diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml index 7a02aa15919..f2deb493718 100644 --- a/.github/release-drafter.yml +++ b/.github/release-drafter.yml @@ -55,7 +55,7 @@ exclude-labels: change-template: '- $TITLE @$AUTHOR (#$NUMBER)' template: | - Please consult the [Upgrade notes in the documentation ](https://docs.defectdojo.com/en/open_source/upgrading/upgrading_guide/) for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release. + Please consult the [Upgrade notes in the documentation](https://docs.defectdojo.com/releases/os_upgrading/upgrading_guide/) for specific instructions for this release, and general upgrade instructions. Below is an automatically generated list of all PRs merged since the previous release. ## Changes since $PREVIOUS_TAG $CHANGES diff --git a/.github/renovate.json b/.github/renovate.json index 62177863787..ad093496aaf 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -8,6 +8,7 @@ "rebaseWhen": "conflicted", "separateMinorPatch": true, "ignorePaths": [ + "docs/**", "requirements.txt", "requirements-lint.txt", "components/package.json", diff --git a/Dockerfile.django-alpine b/Dockerfile.django-alpine index 039eb9d2ed7..5754802a061 100644 --- a/Dockerfile.django-alpine +++ b/Dockerfile.django-alpine @@ -10,6 +10,7 @@ FROM base AS build WORKDIR /app RUN \ apk update && \ + apk upgrade --no-cache && \ apk add --no-cache \ gcc \ build-base \ @@ -40,6 +41,7 @@ ARG appuser=defectdojo ENV appuser=${appuser} RUN \ apk update && \ + apk upgrade --no-cache && \ apk add --no-cache \ openjpeg \ jpeg \ diff --git a/Dockerfile.django-debian b/Dockerfile.django-debian index 593325c8f69..f7cd795b5b2 100644 --- a/Dockerfile.django-debian +++ b/Dockerfile.django-debian @@ -10,6 +10,7 @@ FROM base AS build WORKDIR /app RUN \ apt-get -y update && \ + apt-get -y upgrade && \ apt-get -y install --no-install-recommends \ gcc \ build-essential \ @@ -39,6 +40,7 @@ ARG appuser=defectdojo ENV appuser=${appuser} RUN \ apt-get -y update && \ + apt-get -y upgrade && \ # ugly fix to install postgresql-client without errors mkdir -p /usr/share/man/man1 /usr/share/man/man7 && \ apt-get -y install --no-install-recommends \ diff --git a/Dockerfile.integration-tests-debian b/Dockerfile.integration-tests-debian index 572b02e1e99..41a8027d615 100644 --- a/Dockerfile.integration-tests-debian +++ b/Dockerfile.integration-tests-debian @@ -7,6 +7,7 @@ FROM python:3.13.12-slim-trixie@sha256:a7a03d8253322dba5b97771f4971c6ee17c561f73 WORKDIR /app RUN \ apt-get -y update && \ + apt-get -y upgrade && \ apt-get -y install \ git \ wget \ @@ -20,6 +21,7 @@ RUN \ xvfb \ && \ apt-get clean && \ + rm -rf /var/lib/apt/lists && \ true RUN pip install --no-cache-dir selenium==4.9.0 requests diff --git a/Dockerfile.nginx-alpine b/Dockerfile.nginx-alpine index 03c90ad317c..c017bf85c79 100644 --- a/Dockerfile.nginx-alpine +++ b/Dockerfile.nginx-alpine @@ -10,6 +10,7 @@ FROM base AS build WORKDIR /app RUN \ apk update && \ + apk upgrade --no-cache && \ apk add --no-cache \ gcc \ build-base \ @@ -70,12 +71,14 @@ COPY --from=collectstatic /app/static/ /usr/share/nginx/html/static/ COPY wsgi_params nginx/nginx.conf nginx/nginx_TLS.conf /etc/nginx/ COPY docker/entrypoint-nginx.sh / RUN \ + apk upgrade --no-cache && \ apk add --no-cache openssl && \ chmod -R g=u /var/cache/nginx && \ mkdir /var/run/defectdojo && \ chmod -R g=u /var/run/defectdojo && \ mkdir -p /etc/nginx/ssl && \ chmod -R g=u /etc/nginx && \ + rm -rf /var/cache/apk/* && \ true ENV \ DD_UWSGI_PASS="uwsgi_server" \ diff --git a/docs/assets/images/RA_image1.png b/docs/assets/images/RA_image1.png new file mode 100644 index 00000000000..5aa022a9005 Binary files /dev/null and b/docs/assets/images/RA_image1.png differ diff --git a/docs/assets/images/RA_image2.png b/docs/assets/images/RA_image2.png new file mode 100644 index 00000000000..eb9aba2d769 Binary files /dev/null and b/docs/assets/images/RA_image2.png differ diff --git a/docs/assets/images/RA_image3.png b/docs/assets/images/RA_image3.png new file mode 100644 index 00000000000..1b45d9aaeeb Binary files /dev/null and b/docs/assets/images/RA_image3.png differ diff --git a/docs/assets/images/RA_image4.png b/docs/assets/images/RA_image4.png new file mode 100644 index 00000000000..fb56d387b8f Binary files /dev/null and b/docs/assets/images/RA_image4.png differ diff --git a/docs/assets/images/RA_image5.png b/docs/assets/images/RA_image5.png new file mode 100644 index 00000000000..eac710aac8e Binary files /dev/null and b/docs/assets/images/RA_image5.png differ diff --git a/docs/assets/images/calendar1.png b/docs/assets/images/calendar1.png new file mode 100644 index 00000000000..d45ef5bd29d Binary files /dev/null and b/docs/assets/images/calendar1.png differ diff --git a/docs/assets/images/calendar2.png b/docs/assets/images/calendar2.png new file mode 100644 index 00000000000..a383183dc3c Binary files /dev/null and b/docs/assets/images/calendar2.png differ diff --git a/docs/config/_default/params.toml b/docs/config/_default/params.toml index 36331f1428b..6561c73fa2b 100644 --- a/docs/config/_default/params.toml +++ b/docs/config/_default/params.toml @@ -49,6 +49,7 @@ mainSections = ["docs"] "en", "supported_tools", "get_started", + "releases", "import_data", "triage_findings", "metrics_reports", diff --git a/docs/content/asset_modelling/engagements_tests/PRO__calendar.md b/docs/content/asset_modelling/engagements_tests/PRO__calendar.md new file mode 100644 index 00000000000..7c326551545 --- /dev/null +++ b/docs/content/asset_modelling/engagements_tests/PRO__calendar.md @@ -0,0 +1,62 @@ +--- +title: "Calendar" +description: "How to use the Calendar in DefectDojo Pro" +audience: pro +weight: 2 +--- + +DefectDojo features a built-in Calendar so you can track all prior and active Engagements and Tests within