Skip to content
Open
Show file tree
Hide file tree
Changes from 10 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/config/_default/menus/menus.en.toml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

[[main]]
name = "Supported Tools"
url = "/en/connecting_your_tools/parsers/"
url = "/supported_tools/"
weight = 11

[[main]]
Expand Down
2 changes: 1 addition & 1 deletion docs/config/_default/params.toml
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ mainSections = ["docs"]
bootstrapJavascript = false # false (default) or true

# Nav
sectionNav = ["docs", "en"] # ["docs"] (default) or list of sections (e.g. ["docs", "guides"])
sectionNav = ["docs", "en", "supported_tools"] # ["docs"] (default) or list of sections (e.g. ["docs", "guides"])
toTopButton = false # false (default) or true
breadcrumbTrail = true # false (default) or true
headlineHash = true # true (default) or false
Expand Down
2 changes: 1 addition & 1 deletion docs/content/en/about_defectdojo/about_docs.md
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ Whether you're a Pro or an Open-Source user, we have many resources that can hel

- Our [New User Checklist](../new_user_checklist) covers the fundamentals of setting up your DefectDojo environment and setting up your import, triage and reporting workflows.

- We support a large amount of [security tool integrations](/en/connecting_your_tools/parsers/) to help fit DefectDojo in your DevSecOps program.
- We support a large amount of [security tool integrations](/supported_tools/) to help fit DefectDojo in your DevSecOps program.

- Our team maintains a [YouTube Channel](https://www.youtube.com/@defectdojo) which hosts tutorials, archived Office Hours events and other content. New subscribers are always welcome!

Expand Down
10 changes: 4 additions & 6 deletions docs/content/en/about_defectdojo/faq.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,7 @@ Here are some frequently asked questions about working with DefectDojo - both in

### How should I organize my security testing in DefectDojo?

DefectDojo can support any security testing or reporting environment, but to optimize your use of DefectDojo you'll need to make sure things are in the right place.

There's no one-size-fits-all solution for DefectDojo, because everyone's security team and operations look different. We have a very detailed article on [common use cases](/en/about_defectdojo/examples_of_use/) that has examples of how different organizations apply RBAC and the DefectDojo data model to support their needs.
While DefectDojo can support any security or testing environment, everyone’s security team and operations look different, so there’s no one-size-fits-all approach to using it. We have a very detailed article on [common use cases](/en/about_defectdojo/examples_of_use) that has examples of how different organizations apply RBAC and the DefectDojo data model to support their needs.

### What are the recommended workflows for security testing in DefectDojo?

Expand All @@ -37,7 +35,7 @@ Role and permission assignment generally happens at the Product Type / Product l

### What tools are supported by DefectDojo?

DefectDojo supports reports from over 200 security tools, both commercial and Open Source. See our [Parser List](/en/connecting_your_tools/parsers/) for more information on these tools.
DefectDojo supports reports from over 200 security tools, both commercial and Open Source. See our [Parser List](/supported_tools/) for more information on these tools.

If you're looking to add a new tool to your suite, we have a list of recommended Open Source tools which you can check out [here](https://defectdojo.com/blog/announcing-the-defectdojo-open-source-security-awards).

Expand All @@ -56,15 +54,15 @@ For more information on Reimport, see our [article](/en/connecting_your_tools/im

### How can I troubleshoot Import errors?

DefectDojo supports a wide variety of tools. If you're seeing inconsistent behavior when importing a report, we recommend checking to see if the file structure matches what the tool is expecting. See our [Parser List](/en/connecting_your_tools/parsers/) to see if your tool is supported, and check to make sure that the file format matches what the tool expects. You can also compare the structure to our Unit Tests.
DefectDojo supports a wide variety of tools. If you're seeing inconsistent behavior when importing a report, we recommend checking to see if the file structure matches what the tool is expecting. See our [Parser List](/supported_tools/) to see if your tool is supported, and check to make sure that the file format matches what the tool expects. You can also compare the structure to our Unit Tests.

**DefectDojo Pro** has a Universal Parser import method which allows you to handle any JSON, CSV or XML file. **DefectDojo OS** users can write custom parsers for the same purpose.

Finally, third-party report formats have been known to change without warning, and our Open Source community greatly appreciates [PRs and contributions](/en/open_source/contributing/how-to-write-a-parser/) to keep our parsers up to date.

