diff --git a/docs/assets/images/priority_chooseengine.png b/docs/assets/images/priority_chooseengine.png new file mode 100644 index 00000000000..c3211fa0e92 Binary files /dev/null and b/docs/assets/images/priority_chooseengine.png differ diff --git a/docs/assets/images/priority_default.png b/docs/assets/images/priority_default.png new file mode 100644 index 00000000000..65443684094 Binary files /dev/null and b/docs/assets/images/priority_default.png differ diff --git a/docs/assets/images/priority_engine_new.png b/docs/assets/images/priority_engine_new.png new file mode 100644 index 00000000000..9021231e76d Binary files /dev/null and b/docs/assets/images/priority_engine_new.png differ diff --git a/docs/assets/images/priority_sliders.png b/docs/assets/images/priority_sliders.png new file mode 100644 index 00000000000..4fc720ab8a0 Binary files /dev/null and b/docs/assets/images/priority_sliders.png differ diff --git a/docs/assets/images/risk_threshold.png b/docs/assets/images/risk_threshold.png new file mode 100644 index 00000000000..0e0a6215f72 Binary files /dev/null and b/docs/assets/images/risk_threshold.png differ diff --git a/docs/content/en/working_with_findings/finding_priority.md b/docs/content/en/working_with_findings/finding_priority.md index 646d4e83765..caff9c56bae 100644 --- a/docs/content/en/working_with_findings/finding_priority.md +++ b/docs/content/en/working_with_findings/finding_priority.md @@ -58,8 +58,9 @@ High. Criticality is a subjective field, so when assigning this field, consider Product compares to other Products in your organization. * **User Records** is a numerical estimation of user records in a database (or a system that can access that database). -* **Revenue** is a numerical estimation of annual revenue for the Product. It is not -possible to set a currency type in DefectDojo, so make sure that all of your Revenue +* **Revenue** is a numerical estimation of annual revenue for the Product. To calculate Priority, DefectDojo will calculate a percentage by comparing this Product's revenue to the sum of all Products within the Product Type. + +It is not possible to set a currency type in DefectDojo, so make sure that all of your Revenue estimations have the same currency denomination. (“50000” could mean $50,000 US Dollars or ¥50,000 Japanese Yen - the denomination does not matter as long as all of your Products have revenue calculated in the same currency). @@ -85,9 +86,6 @@ Findings within a Product can have additional metadata which can further adjust * Whether the Finding is in the KEV (Known Exploited Vulnerabilities) database, which is checked by DefectDojo on a regular basis * The tool-reported Severity of a Finding (Info, Low, Medium, High, Critical) -Currently, Priority calculation and the underlying formula cannot be adjusted. These -numbers are meant as a reference only - your team’s actual priority for remediation -may vary from the DefectDojo calculation. ## Finding Risk Calculation diff --git a/docs/content/en/working_with_findings/priority_adjustments.md b/docs/content/en/working_with_findings/priority_adjustments.md new file mode 100644 index 00000000000..2ea030b61c2 --- /dev/null +++ b/docs/content/en/working_with_findings/priority_adjustments.md @@ -0,0 +1,62 @@ +--- +title: "Adjusting Priority and Risk (Pro)" +description: "Change weighting of Priority and Risk calculations" +weight: 2 +--- + +DefectDojo Pro's Priority and Risk calculations can be adjusted, allowing you to tailor DefectDojo Pro to match your internal standards for Finding Priority and Risk. + +## Prioritization Engines + +Similar to SLA configurations, Prioritization Engines allow you to set the rules governing how Priority and Risk are calculated. + +![image](images/priority_default.png) + +DefectDojo comes with a built-in Prioritization Engine, which is applied to all Products. However, you can edit this Prioritization Engine to change the weighting of **Finding** and **Product** multipliers, which will adjust how Finding Priority and Risk are assigned. + +### Finding Multipliers + +Eight contextual factors impact the Priority score of a Finding. Three of these are Finding-specific, and the other five are assigned based on the Product that holds the Finding. + +You can tune your Prioritization Engine by adjusting how these factors are applied to the final calculation. + +![image](images/priority_sliders.png) + +Select a factor by clicking the button, and adjust this slider allows you to control the percentage a particular factor is applied. As you adjust the slider, you'll see the Risk thresholds change as a result. + +#### Finding-Level Multipliers + +* **Severity** - a Finding's Severity level +* **Exploitability** - a Finding's KEV and/or EPSS score +* **Endpoints** - the amount of Endpoints associated with a Finding + +#### Product-Level Multipliers + +* **Business Criticality** - the related Product's Business Criticality (None, Very Low, Low, Medium, High, or Very +High) +* **User Records** - the related Product's User Records count +* **Revenue** - the related Product's revenue, relative to the total revenue of the Product Type +* **External Audience** - whether or not the related Product has an external audience +* **Internet Accessible** - whether or not the related Product is internet accessible + +### Risk Thresholds + +Based on the tuning of the Priority Engine, DefectDojo will automatically recommend Risk Thresholds. However, these thresholds can be adjusted as well and set to whatever values you deem appropriate. + +![image](images/risk_threshold.png) + +## Creating New Prioritization Engines + +You can use multiple Prioritization Engines, which can each be assigned to different Products. + +![image](images/priority_engine_new.png) + +Creating a new Prioritization Engine will open the Prioritization Engine form. Once this form is submitted, a new Prioritization Engine will be added to the table. + +## Assigning Prioritization Engines to Products + +Each Product can have a Prioritization Engine currently in use via the **Edit Product** form for a given Product. + +![image](images/priority_chooseengine.png) + +Note that when a Product's Prioritization Engine is changed, or a Prioritization Engine is updated, the Product's Prioritization Engine or the Prioritization Engine itself will be "Locked" until the prioritization calculation has completed. \ No newline at end of file