Findings on DefectDojo Documentation

Introduction to Findings

Mon, 01 Jan 0001 00:00:00 +0000

Findings are the main way that DefectDojo standardizes and guides the reporting and remediation process of your security tools. Regardless of whether a vulnerability was reported in SonarQube, Acunetix, or your team’s custom tool, Findings give you the ability to manage each vulnerability in the same way.

Creating Findings Manually

Mon, 01 Jan 0001 00:00:00 +0000

Normally, most of the Findings in your environment will be imported from other security tools. If you wish, you can add manual Finding entries as well, if you have vulnerabilities or work you wish to manage that was not created from a scan tool.

Editing Findings

Mon, 01 Jan 0001 00:00:00 +0000

If you want to add notes or update the language on a Finding to be more relevant to the current situation, you can do so through the Edit Finding form.

Finding Status Definitions

Mon, 01 Jan 0001 00:00:00 +0000

Each Finding created in DefectDojo has a Status which communicates relevant information. Statuses help your team keep track of their progress in resolving issues.

Risk Acceptances

Mon, 01 Jan 0001 00:00:00 +0000

Risk Acceptances are a special status that can be applied to Findings to formally document and operationalize the decision to acknowledge them without immediately remediating them.

Risk Acceptances

Mon, 01 Jan 0001 00:00:00 +0000

Risk Acceptances are a special status that can be applied to Findings using either Full Risk Acceptance objects or the Simple Risk Acceptance workflow. Risk Acceptances are used to formally document and operationalize the decision to acknowledge a vulnerable Finding without immediately remediating it.

Attaching Files

Mon, 01 Jan 0001 00:00:00 +0000

You can attach files to a Finding, an Engagement, or a Test to provide supporting context — for example a proof-of-concept screenshot, a raw scanner report, a network diagram, or a spreadsheet that backs up a result.

Attaching Files

Mon, 01 Jan 0001 00:00:00 +0000

Bulk Editing Findings

Mon, 01 Jan 0001 00:00:00 +0000

In the DefectDojo Pro UI, Findings can be edited in bulk from any Finding List — the All Findings page (Act > Explore > Findings > All in the sidebar), or the Findings list within a Test.

Keyboard Triage

Mon, 01 Jan 0001 00:00:00 +0000

Triage walks a Findings list one Finding at a time. The list’s filters and sort order become the queue, so Triage on the Active Findings page filtered to High severity walks exactly those Findings, in that order. No key changes a Finding by itself: n opens the Add Note form for the Finding, and the note is saved only when the form is submitted.