Triage Engine on DefectDojo Documentation

About Triage Engine

Mon, 01 Jan 0001 00:00:00 +0000

Note: Triage Engine is a DefectDojo Pro-only feature.

Triage Engine is a visual automation builder. Instead of a filter plus a flat list of actions, a rule is a graph: a trigger node that decides when the rule wakes up, and any number of logic, Finding and egress nodes wired together to say what happens next.

Building Rules

Mon, 01 Jan 0001 00:00:00 +0000

Note: Triage Engine is a DefectDojo Pro-only feature.

A rule is built on a canvas. You drag nodes out of a palette, wire them together, and configure each one in a side panel. This page covers the parts of that process that are the same whichever nodes you use. The nodes themselves are in the Node Reference.

Webhook Receivers

Mon, 01 Jan 0001 00:00:00 +0000

Note: Triage Engine is a DefectDojo Pro-only feature.

A Webhook Receiver gives the Triage Engine an inbound URL. Any tool that can send a webhook (Jira, a ticketing system, a CI pipeline, an internal service) posts to it, and the rules that listen to the receiver decide what happens next: close a Finding, reopen it, add a note, raise an alert.

Node Reference

Mon, 01 Jan 0001 00:00:00 +0000

Note: Triage Engine is a DefectDojo Pro-only feature.

Triage Engine’s nodes come in five categories, which this page follows. The AI, Alerts and DAST nodes appear in the palette only when the feature or licence they depend on is enabled, and are not covered on this page.

Runs

Mon, 01 Jan 0001 00:00:00 +0000

Note: Triage Engine is a DefectDojo Pro-only feature.

A run is one execution of one rule. Every run is recorded, whether it succeeded or failed, and every node inside it leaves a trace. Act > Triage Engine > Runs lists them.

Deliveries

Mon, 01 Jan 0001 00:00:00 +0000

Note: Triage Engine is a DefectDojo Pro-only feature.

Every outbound side effect a rule produces is one row in the delivery ledger. Act > Triage Engine > Deliveries lists them.

Converting from Rules Engine

Mon, 01 Jan 0001 00:00:00 +0000

Note: Triage Engine is a DefectDojo Pro-only feature.

Both engines run side by side. Turning on Triage Engine changes nothing about your existing Rules Engine rules, and there is no deadline by which you must move them.

Sharing and Versions

Mon, 01 Jan 0001 00:00:00 +0000

Note: Triage Engine is a DefectDojo Pro-only feature.

A rule can leave the instance it was built on. You can export it to a JSON file, import that file on another instance, and go back to any earlier version of it. The usual reason is promotion: you build and run a rule on a test instance until it behaves, then carry it to production. The export file is also plain enough to keep in version control.

Configuration

Mon, 01 Jan 0001 00:00:00 +0000

Note: Triage Engine is a DefectDojo Pro-only feature.

Triage Engine works out of the box. The settings on this page are for deployments that need to tune throughput, retention, or outbound network policy. All of them are applied the same way as any other DefectDojo setting (see Configuration).

Knowledge Check

Mon, 01 Jan 0001 00:00:00 +0000

Note: Triage Engine is a DefectDojo Pro-only feature.

Twenty questions about what Triage Engine is for, and how its rules are built, run and delivered. Pick an answer to see whether it’s right and why. Your first pick is the one that counts toward your score, but you can then pick the other options to see where each one would point you. Each explanation links to the page that covers it. Nothing is recorded: your answers stay in your browser and disappear when you leave the page.