Asset Hierarchy on DefectDojo Documentation

Asset Hierarchy

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro is extending the Product/Product Type object classes to provide greater flexibility with the data model.

Enabling the Hierarchy Feature

The two pieces below are separate, and are controlled by different means.

Assign Priority, Risk and SLAs

Mon, 01 Jan 0001 00:00:00 +0000

Effective risk-based vulnerability management requires an approach that considers both business context and technical exploitability. Using DefectDojo Pro’s Priority and Risk feature, users can automatically sort Findings into a meaningful context, ensuring high-impact vulnerabilities can be addressed first.

Plan your hierarchy

Mon, 01 Jan 0001 00:00:00 +0000

Note: parent and child Assets and the five priority fields are DefectDojo Pro features. The advice on Organizations and Assets applies to Open Source as well, which makes this a good page to read before moving from Open Source to Pro.

Change plans: review every change before it happens

Mon, 01 Jan 0001 00:00:00 +0000

Reorganizing the hierarchy touches many Assets at once: moving an Asset to another Organization takes its subtree along, removes parent links that would cross Organizations, and recalculates priority for both Organizations. A change plan lets you see every one of those effects before anything is written.

Threat Intelligence

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro enriches your findings with dedicated threat intelligence — exploit availability, known exploitation, and threat-actor activity — and factors it into Priority and Risk. This goes well beyond EPSS and the CISA KEV flag.

You can reorganize later

Mon, 01 Jan 0001 00:00:00 +0000

The safest hierarchy plan is one you can change. DefectDojo Pro lets you get scan data in on day one with a reasonable structure, then move Assets between Organizations, change their parents, or point Connector Records at different Assets as you learn more, without losing Findings, their history or their deduplication state.

Finish onboarding: Assets that need attention

Mon, 01 Jan 0001 00:00:00 +0000

A connector can create thousands of Assets in its first sync. It cannot do two things for them: put each one in the right Organization, and say what each one is worth to your business. Until both are done, DefectDojo Pro ranks Findings and picks SLAs from defaults.

Framework Presets

Mon, 01 Jan 0001 00:00:00 +0000

Most of what a framework asks of vulnerability management is a number: patch critical flaws within 14 days, or within 48 hours when an exploit exists, and scan weekly or fortnightly. A framework preset bundles those numbers as DefectDojo Pro settings: SLA configurations, scan cadence policies, a response policy and a set of checks, named after the scheme and the version of it they encode. You apply a preset in one step after previewing exactly what it would change, and you can revert it later.

Asset Health Grade

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo can calculate a grade for your Assets based on the amount of Findings contained within. Grades are ranked from A - F.