or Finding Group will be explicitly, as mentioned above. |
| 54 | +- **Automatically Link New Finding to Target**: When new Findings or Finding Groups are **created** in the assigned Product or Engagement, DefectDojo will automatically push the object to the Issue Tracker. Once created, these Findings or Findings Groups will not be updated without a manual Push to Integrator action. |
| 55 | +- **Automatically Update Existing Link on Finding Edit**: When Findings or Finding Groups are **updated** in the assigned Product or Engagement, automatically push the object to the Issue Tracker if an existing link has already been created manually. |
| 56 | +- **Automatically Link New and Update Existing Link on Finding Edit**: When Findings or Finding Groups are created **or** updated in the assigned Product or Engagement, automatically push the object to the Issue Tracker. |
| 57 | + |
| 58 | +## Issue Tracker Ticket Representation |
| 59 | + |
| 60 | +Issue Tracker Tickets are represented by a series of icons under the "Integrator Tickets" column when viewing and listing |
| 61 | +Findings and Finding Groups |
| 62 | + |
| 63 | +Icons from left to right: |
| 64 | + |
| 65 | +- **Integration Type**: The type of Issue Tracker the Ticket is associated with |
| 66 | +- **Ticket ID**: The ID of the Ticket, as defined by the Issue Tracker |
| 67 | +- **Ticket Link**: The direct link to the Ticket, as define by the Issue Tracker |
| 68 | +- **Changelog**: Specifies when the Issue Tracker Ticket was associated with a Finding or Finding Group, as well as the last time DefectDojo made a change to the ticket |
| 69 | + |
| 70 | + |
| 71 | + |
| 72 | +## Vendor-Specific Requirements |
| 73 | + |
| 74 | +Each vendor will have varying requirements for how DefectDojo will need to interact with them. This could be in the form of an authentication mechanism, additional fields on a per "project" basis, or severity/status mappings. |
| 75 | + |
| 76 | +For the complete list of requirements, please open the vendor specific pages below: |
| 77 | + |
| 78 | +- [Azure Devops](/connections/downstream/downstream_connections_toolreference/#azure-devops-boards) |
| 79 | +- [Bitbucket](/connections/downstream/downstream_connections_toolreference/#bitbucket) |
| 80 | +- [Freshservice](/connections/downstream/downstream_connections_toolreference/#freshservice) |
| 81 | +- [GitHub](/connections/downstream/downstream_connections_toolreference/#github) |
| 82 | +- [GitLab Boards](/connections/downstream/downstream_connections_toolreference/#gitlab) |
| 83 | +- [Jira](/connections/downstream/downstream_connections_toolreference/#jira) |
| 84 | +- [ServiceDesk Plus](/connections/downstream/downstream_connections_toolreference/#servicedesk-plus) |
| 85 | +- [ServiceNow](/connections/downstream/downstream_connections_toolreference/#servicenow) |
| 86 | +- [Shortcut](/connections/downstream/downstream_connections_toolreference/#shortcut) |
| 87 | +- [Zendesk](/connections/downstream/downstream_connections_toolreference/#zendesk) |
| 88 | + |
| 89 | +## Error Handling and Debugging |
| 90 | + |
| 91 | +Downstream Connections can produce errors for a variety of reasons such as connectivity, authentication, permissions, etc.. To assist |
| 92 | +in debugging these errors, each Issue Tracker Mapping has a table of errors that list when the error occurred, the reason it |
| 93 | +occurred, and the Finding or Finding Group that failed to be pushed. |
| 94 | + |
| 95 | +These errors can be found by looking at the All Issue Tracker Mappings & Assignments page, under the ⚠️ Total Errors column. |
| 96 | + |
| 97 | + |
| 98 | + |
| 99 | +Clicking on the Total Errors entry will bring you to a page with more detailed descriptions of errors associated with this Downstream Connection. |
0 commit comments