your organization. Any time a User creates a new Engagement or Test and establishes the start and end dates, a corresponding entry will automatically be added to the Calendar. + +### Landing Page + +The Calendar page includes filters at the top and a monthly calendar below. The filters can adjust which results appear in the calendar based on: +- Engagement and/or Test +- Start and End date +- Engagement Status (e.g., Completed, In Progress, On Hold, etc.) +- Engagement/Test Lead (i.e., to whom is the Engagement/Test assigned?) +- Engagement Type (e.g., Interactive or CI/CD) +- Test Type (e.g., Pen Test, Acunetix Scan, Tenable Scan, etc.) + + + +Once filtered, results can be exported and shared as an ICS file. + +Importantly, Calendar will only present Engagements and Tests to which the User viewing the calendar has access. It will not display Engagements and Tests that the User does not have permission to view. + +## Features + +### Monthly View + +The monthly calendar will preview five entries on each day. Additional entries occurring on that day will be hidden from view unless the **"+ [X] events"** is clicked within the cell of any particular date. Once clicked, the calendar will shift from a monthly view to a daily view. + +Clicking on an for a Test or Engagement will open a pop-up modal with additional information on that entry, including: +- Start and End Date +- Test or Engagement Type +- Lead +- Status +- Asset +- Engagement +- Test + +From there, the Asset, Engagement, or Test can be accessed via hyperlink. + +### Daily View + +In the daily view, all currently active Engagements and Tests will appear chronologically in descending order (i.e, a newly created Engagement or Test will be found at the bottom of that day’s entry). Engagements appear in blue, while Tests appear in Orange. + +If set within the applicable Engagement/Test, the title of each entry in the daily calendar will include the following: +- Status +- Product +- Engagement +- Test +- Assignee + +#### Arrows + +The arrows on the left and right side of each entry indicate whether that particular Test or Engagement is present on the preceding and/or following day. + +For example, a Test that was made on the same day on which it’s being viewed will not have arrows on the left because that Test didn’t exist the day before. Conversely, a Test that ends on the same day on which it’s being viewed will not have arrows on the right because the entry won’t exist on the following day. + +For example, as the final Engagement in the screenshot below (**In Progress** Example Product A ▶ **Sample Engagement** (Unassigned)) is being viewed on the day it was created, and the Target End Date was set for the following day, no arrows are present on either the left or right side. + + \ No newline at end of file diff --git a/docs/content/changelog/os_upgrading/_index.md b/docs/content/changelog/os_upgrading/_index.md deleted file mode 100644 index 5eee9e16873..00000000000 --- a/docs/content/changelog/os_upgrading/_index.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: "Upgrading" -description: "Release specific upgrading instructions" -draft: false -sidebar: - collapsed: true -weight: 2 ---- - -## Docker compose - -When you deploy a vanilla docker compose, it will create a persistent -volume for your Postgres database. As long as your volume is there, you -should not lose any data. - -### Using docker images provided in DockerHub - -If you\'re using `latest`, then you need to pre pull the `latest` from -DockerHub to update. - -The generic upgrade method for docker compose are as follows: -- Pull the latest version - - ``` {.sourceCode .bash} - docker pull defectdojo/defectdojo-django:latest - docker pull defectdojo/defectdojo-nginx:latest - ``` - -- If you would like to use a version other than the latest, specify the version (tag) you want to upgrade to: - - ``` {.sourceCode .bash} - docker pull defectdojo/defectdojo-django:1.10.2 - docker pull defectdojo/defectdojo-nginx:1.10.2 - ``` - -- If you would like to use alpine based images, you specify the version (tag) you want to upgrade to: - - ``` {.sourceCode .bash} - docker pull defectdojo/defectdojo-django:1.10.2-alpine - docker pull defectdojo/defectdojo-nginx:1.10.2-alpine - ``` - -- Go to the directory where your docker-compose.yml file lives -- Stop DefectDojo: `docker compose stop` -- Re-start DefectDojo, allowing for container recreation: `docker compose up -d` -- Database migrations will be run automatically by the initializer. - Check the output via `docker compose logs initializer` or relevant k8s command -- If you have the initializer disabled (or if you want to be on the - safe side), run the migration command: - `docker compose exec uwsgi /bin/bash -c "python manage.py migrate"` - -### Building your local images - -If you build your images locally and do not use the ones from DockerHub, -the instructions are the same, with the caveat that you must build your images -first. -- Pull the latest DefectDojo changes - - ``` {.sourceCode .bash} - git fetch - git pull - git merge origin/master - ``` - -Then replace the first step of the above generic upgrade method for docker compose with: `docker compose build` - -## godojo installations - -If you have installed DefectDojo on "iron" and wish to upgrade the installation, please see the [instructions in the repo](https://github.com/DefectDojo/godojo/blob/master/docs-and-scripts/upgrading.md). - -## Upgrade notes for each release diff --git a/docs/content/releases/_index.md b/docs/content/releases/_index.md new file mode 100644 index 00000000000..9f4ee0de7da --- /dev/null +++ b/docs/content/releases/_index.md @@ -0,0 +1,3 @@ +--- +title: "Release Information" +--- diff --git a/docs/content/changelog/os_upgrading/1.10.md b/docs/content/releases/os_upgrading/1.10.