---
title: "Migrate from DefectDojo"
description: "Import products and findings from DefectDojo into AppSec Portal, with a preview of what comes over."
url: https://whitespots.io/docs/appsec-portal/get-started/migrate-from-defectdojo
slug: appsec-portal/get-started/migrate-from-defectdojo
publish_date: 2026-10-30T19:42:15.000Z
last_modified: 2026-10-30T19:42:15.000Z
---

# Migrate from DefectDojo

AppSec Portal imports your products and findings from DefectDojo. Preview what comes
over, or import it right away.

## Connect DefectDojo

1. In DefectDojo, open your user's **API v2 Key** page and copy the key.
2. In Portal, open **Global Settings**, then **DefectDojo**
   under **Integrations**.
3. Fill in the settings:

   | Setting | Value |
   | --- | --- |
   | **Api auth token** | the API v2 key |
   | **Host URL** | the DefectDojo address, for example `https://dojo.example.com` |
   | **Self-Signed SSL** | on if DefectDojo uses a self-signed certificate |
   | **Items Download Step** | how many items to download per request, up to 100. Lower it if DefectDojo times out. |

Importing needs access to all products.

## Import the findings

Under **Import findings**, choose how to import:

- **Review first.** Click **Check for new findings**, then **Review findings**. To build the
  preview, Portal reads every finding from DefectDojo, which can take a while
  for a large DefectDojo: keep the page open until the check finishes. Each next page of the
  preview takes as long again. The preview lists each new DefectDojo finding with the product it
  goes to (an existing product, or a new one that the import creates), its linked Jira task, and
  whether it will be imported. Findings that can't be imported show why. Then import the ones that
  can be.
- **Import right away.** Click **Import now** to skip the preview and the wait.

The import runs in the background as an operation. Its progress shows on the page and in
**Operations** under **Maintenance**
in the settings, and you get a notification when it's done. A failed or stalled import can be retried from there.

## What comes over

Each finding goes to the product linked to its DefectDojo product. If there is none yet,
Portal uses a product with the same name and product type, or creates one.
Each finding comes over with:

- title, description, severity, file path and line;
- the scanner, named after the DefectDojo test type;
- tags;
- a link to the finding in DefectDojo;
- the linked Jira task, if one [task tracker](https://whitespots.io/docs/appsec-portal/integrations/task-trackers) integration for
  its Jira project applies to the product;
- the status: verified findings become **Verified**, false positives **Rejected**, mitigated
  findings **Resolved**, and the rest **Unverified**.

Findings that DefectDojo marks as duplicates or out of scope are skipped. Long descriptions are
shortened.

A finding isn't imported when its product can't be matched: the DefectDojo product or its type is
missing, the product here is linked to another DefectDojo product or is being deleted, or its Jira
task has no matching integration, or more than one.

## Import again

An import copies the findings once. It doesn't keep the two in sync: changes in DefectDojo after
the import don't come over, and changes here aren't sent back. Run the import again to bring in
findings that are new in DefectDojo since the last one; findings imported before are skipped.

## Switch over

When your scans send their results to Portal (see
[Audits](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/audits) and
[Import scan results](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/import-scan-results)), run a last import to
catch the findings that came into DefectDojo in the meantime. The imported findings stay when you
remove the DefectDojo settings.

---

## Navigation

- Location: [Docs](https://whitespots.io/docs) > [Application Security Portal](https://whitespots.io/docs/appsec-portal) > [Get started](https://whitespots.io/docs/appsec-portal/get-started)
- Previous: [Move the database](https://whitespots.io/docs/appsec-portal/get-started/move-database)
- Next: [Troubleshooting](https://whitespots.io/docs/appsec-portal/get-started/troubleshooting)