Engagements & Tests on DefectDojo Documentation

Organizations

Mon, 01 Jan 0001 00:00:00 +0000

ORGANIZATIONS → Assets → Engagements → Tests → Findings

Overview

Organizations sit at the very top of DefectDojo’s object hierarchy. Organizations are distinct from the descending objects in the hierarchy—Assets, Engagements, Tests, and Findings—because they are not technical scan targets, but rather serve primarily as organizational abstractions that compartmentalize your security efforts according to:

Organizations

Mon, 01 Jan 0001 00:00:00 +0000

ORGANIZATIONS → Assets → Engagements → Tests → Findings

Overview

Organizations sit at the very top of DefectDojo’s Asset hierarchy. Organizations are distinct from the descending objects in the hierarchy—Assets, Engagements, Tests, and Findings—because they are not technical scan targets, but rather serve primarily as organizational abstractions that compartmentalize your security efforts according to:

Assets

Mon, 01 Jan 0001 00:00:00 +0000

Organizations → ASSETS → Engagements → Tests → Findings

An Asset is the thing whose security posture you want to track over time, such as an application, an API or a cloud environment. It holds every Engagement, Test and Finding for that thing, and its settings decide the SLA, permissions and deduplication scope those Findings use. To decide how broad each Asset should be, read Asset Examples and Asset Boundaries. To add an Asset, see Create Assets.

Assets

Mon, 01 Jan 0001 00:00:00 +0000

Organizations → ASSETS → Engagements → Tests → Findings

Overview

Assets sit at the center of how security work is organized within DefectDojo’s object hierarchy. Assets represent any project, program, software, or physical asset that your security team is testing, and host all of the security work and testing history related to the testing goal. Examples of Assets can include:

Engagements

Mon, 01 Jan 0001 00:00:00 +0000

Organizations → Assets → ENGAGEMENTS → Tests → Findings

Overview

In DefectDojo’s Asset hierarchy, Engagements are time- or pipeline-bound containers that represent groups of related Tests within a specific Asset. If you have a planned testing effort scheduled, whether on a routine or one-time basis, an Engagement offers you a place to store all of the related results.

Engagements

Mon, 01 Jan 0001 00:00:00 +0000

Organizations → Assets → ENGAGEMENTS → Tests → Findings

Overview

In DefectDojo’s Asset Hierarchy, Engagements are time- or pipeline-bound containers that represent groups of related Tests within a specific Asset. If you have a planned testing effort scheduled, whether on a routine or one-time basis, an Engagement offers you a place to store all of the related results.

Tests

Mon, 01 Jan 0001 00:00:00 +0000

Organizations → Assets → Engagements → TESTS → Findings

Overview

A Test is a container for one or more scan executions, which are used to discover flaws in an Asset. Tests are the final, most granular component of DefectDojo’s Asset hierarchy, serving as the container for the Findings that result from an execution of a security tool or manual assessment while also adding the context in which any such Findings were found (i.e., which tool reported it, when that tool was last run, etc.).

Tests

Mon, 01 Jan 0001 00:00:00 +0000

Organizations → Assets → Engagements → TESTS → Findings

Overview

A Test is a container for one or more scan executions, which are used to discover flaws in an Asset. Tests are the final, most granular component of DefectDojo’s object hierarchy, serving as the container for the Findings that result from an execution of a security tool or manual assessment while also adding the context in which any such Findings were found (i.e., which tool reported it, when that tool was last run, etc.).

Findings

Mon, 01 Jan 0001 00:00:00 +0000

Organizations → Assets → Engagements → Tests → FINDINGS

Overview

Findings represent the lowest level of the Asset Hierarchy where individual vulnerabilities are tracked and managed, and are the main way that DefectDojo standardizes and guides the reporting and remediation process of your security tools. Regardless of whether a vulnerability was reported in SonarQube, Acunetix, or your team’s custom tool, Findings give you the ability to manage each vulnerability in the same way.

Findings

Mon, 01 Jan 0001 00:00:00 +0000

Organizations → Assets → Engagements → Tests → FINDINGS

Overview

Findings represent the lowest level of the Asset Hierarchy where individual vulnerabilities are tracked and managed and serve as the main way that DefectDojo standardizes and guides the reporting and remediation process of your security tools. Regardless of whether a vulnerability was reported in SonarQube, Acunetix, or your team’s custom tool, Findings give you the ability to manage each vulnerability in the same way.