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.10.md rename to docs/content/releases/os_upgrading/1.10.md diff --git a/docs/content/changelog/os_upgrading/1.11.md b/docs/content/releases/os_upgrading/1.11.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.11.md rename to docs/content/releases/os_upgrading/1.11.md diff --git a/docs/content/changelog/os_upgrading/1.12.md b/docs/content/releases/os_upgrading/1.12.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.12.md rename to docs/content/releases/os_upgrading/1.12.md diff --git a/docs/content/changelog/os_upgrading/1.13.md b/docs/content/releases/os_upgrading/1.13.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.13.md rename to docs/content/releases/os_upgrading/1.13.md diff --git a/docs/content/changelog/os_upgrading/1.14.md b/docs/content/releases/os_upgrading/1.14.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.14.md rename to docs/content/releases/os_upgrading/1.14.md diff --git a/docs/content/changelog/os_upgrading/1.15.md b/docs/content/releases/os_upgrading/1.15.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.15.md rename to docs/content/releases/os_upgrading/1.15.md diff --git a/docs/content/changelog/os_upgrading/1.2.2.md b/docs/content/releases/os_upgrading/1.2.2.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.2.2.md rename to docs/content/releases/os_upgrading/1.2.2.md diff --git a/docs/content/changelog/os_upgrading/1.2.3.md b/docs/content/releases/os_upgrading/1.2.3.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.2.3.md rename to docs/content/releases/os_upgrading/1.2.3.md diff --git a/docs/content/changelog/os_upgrading/1.2.4.md b/docs/content/releases/os_upgrading/1.2.4.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.2.4.md rename to docs/content/releases/os_upgrading/1.2.4.md diff --git a/docs/content/changelog/os_upgrading/1.2.8.md b/docs/content/releases/os_upgrading/1.2.8.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.2.8.md rename to docs/content/releases/os_upgrading/1.2.8.md diff --git a/docs/content/changelog/os_upgrading/1.2.9.md b/docs/content/releases/os_upgrading/1.2.9.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.2.9.md rename to docs/content/releases/os_upgrading/1.2.9.md diff --git a/docs/content/changelog/os_upgrading/1.3.1.md b/docs/content/releases/os_upgrading/1.3.1.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.3.1.md rename to docs/content/releases/os_upgrading/1.3.1.md diff --git a/docs/content/changelog/os_upgrading/1.7.0.md b/docs/content/releases/os_upgrading/1.7.0.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.7.0.md rename to docs/content/releases/os_upgrading/1.7.0.md diff --git a/docs/content/changelog/os_upgrading/1.8.0.md b/docs/content/releases/os_upgrading/1.8.0.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.8.0.md rename to docs/content/releases/os_upgrading/1.8.0.md diff --git a/docs/content/changelog/os_upgrading/1.9.3.md b/docs/content/releases/os_upgrading/1.9.3.md similarity index 100% rename from docs/content/changelog/os_upgrading/1.9.3.md rename to docs/content/releases/os_upgrading/1.9.3.md diff --git a/docs/content/changelog/os_upgrading/2.0.md b/docs/content/releases/os_upgrading/2.0.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.0.md rename to docs/content/releases/os_upgrading/2.0.md diff --git a/docs/content/changelog/os_upgrading/2.10.md b/docs/content/releases/os_upgrading/2.10.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.10.md rename to docs/content/releases/os_upgrading/2.10.md diff --git a/docs/content/changelog/os_upgrading/2.12.md b/docs/content/releases/os_upgrading/2.12.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.12.md rename to docs/content/releases/os_upgrading/2.12.md diff --git a/docs/content/changelog/os_upgrading/2.13.md b/docs/content/releases/os_upgrading/2.13.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.13.md rename to docs/content/releases/os_upgrading/2.13.md diff --git a/docs/content/changelog/os_upgrading/2.15.md b/docs/content/releases/os_upgrading/2.15.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.15.md rename to docs/content/releases/os_upgrading/2.15.md diff --git a/docs/content/changelog/os_upgrading/2.16.md b/docs/content/releases/os_upgrading/2.16.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.16.md rename to docs/content/releases/os_upgrading/2.16.md diff --git a/docs/content/changelog/os_upgrading/2.17.md b/docs/content/releases/os_upgrading/2.17.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.17.md rename to docs/content/releases/os_upgrading/2.17.md diff --git a/docs/content/changelog/os_upgrading/2.18.md b/docs/content/releases/os_upgrading/2.18.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.18.md rename to docs/content/releases/os_upgrading/2.18.md diff --git a/docs/content/changelog/os_upgrading/2.19.md b/docs/content/releases/os_upgrading/2.19.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.19.md rename to docs/content/releases/os_upgrading/2.19.md diff --git a/docs/content/changelog/os_upgrading/2.2.md b/docs/content/releases/os_upgrading/2.2.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.2.md rename to docs/content/releases/os_upgrading/2.2.md diff --git a/docs/content/changelog/os_upgrading/2.20.md b/docs/content/releases/os_upgrading/2.20.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.20.md rename to docs/content/releases/os_upgrading/2.20.md diff --git a/docs/content/changelog/os_upgrading/2.21.md b/docs/content/releases/os_upgrading/2.21.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.21.md rename to docs/content/releases/os_upgrading/2.21.md diff --git a/docs/content/changelog/os_upgrading/2.22.md b/docs/content/releases/os_upgrading/2.22.