Migrate from DefectDojo

#Connect DefectDojo

1. In DefectDojo, open your user’s API v2 Key page and copy the key.

2. In Portal, open Global Settings, then DefectDojo under Integrations.

3. Fill in the settings:

   Setting	Value
   Api auth token	the API v2 key
   Host URL	the DefectDojo address, for example https://dojo.example.com
   Self-Signed SSL	on if DefectDojo uses a self-signed certificate
   Items Download Step	how many items to download per request, up to 100. Lower it if DefectDojo times out.

Importing needs access to all products.

#Import the findings

Under Import findings, choose how to import:

• Review first. Click Check for new findings, then Review findings. To build the preview, Portal reads every finding from DefectDojo, which can take a while for a large DefectDojo: keep the page open until the check finishes. Each next page of the preview takes as long again. The preview lists each new DefectDojo finding with the product it goes to (an existing product, or a new one that the import creates), its linked Jira task, and whether it will be imported. Findings that can’t be imported show why. Then import the ones that can be.
• Import right away. Click Import now to skip the preview and the wait.

The import runs in the background as an operation. Its progress shows on the page and in Operations under Maintenance in the settings, and you get a notification when it’s done. A failed or stalled import can be retried from there.

#What comes over

Each finding goes to the product linked to its DefectDojo product. If there is none yet, Portal uses a product with the same name and product type, or creates one. Each finding comes over with:

• title, description, severity, file path and line;
• the scanner, named after the DefectDojo test type;
• tags;
• a link to the finding in DefectDojo;
• the linked Jira task, if one task tracker integration for its Jira project applies to the product;
• the status: verified findings become Verified, false positives Rejected, mitigated findings Resolved, and the rest Unverified.

Findings that DefectDojo marks as duplicates or out of scope are skipped. Long descriptions are shortened.

A finding isn’t imported when its product can’t be matched: the DefectDojo product or its type is missing, the product here is linked to another DefectDojo product or is being deleted, or its Jira task has no matching integration, or more than one.

#Import again

An import copies the findings once. It doesn’t keep the two in sync: changes in DefectDojo after the import don’t come over, and changes here aren’t sent back. Run the import again to bring in findings that are new in DefectDojo since the last one; findings imported before are skipped.

#Switch over

When your scans send their results to Portal (see Audits and Import scan results), run a last import to catch the findings that came into DefectDojo in the meantime. The imported findings stay when you remove the DefectDojo settings.