Skip to content

defectdojo.md

Latest commit

 

History

History
135 lines (100 loc) · 7.44 KB

defectdojo.md

File metadata and controls

135 lines (100 loc) · 7.44 KB
Raw
title DefectDojo
category Integrations
chapter 6
order 6

Dependency-Track can automatically publish results to DefectDojo providing a consolidated view of security-centric code findings and vulnerable component findings.

Dependency-Track accomplishes this in the following ways:

  • DefectDojo integration is configured in Dependency-Track
  • Dependency-Track pushes findings to DefectDojo on a periodic basis (configurable)
  • DefectDojo parses Dependency-Track findings

Forwarded analysis data

Each finding pushed to DefectDojo includes audit data from Dependency-Track. The following fields influence how DefectDojo represents the finding:

Field Description
analysis.state A state of FALSE_POSITIVE marks the finding as a false positive in DefectDojo. Other states are included in the payload but are not acted on by the DefectDojo parser.
analysis.isSuppressed Whether the finding is suppressed in Dependency-Track.
analysis.detail Free-text analyst notes entered in Dependency-Track. Appended to the finding description in DefectDojo. Requires Dependency-Track v4.14.0 or higher and a compatible version of the DefectDojo Dependency Track parser.

Requirements:

  • Dependency-Track v4.1.0 or higher
  • DefectDojo 1.13.1 or higher

Dependency-Track Configuration

DefectDojo Configuration

Step 1: Create a product (or navigate to one you've created already

Create a product

Step 2: Create a CI/CD engagement for your product

Create CI/CD engagement menu Create CI/CD engagement

Step 3: Note down the ID of the new engagement

Note engagement ID

Step 4: Note down your API key

Note API Key Note API Key

Step 5: Add the API key in Dependency-Track configuration

Configure DefectDojo Integration

Step 6: Add Per-project configuration

Configure Project Dependency-Track includes the ability to specify configuration properties on a per-project basis. Navigate to Projects / 'Your Project', then click on 'View Details' to open 'Project Details' page; then click on 'Properties' button; click on 'Create Property'. This feature is used to map projects in Dependency-Track to engagements in DefectDojo.

Attribute Value
Group Name integrations
Property Name defectdojo.engagementId
Property Value The CI/CD engagement ID to upload findings to, noted in Step 3
Property Type STRING

Step 7: Add Per-project configuration for Reimport Enhancement (Optional)

  • Dependency-Track v4.6.0 or higher Configure Project Instead of creating numerous tests per DefectDojo engagement, now you have the option to deduplicate the tests automatically with this configuration. Once configured, Dependency Track server will try to determine if previous test exist or not. If no, a new test will be created. Otherwise, the test results will be published into the existing one. The additional configuration property is defined as below:
Attribute Value
Group Name integrations
Property Name defectdojo.reimport
Property Value 'true'
Property Type BOOLEAN

Step 8: Add Per-project configuration for do_not_reactivate Enhancement (Optional)

Configure Project

  • Dependency-Track v4.8.0 or higher
  • Only work in combination with reimport
  • Enabling this flag will mean that DefectDojo is considered the source of truth and findings closed in DefectDojo are not re-opened.
  • WARNING! This comes with the downside that a potentially patched vulnerability that is re-introduced by, for example a library downgrade, is reactivated

As mentioned in the DefectDojo documentation this feature 'Will keep existing findings closed, without reactivating them.' Usually DefectDojo considers the scanners report as the source of truth, this leads DefectDojo to re-open findings that might have been closed in DefectDojo if it shows up in a scan.

Attribute Value
Group Name integrations
Property Name defectdojo.doNotReactivate
Property Value 'true'
Property Type BOOLEAN

Step 9: Add Per-project configuration for test title (Optional)

Configure Project

  • Dependency-Track v4.13.0 or higher

You can define the title of the test. The DefectDojo documentation says 'If no test_title is provided, the latest test inside the engagement will be chosen based on scan_type.'

Attribute Value
Group Name integrations
Property Name defectdojo.testTitle
Property Value Title of the test that is created in DefectDojo
Property Type STRING

Step 10: Global configuration for Reimport Enhancement (Optional)

  • Dependency-Track v4.6.0 or higher Configure Project Alternatively, you can turn on the above reimport feature for all projects in one click, by checking on 'Enable reimport' box as shown in the screenshot above.

Step 11: Add per project configuration for finding groups

  • Not supported in any release yet

You can define how findings should be grouped into Finding Groups in DefectDojo on import/reimport. This is particularly useful when pushing findings to an issue tracker like Jira, as it allows multiple related findings (e.g. all vulnerabilities in the same component) to be consolidated into a single ticket instead of one ticket per finding.

If this property is not set, no grouping is applied and DefectDojo's default behavior is used.

Supported values are defined by DefectDojo (see GROUP_BY_OPTIONS in the DefectDojo source), and currently include:

  • component_name
  • component_name+component_version
  • file_path
  • finding_title
Attribute Value
Group Name integrations
Property Name defectdojo.groupBy
Property Value One of the supported group_by values, e.g. component_name
Property Type STRING