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.22.md rename to docs/content/releases/os_upgrading/2.22.md diff --git a/docs/content/changelog/os_upgrading/2.23.md b/docs/content/releases/os_upgrading/2.23.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.23.md rename to docs/content/releases/os_upgrading/2.23.md diff --git a/docs/content/changelog/os_upgrading/2.24.md b/docs/content/releases/os_upgrading/2.24.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.24.md rename to docs/content/releases/os_upgrading/2.24.md diff --git a/docs/content/changelog/os_upgrading/2.25.md b/docs/content/releases/os_upgrading/2.25.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.25.md rename to docs/content/releases/os_upgrading/2.25.md diff --git a/docs/content/changelog/os_upgrading/2.26.md b/docs/content/releases/os_upgrading/2.26.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.26.md rename to docs/content/releases/os_upgrading/2.26.md diff --git a/docs/content/changelog/os_upgrading/2.27.md b/docs/content/releases/os_upgrading/2.27.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.27.md rename to docs/content/releases/os_upgrading/2.27.md diff --git a/docs/content/changelog/os_upgrading/2.28.md b/docs/content/releases/os_upgrading/2.28.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.28.md rename to docs/content/releases/os_upgrading/2.28.md diff --git a/docs/content/changelog/os_upgrading/2.29.md b/docs/content/releases/os_upgrading/2.29.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.29.md rename to docs/content/releases/os_upgrading/2.29.md diff --git a/docs/content/changelog/os_upgrading/2.3.md b/docs/content/releases/os_upgrading/2.3.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.3.md rename to docs/content/releases/os_upgrading/2.3.md diff --git a/docs/content/changelog/os_upgrading/2.30.md b/docs/content/releases/os_upgrading/2.30.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.30.md rename to docs/content/releases/os_upgrading/2.30.md diff --git a/docs/content/changelog/os_upgrading/2.31.md b/docs/content/releases/os_upgrading/2.31.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.31.md rename to docs/content/releases/os_upgrading/2.31.md diff --git a/docs/content/changelog/os_upgrading/2.32.md b/docs/content/releases/os_upgrading/2.32.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.32.md rename to docs/content/releases/os_upgrading/2.32.md diff --git a/docs/content/changelog/os_upgrading/2.33.md b/docs/content/releases/os_upgrading/2.33.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.33.md rename to docs/content/releases/os_upgrading/2.33.md diff --git a/docs/content/changelog/os_upgrading/2.34.md b/docs/content/releases/os_upgrading/2.34.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.34.md rename to docs/content/releases/os_upgrading/2.34.md diff --git a/docs/content/changelog/os_upgrading/2.35.md b/docs/content/releases/os_upgrading/2.35.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.35.md rename to docs/content/releases/os_upgrading/2.35.md diff --git a/docs/content/changelog/os_upgrading/2.36.md b/docs/content/releases/os_upgrading/2.36.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.36.md rename to docs/content/releases/os_upgrading/2.36.md diff --git a/docs/content/changelog/os_upgrading/2.37.md b/docs/content/releases/os_upgrading/2.37.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.37.md rename to docs/content/releases/os_upgrading/2.37.md diff --git a/docs/content/changelog/os_upgrading/2.38.md b/docs/content/releases/os_upgrading/2.38.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.38.md rename to docs/content/releases/os_upgrading/2.38.md diff --git a/docs/content/changelog/os_upgrading/2.39.md b/docs/content/releases/os_upgrading/2.39.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.39.md rename to docs/content/releases/os_upgrading/2.39.md diff --git a/docs/content/changelog/os_upgrading/2.4.md b/docs/content/releases/os_upgrading/2.4.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.4.md rename to docs/content/releases/os_upgrading/2.4.md diff --git a/docs/content/changelog/os_upgrading/2.40.md b/docs/content/releases/os_upgrading/2.40.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.40.md rename to docs/content/releases/os_upgrading/2.40.md diff --git a/docs/content/changelog/os_upgrading/2.41.md b/docs/content/releases/os_upgrading/2.41.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.41.md rename to docs/content/releases/os_upgrading/2.41.md diff --git a/docs/content/changelog/os_upgrading/2.42.md b/docs/content/releases/os_upgrading/2.42.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.42.md rename to docs/content/releases/os_upgrading/2.42.md diff --git a/docs/content/changelog/os_upgrading/2.43.md b/docs/content/releases/os_upgrading/2.43.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.43.md rename to docs/content/releases/os_upgrading/2.43.md diff --git a/docs/content/changelog/os_upgrading/2.44.1.md b/docs/content/releases/os_upgrading/2.44.1.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.44.1.md rename to docs/content/releases/os_upgrading/2.44.1.md diff --git a/docs/content/changelog/os_upgrading/2.44.md b/docs/content/releases/os_upgrading/2.44.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.44.md rename to docs/content/releases/os_upgrading/2.44.md diff --git a/docs/content/changelog/os_upgrading/2.45.md b/docs/content/releases/os_upgrading/2.45.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.45.md rename to docs/content/releases/os_upgrading/2.45.md diff --git a/docs/content/changelog/os_upgrading/2.46.md b/docs/content/releases/os_upgrading/2.46.