Sensei on DefectDojo Documentation

About Sensei

Mon, 01 Jan 0001 00:00:00 +0000

Note: Sensei is a DefectDojo Pro-only feature and is currently in BETA.

Sensei is DefectDojo’s AI-powered scan-and-fix capability for source code repositories. Connect a repository (through a GitHub App, GitLab, Bitbucket, or Azure DevOps) and Sensei scans it, imports the results as DefectDojo findings, and then uses a large language model to remediate those findings by opening pull/merge requests, all without leaving DefectDojo.

Sensei

Mon, 01 Jan 0001 00:00:00 +0000

Note: Sensei is a DefectDojo Pro-only feature.

Sensei, DefectDojo’s AI-powered scan-and-fix for source code repositories, is available only in DefectDojo Pro. It is not part of the open-source edition.

Set Up Sensei

Mon, 01 Jan 0001 00:00:00 +0000

Note: Sensei is a DefectDojo Pro-only feature and is currently in BETA.

Setting up Sensei has two parts: connect a source-control provider, then onboard the repositories you want to scan. You need a global Maintainer or Owner role to do this. Sensei supports:

AI Model Settings

Mon, 01 Jan 0001 00:00:00 +0000

Note: Sensei is a DefectDojo Pro-only feature and is currently in BETA.

When Sensei runs a scan or applies a fix DefectDojo-hosted (server-side, rather than in your own CI), it needs an LLM. AI Model Settings is where you choose that model and supply its credentials, once, instance-wide — the hosted worker uses this configuration instead of any per-repository secret.

Fixing Findings with Sensei

Mon, 01 Jan 0001 00:00:00 +0000

Note: Sensei is a DefectDojo Pro-only feature and is currently in BETA.

Sensei surfaces directly on your findings and on the Sensei hub. This page covers scanning a repository, triaging auto-fix candidates, and remediating individual findings. You need at least Writer access to a finding’s Asset to trigger a fix. Linking a new repository to an Asset (below) needs the global Maintainer or Owner role, the same as onboarding.

Cloud Security Posture (CSPM)

Mon, 01 Jan 0001 00:00:00 +0000

Note: Sensei is a DefectDojo Pro-only feature and is currently in BETA.

Sensei has two capabilities that share one hub. AppSec scans and fixes source-code repositories (see About Sensei). Cloud Security Posture (CSPM) does the same for cloud accounts: connect an AWS account, Azure subscription, or GCP project; Sensei scans it for misconfigurations with Prowler, imports the results as DefectDojo findings, and remediates them — either by opening an infrastructure-as-code pull request or by applying a reversible change to the live cloud resource.

AI Agent Red Teaming

Mon, 01 Jan 0001 00:00:00 +0000

Note: Sensei is a DefectDojo Pro-only feature. AI Agent Red Teaming is available on any instance whose license includes Sensei.

Sensei Advisor

Mon, 01 Jan 0001 00:00:00 +0000

Sensei Advisor looks at how your instance is configured and what your data looks like, and proposes concrete settings changes for you to review and apply. It never changes anything on its own: every recommendation is applied by a person, in one click, and can be reverted.

Threat Modeling

Mon, 01 Jan 0001 00:00:00 +0000

Note: Threat Modeling is a DefectDojo Pro-only feature.

Threat Modeling turns a feature design into a reviewed threat model. You supply the design — pasted text, a design document, and optionally an architecture diagram — and DefectDojo produces the components and data flows it describes, the threats against them, and the security requirements that mitigate those threats. Requirements can then be pushed into DefectDojo as findings, so design-stage work flows through the same triage, SLA, Jira and reporting machinery as everything else.

Ask Sensei

Mon, 01 Jan 0001 00:00:00 +0000

Ask Sensei answers questions about your findings, Assets and trends from anywhere in the DefectDojo Pro UI. Instead of a block of text, an answer is composed from the same kinds of views the rest of the product uses: headline numbers, charts, tables, lists of findings that link to each finding, a small what-if calculator, and follow-up questions you can pick with one click. When an answer suggests a change, such as marking findings as verified, it offers a button, and nothing changes until you confirm.