### How should I handle large scan files?

Importing a large report into DefectDojo can be a lengthy process. Reports of 2MB contain substantial amounts of data which can take a long time to translate into Findings. This depends on the security tool's report format itself
Importing a large report into DefectDojo can be a lengthy process. Reports of 2MB contain substantial amounts of data which can take a long time to translate into Findings. This depends on the security tool's report format itself.

Our recommended approach is to break a large report up before import - rather than ingesting a report of **all** a tool's vulnerabilities at once, split them up by software project, application or by another context. This makes it much easier for DefectDojo to handle and categorize the data, and has the added benefit of proactively organizing your Findings, which makes for more relevant and faster report generation.

Expand Down
2 changes: 1 addition & 1 deletion docs/content/en/about_defectdojo/pro_features.md
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,6 @@ Supported tools for Connectors include:
Are you using an unsupported or customized scanning tool? Or do you just wish DefectDojo handled a report slightly differently?

Use DefectDojo Pro's Universal Parser to turn any .json or .csv report into an actionable set of Findings, and have DefectDojo parse the data however you like.
See our [Universal Parser Guide](/en/connecting_your_tools/parsers/universal_parser/) for more information.
See our [Universal Parser Guide](/en/connecting_your_tools/universal_parser/) for more information.

![image](images/universal_parser_3.png)
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ When you're ready to add more tools to DefectDojo, you can easily rearrange your

## My Connector isn't supported

Fortunately, DefectDojo can still handle manual import for a wide range of security tools. Please see our [Supported Tool List](../../parsers/), as well as our guide to Importing data.
Fortunately, DefectDojo can still handle manual import for a wide range of security tools. Please see our [Supported Tool List](/supported_tools), as well as our guide to Importing data.

# **Next Steps**

Expand Down
2 changes: 1 addition & 1 deletion docs/content/en/connecting_your_tools/external_tools.md
Original file line number Diff line number Diff line change
Expand Up @@ -921,4 +921,4 @@ If you encounter any issues with these tools, please check the following:
- Ensure you're using the correct binary for your operating system and CPU architecture.
- Verify that the API key is set correctly in your environment variables.
- Check that the DefectDojo URL is correct and accessible.
- When importing, confirm that the report file exists and is in the supported format for the specified scan type. You can review the supported scanners for DefectDojo on our [supported tools list](../parsers).
- When importing, confirm that the report file exists and is in the supported format for the specified scan type. You can review the supported scanners for DefectDojo on our [supported tools list](/supported_tools).
2 changes: 1 addition & 1 deletion docs/content/en/connecting_your_tools/import_intro.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ There are two main ways that DefectDojo can upload Finding reports.

| | **UI Import** | **API** | **Connectors** <span style="background-color:rgba(242, 86, 29, 0.3)">(Pro)</span> | **Smart Upload** <span style="background-color:rgba(242, 86, 29, 0.3)">(Pro)</span>|
| --- | --- | --- | --- | --- |
| **Supported Scan Types** | All: see [Supported Tools](/en/connecting_your_tools/parsers) | All: see [Supported Tools](/en/connecting_your_tools/parsers) | Snyk, Semgrep, Burp Suite, AWS Security Hub, Probely, Checkmarx, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable |
| **Supported Scan Types** | All: see [Supported Tools](/supported_tools/) | All: see [Supported Tools](/supported_tools/) | Snyk, Semgrep, Burp Suite, AWS Security Hub, Probely, Checkmarx, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable |
| **Automation?** | Available via API: `/reimport` `/import` endpoints | Triggered from [CLI Importer](../external_tools) or external code | Connectors is inherently automated | Available via API: `/smart_upload_import` endpoint |

### Product Hierarchy and organization
Expand Down
2 changes: 1 addition & 1 deletion docs/content/en/open_source/upgrading/2.48.2.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,4 @@ description: Tag invalid character cleanup
---

## Tag Formatting Update
In [2.46.0](../2.46.md) tag validation was added to disallow commas, spaces and quotes in tags. Some parsers were still creating tags with invalid characters. This is fixed in this release and this release will run another data migration to replace any invalid character in tag with an underscore '`_`'.
In [2.46.0](../2.46) tag validation was added to disallow commas, spaces and quotes in tags. Some parsers were still creating tags with invalid characters. This is fixed in this release and this release will run another data migration to replace any invalid character in tag with an underscore '`_`'.
37 changes: 37 additions & 0 deletions docs/content/supported_tools/_index.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
---
title: "Index"
date: 2021-02-02T20:46:29+01:00
draft: false
type: docs

cascade:
- type: "blog"
# set to false to include a blog section in the section nav along with docs
toc_root: true
_target:
path: "/blog/**"
- type: "docs"
_target:
path: "/**"
exclude_search: true
---
DefectDojo can parse data from 200+ security reports and counting.