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.46.md rename to docs/content/releases/os_upgrading/2.46.md diff --git a/docs/content/changelog/os_upgrading/2.47.md b/docs/content/releases/os_upgrading/2.47.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.47.md rename to docs/content/releases/os_upgrading/2.47.md diff --git a/docs/content/changelog/os_upgrading/2.48.2.md b/docs/content/releases/os_upgrading/2.48.2.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.48.2.md rename to docs/content/releases/os_upgrading/2.48.2.md diff --git a/docs/content/changelog/os_upgrading/2.48.md b/docs/content/releases/os_upgrading/2.48.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.48.md rename to docs/content/releases/os_upgrading/2.48.md diff --git a/docs/content/changelog/os_upgrading/2.49.md b/docs/content/releases/os_upgrading/2.49.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.49.md rename to docs/content/releases/os_upgrading/2.49.md diff --git a/docs/content/changelog/os_upgrading/2.5.md b/docs/content/releases/os_upgrading/2.5.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.5.md rename to docs/content/releases/os_upgrading/2.5.md diff --git a/docs/content/changelog/os_upgrading/2.50.md b/docs/content/releases/os_upgrading/2.50.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.50.md rename to docs/content/releases/os_upgrading/2.50.md diff --git a/docs/content/changelog/os_upgrading/2.51.md b/docs/content/releases/os_upgrading/2.51.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.51.md rename to docs/content/releases/os_upgrading/2.51.md diff --git a/docs/content/changelog/os_upgrading/2.52.md b/docs/content/releases/os_upgrading/2.52.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.52.md rename to docs/content/releases/os_upgrading/2.52.md diff --git a/docs/content/changelog/os_upgrading/2.53.md b/docs/content/releases/os_upgrading/2.53.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.53.md rename to docs/content/releases/os_upgrading/2.53.md diff --git a/docs/content/changelog/os_upgrading/2.54.3.md b/docs/content/releases/os_upgrading/2.54.3.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.54.3.md rename to docs/content/releases/os_upgrading/2.54.3.md diff --git a/docs/content/changelog/os_upgrading/2.54.md b/docs/content/releases/os_upgrading/2.54.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.54.md rename to docs/content/releases/os_upgrading/2.54.md diff --git a/docs/content/releases/os_upgrading/2.55.2.md b/docs/content/releases/os_upgrading/2.55.2.md new file mode 100644 index 00000000000..45df3e68dc7 --- /dev/null +++ b/docs/content/releases/os_upgrading/2.55.2.md @@ -0,0 +1,55 @@ +--- +title: 'Upgrading to DefectDojo Version 2.55.2' +toc_hide: true +weight: -20260208 +description: JIRA Reconciliation now also processes Finding Groups. +--- + +## JIRA Reconciliation + +The `jira_status_reconciliation` management command now also processes JIRA issues for Finding Groups. + +New command line options: + +- `--include-findings` / `--no-include-findings` — Process individual findings with direct JIRA issues (default: True) +- `--include-finding-groups` / `--no-include-finding-groups` — Process finding groups with JIRA issues (default: True) + +Full list of options: + + docker compose exec uwsgi bash -c "python manage.py jira_status_reconciliation --help" + + usage: manage.py jira_status_reconciliation [-h] [--mode MODE] [--product PRODUCT] + [--engagement ENGAGEMENT] [--daysback DAYSBACK] [--dryrun] + [--include-findings | --no-include-findings] + [--include-finding-groups | --no-include-finding-groups] + [--version] [-v {0,1,2,3}] [--settings SETTINGS] + [--pythonpath PYTHONPATH] [--traceback] [--no-color] + [--force-color] [--skip-checks] + + Reconcile finding/finding group status with JIRA issue status, stdout will + contain semicolon separated CSV results. Risk Accepted findings are skipped. + Findings created before 1.14.0 are skipped. + + options: + -h, --help show this help message and exit + --mode MODE reconcile: (default) reconcile any differences in + status between Defect Dojo and JIRA. + push_status_to_jira: update JIRA status for all JIRA + issues connected to a finding or finding group. + import_status_from_jira: update finding/finding group + status from JIRA. + --product PRODUCT Only process findings in this product (name) + --engagement ENGAGEMENT + Only process findings in this engagement (name) + --daysback DAYSBACK Only process findings created in the last + 'daysback' days + --dryrun Only print actions to be performed, but make no + modifications. + --include-findings, --no-include-findings + Process individual findings with direct JIRA issues + (default: True) + --include-finding-groups, --no-include-finding-groups + Process finding groups with JIRA issues + (default: True) + +Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.55.2) for the contents of the release. diff --git a/docs/content/en/open_source/upgrading/2.55.md b/docs/content/releases/os_upgrading/2.55.md similarity index 100% rename from docs/content/en/open_source/upgrading/2.55.md rename to docs/content/releases/os_upgrading/2.55.md diff --git a/docs/content/changelog/os_upgrading/2.6.md b/docs/content/releases/os_upgrading/2.6.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.6.md rename to docs/content/releases/os_upgrading/2.6.md diff --git a/docs/content/changelog/os_upgrading/2.7.md b/docs/content/releases/os_upgrading/2.7.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.7.md rename to docs/content/releases/os_upgrading/2.7.md diff --git a/docs/content/changelog/os_upgrading/2.8.md b/docs/content/releases/os_upgrading/2.8.