Add Jira 'Push all Finding Groups' to compliment existing 'Push all issues' selection

[testaccount90009]

⚠️ Note on feature completeness ⚠️

We are narrowing the scope of acceptable enhancements to DefectDojo. Learn more here:
https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/CONTRIBUTING.md

Is your feature request related to a problem? Please describe
Findings in libraries don't need separate issues in Jira, since a library can contain multiple CVEs or 'issues' but there is only one upgrade path specific to the library. Pushing 10 separate Jira tickets as 'Push all issues' makes no sense when 1 library upgrade will mitigate that and as such, one Jira ticket (the Finding Group in this example) could represent the issue in a cleaner way.

Describe the solution you'd like
I'd like an option for 'Push all Finding Groups' similarly to how 'Push all issues' works. This will give the option for enhanced efficiency with Jira issues and representing Grouped work.

Describe alternatives you've considered
Manually pushing the Finding Group in the UI. At scale, this is tedious.

Additional context
Add any other context, screenshots, sketch, code snippet, etc. about the feature request here.
I will look to add a pull request with the code changes, as I have time. I will link it to this Issue for tracking.

[testaccount90009]

Looks like it was first introduced here #2140

[valentijnscholten]

I haven't looked at the code yet, but I believe the way it should is that if you auto group your findings during import and use push_all_issues it will push the groups and not the individual findings. Are you seeing a different behaviour?

[testaccount90009]

@valentijnscholten we were hoping that was the case, but unfortunately in our experience when it is enabled for an Engagement/Product - it is individual Findings pushed for each Jira ticket and not Grouped. We do group the Findings on import as well.

Does the flag 'push_all_issues' on the reimport need to be set to true in the payload, or if 'Push all issues' in the UI for an Engagement has it enabled (but false in the import) - should that automatically send Grouped Findings to Jira? We have the latter, since not all teams want automated pushed vulnerabilities when we do our mass reimport script. So some Engagements/Products have the 'Push all issues' enabled - and we experience the 1 CVE / Finding per Jira item, instead of ideally 1 Finding Group (multiple CVE an Finding) per Jira item.

Hope this adds clarity.

[valentijnscholten]

I just did a test on the latest Defect Dojo version and JIRA issues are created for groups and not for findings. This is when having Push All issues enabled on the Engagement and not sending any push_to_jira in the UI or import request.

This is as expected as we also have unit tests for these scenario's.

Could you show in more detail how you can reproduce your observed problem?

[testaccount90009]

@valentijnscholten running a test now with these settings and should be able to provide more details. Thank you for the quick response!

[testaccount90009]

@valentijnscholten I have figured out the issue. Huge thank you to you for your response on this. The root cause was we enabled 'Push all issues' - but coincidentally after another person from the team with access selected all Findings and used Bulk Edit to 'Push to Jira'. There was a misunderstanding amongst the team on how to set it up.

To add some extra info on behavior observed -- when an individual does in fact select all Findings and 'Push to Jira' via Bulk Edit to accomplish 'Push all issues' (the original misunderstanding) and it creates 1 Finding to 1 Jira ticket (instead of this lovely Push all issues which does the Grouped push) if you also have 'Push all issues' enabled in the Engagement/Product after doing this, it will cause errors because it wants to push the Finding Group at that point, but cannot because the item is already linked (not at the group level, but it is trying to group them) at the individual Finding level.

The misunderstanding on what our team said by 'Push all issues' caused this and we did not catch that the individual used the Bulk Edit 'Push to Jira' on all Findings, rather than 'Push all issues' pushing to Jira the Grouped Findings.

Again, massive shout out to @valentijnscholten for your quick response. It is much appreciated!

[valentijnscholten]

Thank you for coming back to us. So was the scenario that the individual findings were pushed to JIRA before being grouped? Because if they are already grouped, I expect Defect Dojo to always push the group instead of the finding itself.
I can also see that happening when doing bulk edits with grouped findings. Just trying to make sure I fully understand what "went wrong" on your end, also because there's PR coming in 2.48.0 that with changes around how Finding Groups are pushed to JIRA (#12475)

[testaccount90009]

@valentijnscholten individual Findings were selected and using 'Bulk Edit' the 'Push to Jira' option. They were already grouped on import, but pushing them to Jira in the described manner above results in not the Finding Group, but the individual Findings pushed, just in bulk. At that point it was when a different team member went to 'Push all issues' in the Engagement/Product in the UI, which I've tested does in fact push them as Finding Groups. This was when we started to get nightly (per automation imports into DefectDojo) errors that the Push to Jira failed.

I suspect it has to do with individual Findings being selected and the 'Bulk Edit' 'Push to Jira' option which will push an individual finding per Jira ticket, rather than the Finding Groups being pushed with 'Push all issues'.

[testaccount90009]

If when in a Test and viewing the Findings, selecting them all and using the 'Bulk Edit' 'Push to Jira' does in fact push the Groups - then I am honestly at a loss for how it happened, since there are a few team members who have had access to this and some time has passed since originally encountering the issue.

Can you confirm that when on a test, under Findings and selecting all of them and using Bulk Edit 'Push to Jira' does push the Group? I can try to recreate the scenario when I am back in office Tuesday.

[valentijnscholten]

When performing bulk edit via the UI and checking push to jira, the groups will be pushed. But it looks like the groups will not be pushed automatically even if push_all_issues is checked or finding_jira_sync is checked.