Deduplication on DefectDojo Documentation

How DefectDojo Deduplicates Findings Across Security Tools

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo does not scan anything itself. It ingests findings from 500+ security tools, through report files, API imports and connectors, normalizes every result into the same Finding format, and then deduplicates them: within a single tool, across different tools, and across repeated imports of the same scan. The Findings that remain after deduplication are the ones your team remediates, with SLA deadlines, Jira and other ticketing integrations, risk acceptance, and reimports that close Findings once a tool stops reporting them.

About Deduplication

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo is designed to ingest bulk reports from tools, creating one or more Findings based on the content of the report. When using DefectDojo, you’ll most likely be ingesting reports from the same tool on a regular basis, which means that duplicate Findings are highly likely.

Enabling Deduplication

Mon, 01 Jan 0001 00:00:00 +0000

Deduplication can be applied at an Asset-wide level, or scoped more narrowly to a single Engagement. To scope it the other way, across a chosen group of Assets, see Dedupe Pools.

Similar Findings

Mon, 01 Jan 0001 00:00:00 +0000

While Deduplication runs automatically at import time, Similar Findings is a manual, interactive tool that lives on the View Finding page. It surfaces other Findings in the same Asset that resemble the one you are looking at, and lets you link them into a duplicate cluster by hand.

Similar Findings

Mon, 01 Jan 0001 00:00:00 +0000

While Deduplication runs automatically at import time, Similar Findings is a manual, interactive tool on the View Finding page. It surfaces other Findings in the same Asset that resemble the one you are looking at, and lets you link them into a duplicate cluster by hand.

Avoiding Excess Duplicates

Mon, 01 Jan 0001 00:00:00 +0000

One of DefectDojo’s strengths is that the data model can accommodate many different use-cases and applications. You’ll likely change your approach as you master the software and discover ways to optimize your workflow.

Deduplication Tuning

Mon, 01 Jan 0001 00:00:00 +0000

Deduplication Tuning is a DefectDojo Pro feature that gives you fine-grained control over how findings are deduplicated, allowing you to optimize duplicate detection for your specific security testing workflow.

Deduplication Tuning

Mon, 01 Jan 0001 00:00:00 +0000

The Open Source edition of DefectDojo uses settings files and environment variables to tune deduplication.

See also: Open Source Configuration for details on environment variables and local_settings.py overrides.

Global Component Deduplication

Mon, 01 Jan 0001 00:00:00 +0000

Global Component Deduplication is a DefectDojo Pro algorithm that identifies duplicate Findings across all Assets based on the component name and version they reference. It is intended for Software Composition Analysis (SCA) tools, where the same vulnerable dependency (for example, timespan@2.3.0) may appear in many Assets, and you want DefectDojo to treat those occurrences as duplicates of a single original Finding.

Global Locations Deduplication

Mon, 01 Jan 0001 00:00:00 +0000

Global Locations Deduplication is a DefectDojo Pro algorithm that identifies duplicate Findings across all Assets based purely on a shared location: a URL, or a dependency (identified by its Package URL). Two Findings that share a location of a selected type are treated as duplicates regardless of their title, severity, CWE, or vulnerability IDs: the location alone is the identity.