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.8.md rename to docs/content/releases/os_upgrading/2.8.md diff --git a/docs/content/changelog/os_upgrading/2.9.md b/docs/content/releases/os_upgrading/2.9.md similarity index 100% rename from docs/content/changelog/os_upgrading/2.9.md rename to docs/content/releases/os_upgrading/2.9.md diff --git a/docs/content/releases/os_upgrading/_index.md b/docs/content/releases/os_upgrading/_index.md new file mode 100644 index 00000000000..54683be09d2 --- /dev/null +++ b/docs/content/releases/os_upgrading/_index.md @@ -0,0 +1,7 @@ +--- +title: "Open Source Upgrades" +description: "Release specific upgrading instructions" +draft: false +weight: 2 +audience: opensource +--- diff --git a/docs/content/changelog/os_upgrading/upgrading_guide.md b/docs/content/releases/os_upgrading/upgrading_guide.md similarity index 98% rename from docs/content/changelog/os_upgrading/upgrading_guide.md rename to docs/content/releases/os_upgrading/upgrading_guide.md index 792d024dfc2..18a07166141 100644 --- a/docs/content/changelog/os_upgrading/upgrading_guide.md +++ b/docs/content/releases/os_upgrading/upgrading_guide.md @@ -1,5 +1,5 @@ --- -title: "Upgrading Guide" +title: "Open Source Upgrading" description: "Release specific upgrading instructions" draft: false sidebar: diff --git a/docs/content/releases/pro/_index.md b/docs/content/releases/pro/_index.md new file mode 100644 index 00000000000..da83ccf44b4 --- /dev/null +++ b/docs/content/releases/pro/_index.md @@ -0,0 +1,7 @@ +--- +title: "Pro Upgrades" +description: "" +draft: false +weight: 2 +audience: pro +--- diff --git a/docs/content/changelog/pro_changelog.md b/docs/content/releases/pro/changelog.md similarity index 98% rename from docs/content/changelog/pro_changelog.md rename to docs/content/releases/pro/changelog.md index fa3466d6505..d328fb1dcfc 100644 --- a/docs/content/changelog/pro_changelog.md +++ b/docs/content/releases/pro/changelog.md @@ -6,20 +6,34 @@ exclude_search: true Here are the release notes for **DefectDojo Pro (Cloud Version)**. These release notes are focused on UX, so will not include all code changes. -For Open Source release notes, please see the [Releases page on GitHub](https://github.com/DefectDojo/django-DefectDojo/releases), or alternatively consult the Open Source [upgrade notes](/open_source/upgrading/upgrading_guide/). +For Open Source release notes, please see the [Releases page on GitHub](https://github.com/DefectDojo/django-DefectDojo/releases), or alternatively consult the Open Source [upgrade notes](/changelog/os_upgrading/upgrading_guide/). -## Jan 2025: v2.54 +## Feb 2025: v2.55 -### Jan 20, 2025: v2.54.2 +### Feb 2, 2026: v2.55.0 + +* **(Pro UI)** Risk Acceptances can now have Notes added. +* **(Pro UI)** Note Types are now available in the Pro UI. + +## Jan 2026: v2.54 + +### Jan 27, 2026: v2.54.3 + +* **(Connectors)** Added a "Pending" status to Connectors when Sync or Discovery operations are in progress. +* **(Pro UI)** Findings Under Review can now be Mitigated when clearing Review. +* **(Pro UI)** An Asset's Parent and Child Assets can now be quickly added to a Pro Metrics query. + + +### Jan 20, 2026: v2.54.2 * **(Pro UI)** corrected a bug where unordered lists would display as ordered lists in editor forms. * **(Smart Upload)** introduced severity filtering to the Smart Importer to skip findings below a specified severity level. Added detailed logging throughout the findings processing to improve traceability and debugging. -### Jan 12, 2025: v2.54.1 +### Jan 12, 2026: v2.54.1 * **(AI Tools)** added Risk Scores to schema for MCP processing. -### Jan 5, 2025: v2.54.0 +### Jan 5, 2026: v2.54.0 No significant UX changes. diff --git a/docs/content/triage_findings/findings_workflows/PRO__risk_acceptance.md b/docs/content/triage_findings/findings_workflows/PRO__risk_acceptance.md new file mode 100644 index 00000000000..8ddf6e6a1e5 --- /dev/null +++ b/docs/content/triage_findings/findings_workflows/PRO__risk_acceptance.md @@ -0,0 +1,114 @@ +--- +title: "Risk Acceptances" +description: "Leveraging Risk Acceptances in DefectDojo Pro" +audience: pro +weight: 2 +--- + +**Risk Acceptances** are a special status that can be applied to Findings using either **Full Risk Acceptance** objects or the **Simple Risk Acceptance** workflow. Risk Acceptances are used to formally document and operationalize the decision to acknowledge a vulnerable Finding without immediately remediating it. + +DefectDojo Pro includes enhanced Risk Acceptance capabilities to scale risk management decisions, including: +- **Cross-Product Risk Acceptances**: A single Risk Acceptance can be applied across multiple products, allowing you to bundle all instances of the same or similar Findings throughout your entire portfolio of Assets into a single Risk Acceptance object. +- **Bulk Risk Acceptance Management**: Filter and search for specific Findings of vulnerability IDs and apply Risk Acceptance to all results simultaneously regardless of the Asset they belong to. + +### Accessing Risk Accepted Findings + +The sidebar features a section for Risk Acceptances that includes three subsections in its dropdown menu: +- **Risk Accepted Findings** + - This section includes a table of all Findings that have been risk accepted, whether through as a part of a Full Risk Acceptance object or using the Simple Risk Acceptance workflow. +- **All Risk Acceptances** + - This section includes a table of all Full Risk Acceptance objects, arranged in chronological order. +- **New Risk Acceptance** + - Clicking this option in the sidebar will start the workflow to create a Full Risk Acceptance object. + + + +## Creating Risk Acceptances + +When a Finding is Risk Accepted, the following will occur: + +- The Finding’s status will no longer be “Active”. +- The Finding’s status will be changed to “Risk Accepted.” +- The Finding will no longer be counted toward Metrics, but will still appear within the Test it originated