Concurrent Report Uploads Creating Duplicate Engagements

[saeedsrm]

Be informative
When multiple reports are sent to DefectDojo simultaneously from different tools for the same Product, instead of creating a single Engagement and adding all reports to it, separate Engagements are created for each report. This issue only occurs when requests are sent concurrently; if reports are sent with a slight delay, they are properly aggregated into a single Engagement.

All reports share the same Engagement name, and the Engagement should dose not exist in DefectDojo, so it should be created .

Steps to reproduce
Steps to reproduce the behavior:
Send multiple reports from different tools to DefectDojo at the same time, all targeting an Engagement with the same name.

Expected behavior
A clear and concise description of what you expected to happen.
Observe that multiple Engagements are created instead of one single Engagement.

Deployment method (select with an X)

• Docker Compose
• Kubernetes
• GoDojo

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context (optional)
Add any other context about the problem here.

[mtesauro]

@saeedsrm You don't say what API call you're making so I'm going answer this assuming you're using auto_create_context=True to create the engagements.

I'm assuming you want something like this

Based on the info you provided, I'd suggest you either:
(1) Have a short pause between the first scanner output upload/REST call and the remaining scanner outputs. I suspect that due to the concurrent nature of your requests, DefectDojo is auto-creating the engagements independently rather then creating just a single one. Without more details it's harder to be more specific on why it's happening.
(2) Create the engagement first and auto-create the tests for each of the scanner outputs. If you first create an engagement and get back an ID e.g. Engagement ID 1234, you can tell DefectDojo to add each test to that engagement (ID 1234). That will ensure you only create a single engagement with multiple tests even if the tests are uploaded concurrently.

Also, since you didn't say either way and it appears your doing CICD/automated tool runs, I'd strongly recommend using reimport instead of import. Details on reimport can be found at https://documentation.defectdojo.com/integrations/importing/#reimport-1

[valentijnscholten]

I think it's a fair request to prevent this on the Defect Dojo side. Small PR created.