## DefectDojo Pro Methods
<span style="background-color:rgba(242, 86, 29, 0.3)">DefectDojo Pro</span> users have enhanced methods of import available for certain tools.

**Connectors** allow you to automatically import and sync vulnerabilities from certain tools.

**Smart Upload** allows you to split infrastructure-wide scan files up by component or endpoint, and easily combine those results with other Findings from the same location.

| [Connectors](/en/connecting_your_tools/connectors/about_connectors/): supported tools | [Smart Upload](/en/connecting_your_tools/import_scan_files/smart_upload/): supported tools |
| --- | --- |
| AWS Security Hub, BurpSuite, Checkmarx ONE, Dependency-Track, Probely, Semgrep, SonarQube, Snyk, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable, Wiz |

# All Supported Tools

All of these listed reports can be ingested via [Import/Reimport](/en/connecting_your_tools/import_intro) methods. This means that they can be imported to both Open-Source and Pro instances using the UI or API.

If your tool is not in this list, there's a good chance that DefectDojo can still import a report from the tool. Consider the [Generic Findings Import](/supported_tools/parsers/generic_findings_import/) method.

<span style="background-color:rgba(242, 86, 29, 0.3)">DefectDojo Pro</span> users can import any JSON or CSV report using the [Universal Parser](/en/connecting_your_tools/universal_parser).
Original file line number Diff line number Diff line change
@@ -1,8 +1,18 @@
---
title: "Supported Report Types"
description: "DefectDojo has the ability to import scan reports from a large number of security tools."
title: "Supported Tools"
date: 2021-02-02T20:46:29+01:00
draft: false
weight: 5
type: docs

cascade:
- type: "blog"
# set to false to include a blog section in the section nav along with docs
toc_root: true
_target:
path: "/blog/**"
- type: "docs"
_target:
path: "/**"
exclude_search: true
---

Expand All @@ -15,14 +25,14 @@ DefectDojo can parse data from 180+ security reports and counting.

**Smart Upload** allows you to split infrastructure-wide scan files up by component or endpoint, and easily combine those results with other Findings from the same location.

| [Connectors](../connectors/about_connectors): supported tools | [Smart Upload](../import_scan_files/smart_upload/): supported tools |
| [Connectors](/en/connecting_your_tools/connectors/about_connectors/): supported tools | [Smart Upload](/en/connecting_your_tools/import_scan_files/smart_upload/): supported tools |
| --- | --- |
| Anchore, AWS Security Hub, BurpSuite, Checkmarx ONE, Dependency-Track, Probely, Semgrep, SonarQube, Snyk, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable, Wiz |
| AWS Security Hub, BurpSuite, Checkmarx ONE, Dependency-Track, Probely, Semgrep, SonarQube, Snyk, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable, Wiz |

# All Supported Tools

All of these listed reports can be ingested via [Import/Reimport](../import_intro) methods. This means that they can be imported to both Open-Source and Pro instances using the UI or API.
All of these listed reports can be ingested via [Import/Reimport](/en/connecting_your_tools/import_intro) methods. This means that they can be imported to both Open-Source and Pro instances using the UI or API.

If your tool is not in this list, there's a good chance that DefectDojo can still import a report from the tool. Consider the [Generic Findings Import](./generic_findings_import/) method.
If your tool is not in this list, there's a good chance that DefectDojo can still import a report from the tool. Consider the [Generic Findings Import](/supported_tools/parsers/generic_findings_import/) method.

<span style="background-color:rgba(242, 86, 29, 0.3)">DefectDojo Pro</span> users can import any JSON or CSV report using the [Universal Parser](./universal_parser).
<span style="background-color:rgba(242, 86, 29, 0.3)">DefectDojo Pro</span> users can import any JSON or CSV report using the [Universal Parser](/en/connecting_your_tools/universal_parser).
Loading
Loading