from. + +Findings can be Risk Accepted in one of two ways: They can either be added to Full Risk Acceptance objects, or by using the Simple Risk Acceptance workflow. + +### Full Risk Acceptances + +A Full Risk Acceptance allows Users to accept the risk of multiple Findings while bundling them into a single object, regardless of the Asset, Engagement, or Test they originated from. + +If organizational policy requires formal, documented risk acceptances, or Users want to have risk acceptances automatically expire after a certain date, Full Risk Acceptance is the best choice, as they capture the internal decision-making process and can serve as a source of truth. + +Each Full Risk Acceptance adds additional context to Risk Acceptance, such as: +- The name of the Risk Acceptance object. +- The owner of the Risk Acceptance object. +- The security recommendation and decision regarding how to handle the Finding(s). +- Any proof associated with the recommendation or decision. +- Details regarding the recommendation or decision. +- The User who accepts the risk associated with the decision. +- The expiration date. + - Whether the Finding’s status will return to “Active” upon expiration. + - Whether the SLA will restart upon expiration. + +Expiration is unique to Full Risk Acceptance objects, and allows any Findings that have been Risk Accepted to be re-examined at an appropriate time. Once a Risk Acceptance expires, any Findings will be set to Active again. + +If you don’t specify a date, the Default Risk Acceptance / Default Risk Acceptance Expiration days will be used from the System Settings page. + +#### How to Complete a Full Risk Acceptance + +A Full Risk Acceptance object can be made in three different ways: +- Using the **New Risk Acceptance** button in the sidebar. +- Using the **Add Risk Acceptance** button on an individual Finding. +- Clicking the **Risk Acceptance Actions** button that appears after selecting a Finding/multiple Findings from within a table. + +##### New Risk Acceptance (Sidebar) + +Clicking New Risk Acceptance from the sidebar will open a page in which the User can establish the data and details associated with a new Full Risk Acceptance object. The second page will allow the User to filter and select the Findings to be added to that object. + +##### Add Risk Acceptance (Individual) + +Having opened an individual Finding, click the gear icon in the top right corner of the view and select **Add Risk Acceptance**. From there, you will be able to either add the Finding to an existing Full Risk Acceptance object, or create a new object. + + + +##### Risk Acceptance Actions (Table) + +Having selected a Finding/Findings from within a table, click the **Risk Acceptance Actions** button that appears at the top and select either **Add to New Risk Acceptance Object** or **Add to Existing Risk Acceptance Object** and fill out the required fields. + +Findings can only be added to a single Risk Acceptance at once. If the Risk Acceptance Actions button is unclickable, it’s likely because one of the selected Findings has already been added to a Full Risk Acceptance object. + + + +##### Editing Full Risk Acceptances + +Once a Full Risk Acceptance object has been created, you can edit the details of the object, upload a file with proof of the Risk Acceptance, or delete the object entirely by clicking the gear icon in the top right of the object’s view. + +Findings can also be added and removed from the object using the same menu. Alternatively, Findings can be removed from the object by clicking the ⋮ kebab menu next to an individual Finding, clicking **Bulk Update Actions**, and selecting **Unaccept Risk** from the Simple Risk Acceptance Status dropdown menu. + +Finally, if you add any Findings to a Full Risk Acceptance object and then subsequently delete that object, the Findings within will have their status automatically reverted to “Active.” + +### Simple Risk Acceptances + +Simple Risk Acceptances do not have any associated metadata or expiration date. They are most appropriate for when tracking risk-accepted Findings is still required for compliance, but there is no associated need for an object to track or to change the status of the affected Findings. + +Simple Risk Acceptance is not enabled by default, but it can be toggled in the Optional Fields portion of the Asset’s settings after clicking the gear icon in the top right of the Asset view. + + + +Once enabled, Simple Risk Acceptance can be run from the table of Findings within a Test view. + +#### How to Complete a Simple Risk Acceptance + +You can complete the Simple Risk Acceptance workflow from either the All Findings table (accessible from the sidebar) or from the table of Findings within a specific test. The workflow is identical between the two. + +Select the Findings you wish to Risk Accept and click the **Bulk Update Actions** button that appears at the top of the table. From there, select **Accept Risk** from the Simple Risk Acceptance Status dropdown. Because the Findings have been Simple Risk Accepted, there is no associated Full Risk Acceptance object. The Findings that were Risk Accepted are accessible from the **Risk Accepted Findings** menu in the sidebar. + + + +Conversely, if you wish to unaccept the risk for any Findings that had been previously Risk Accepted, select **Unaccept Risk**. If a Finding has been Simple Risk Accepted, the risk must be unaccepted prior to adding it to a Full Risk Acceptance object. + +### Risk Acceptance Best Practices + +While it is possible to affect Findings within Full Risk Acceptance objects using Simple Risk Acceptance workflows (and vice versa), it is generally preferable to default to either process exclusively rather than having both enabled at once. + +For example, if Full Risk Acceptance objects are the default approach, if a Finding is Simple Risk Accepted, it may cause confusion if there is no associated object that contains the affected Finding. Similarly, if Findings are typically Simple Risk Accepted, it may create similar confusion to then add some Findings to a Full Risk Acceptance object when there are no such objects for most other Findings. diff --git a/docs/content/triage_findings/findings_workflows/risk_acceptances.md b/docs/content/triage_findings/findings_workflows/risk_acceptances.md deleted file mode 100644 index db37e0e450d..00000000000 --- a/docs/content/triage_findings/findings_workflows/risk_acceptances.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: "Using Risk Acceptances" -description: "Adding Simple and Full Risk Acceptances to your Findings" ---- - -‘Risk Accepted’ is a special status that can be applied to a Finding in two ways: - -* **Risk Accepted** can be freely applied as a Status **if ‘Simple Risk Acceptance’** is enabled. -* You can also create **Full Risk Acceptances**, which are objects stored in DefectDojo to capture a risk acceptance decision made by your team. - -A **Full Risk Acceptance** is a special object in DefectDojo, used when Active Findings are ‘backlogged’ by your team. Often, both security teams and developer teams will decide when a Risk Acceptance is appropriate. In DefectDojo, your team can create Risk Acceptances which capture the internal decision making process and can be used as a source of truth. - -## About Full Risk Acceptances - -Each Full Risk Acceptance can store details about the following: - -* The Security team’s recommendation to a Product owner or other stakeholder -* Description of the decision made by stakeholders -* The DefectDojo user involved in the decision making process -* One or more Findings governed by the Risk Acceptance - -Findings can be added to a Risk Acceptance regardless of the Product, Test or Engagement they are in. - -Any Findings associated with a Full Risk Acceptance will be set to **Inactive**, **Risk Accepted**. - -Generally, any Risk Acceptances should follow your internal security policy and be re\-examined at an appropriate time. As a result, Risk Acceptances also have expiration dates. Once a Risk Acceptance expires, any Findings will be set to Active again. - -### DefectDojo Pro vs Open Source: Cross-Product Risk Acceptances - -**DefectDojo Pro** provides enhanced Risk Acceptance capabilities that aid in managing risk decisions at scale: - -* **Cross-Product Risk Acceptances**: In DefectDojo Pro, you can apply a single Risk Acceptance across multiple Products. For example, if CVE-2024-1234 appears in 10 different products, you can create one Risk Acceptance that governs all instances of that CVE across your entire portfolio. -* **Bulk CVE Management**: Search for all Findings with a specific CVE or vulnerability ID, then apply a Risk Acceptance to all instances simultaneously, regardless of which Product they belong to. - -**DefectDojo Open Source** implements Risk Acceptances at the Engagement level: - -* **Product-Scoped Risk Acceptances**: Risk Acceptances are restricted to individual Products. If CVE-2024-1234 appears in 10 different products, you need to create 10 separate Risk Acceptances—one for each Engagement. - -Both approaches follow the same Risk Acceptance workflow described below, but the scope differs based on your DefectDojo edition. - -### Add a new Full Risk Acceptance - -Risk Acceptances can be added to a Finding in two ways: - -* Using the **Bulk Edit** menu, when looking at a list of Findings -* Using the **Add Risk Acceptance** button on an individual Finding - - - - - -To create a New Risk Acceptance, complete the Add to New Risk Acceptance form on a Finding you wish to Risk Accept. - - - -2. Select the **Owner** of the Risk Acceptance \- this is generally meant to be the DefectDojo team member responsible for the decision to Risk Accept the Finding. -3. Complete the **Optional Fields** with any relevant information. If you want to set an Expiration Date or a Warning for that Expiration Date, you can do so here as well. If you don’t specify a date, the Default Risk Acceptance / Default Risk Acceptance Expiration days will be used from the **System Settings** page. -4. Select whether you want to **Reactivate** or **Restart SLAs** on any associated Findings once the Risk Acceptance expires. - -## Simple Risk Acceptances - -If you don’t want to create a Full Risk Acceptance object and would prefer to simply **apply a status of ‘Risk Accepted’ to a Finding**, you can do so through the Bulk Edit menu. This method is called **Simple Risk Acceptance**. - -Before you can apply a Simple Risk Acceptance to a Finding, Simple Risk Acceptance will need to be enabled at the Product level. This setting can be found on the **Edit Product Form**. - -### Apply a Simple Risk Acceptance - -With one or more Findings selected, open **Bulk Update Actions**. Navigate to **Simple Risk Acceptance Status** and select either **Accept Risk** or **Unaccept Risk**. Once you have submitted the Bulk Update, ‘Risk Accepted’ will be applied to any Findings selected without the need to create a Risk Acceptance object (with an expiration date or additional metadata). - -## Locating Risk Accepted Findings - -The sidebar in DefectDojo allows you to quickly find any Risk Accepted Findings by opening **Manage \> Risk Acceptances.** From here you can view the Risk Acceptance objects themselves, or view a list of Risk Accepted Findings. - - diff --git a/docs/layouts/_partials/header/header.html b/docs/layouts/_partials/header/header.html index 24af9353c0b..2db258f53d8 100644 --- a/docs/layouts/_partials/header/header.html +++ b/docs/layouts/_partials/header/header.html @@ -159,7 +159,7 @@