Findings (Open Source)

Overview

Findings represent the lowest level of the Product Hierarchy where individual vulnerabilities are tracked and managed, and are the main way that DefectDojo standardizes and guides the reporting and remediation process of your security tools. Regardless of whether a vulnerability was reported in SonarQube, Acunetix, or your team’s custom tool, Findings give you the ability to manage each vulnerability in the same way.

Examples of Findings include:

• Cookie Not Marked as HttpOnly
• Out-of-Date Version (PHP)
• Out-of-Band Code Evaluation (PHP)
• Out-of-Date Version (MySQL)
• Backup Source Code Detected
• Blind Cross-Site Scripting

In addition to storing the vulnerability data and providing a remediation framework, DefectDojo also enhances your Findings in the following ways:

• Automatically adding related EPSS scores to a Finding to describe exploitability
• Automatically translating a security tool’s severity metric into a Severity score for each Finding, which confers an SLA onto the Finding according to your Asset’s SLA configuration.

Overall, Findings are designed to work with the Product Hierarchy to standardize your efforts, and apply a consistent method to each Asset.

Accessing Findings

Findings are accessible via the sidebar. The submenu provides access to Open and Closed Findings, All Findings (regardless of Open or Closed status), Risk Accepted Findings, as well as Findings Templates. Individual Findings are also accessible from within the Test that contains them.

Permissions

Every Finding belongs to a Test, allowing DefectDojo to preserve which scan or assessment originally identified the vulnerability.

As Findings belong to Tests, access to Findings is determined by a User’s access to the Asset that contains the Test. Tests do not have independent access control lists.

Findings View

Finding views contain a variety of tables to help interpret a Finding’s status at a glance. This includes:

• Overview
  • ID: The unique ID number for that Finding.
  • Severity: The severity rating of that Finding, which is applied automatically.
    • As mentioned above, DefectDojo automatically translates a security tool’s severity metric into a Severity score for each Finding, which confers an SLA onto the Finding according to your Asset’s SLA configuration.
  • SLA: The intended due date by which the Finding is intended to be resolved.
  • Status: The status of the Finding (e.g., Active, Verified, False Positive, Duplicate, Out of Scope, and Under Defect Review).
  • Finding type: Whether the Finding is Static (SAST) or Dynamic (DAST).
  • Date discovered: The date on which the Finding was discovered.
  • CWE: The CWE classification of the Finding.
  • Vulnerability ID: IDs of vulnerabilities in security advisories associated with the Finding (e.g., CVE or other sources).
  • Found by: The tool that revealed the Finding.
• Similar Findings: Other Findings within the same Asset that are not exact duplicates but have similar values for vulnerability ID, CWE, file_path, line number, etc.
• Import history: List of imports/reimports that created/closed/reactivated this Finding in any Test.
• Vulnerable endpoints/systems: Endpoints/Systems that the Finding reveals are vulnerable.
• Description: The description of the Finding (added automatically depending on the type of Finding, or created manually).
• Mitigation: Suggested steps to mitigate.
• Impact: Potential impact of leaving the Finding unresolved.
• Steps to reproduce: Steps for reproducing the Finding.
• Severity justification: Written description of why a certain Severity rating was associated with the Finding.
• References: URL to cross-reference the third-party scan tool’s specific description of the Finding. For example, References could be links to a relevant entry in a Finding catalog, or a single advisory URL.
• Notes: Notes left by Users related to the Finding. Marking a note as Private will mean it will not be included in any generated reports that include the selected Finding.

Findings Data

Findings require the following metadata:
Title Date Severity Description In addition to metadata corresponding to the tables in a Finding’s view, optional metadata fields include:

• Group: Finding Groups that include the selected Finding.
• CVSS3/CVSS4 vector and score: The CVSS3 and CVSS4 vector and score of the selected Finding.
• Request and response pairs: A copy of the message sent by the client and the server’s reply to the request.
• Endpoints to add: Vulnerable endpoints that may be affected by the selected Finding that are not reflected in the preceding list of systems/endpoints.
• EPSS score and percentile: ESS score and percentile for the CVE.
• KEV date added: The date the Finding was added to the KEV catalog.
• Fix availability and version: Defines if there is a fix available for the vulnerability, and the version of the affected component in which the fix was implemented.
• User who requested a defect review: Records who requested a defect review for the flaw in question.
• Line number: Source line number of the attack vector.
• File path: Identified files that contain the flaw.
• Component name and version: Name and version of the affected component.
• Unique ID from tool: Vulnerability technical ID from the source tool.
• Vulnerability ID from tool: Non-unique technical ID from the source tool.
• SAST source object, line number, and file path: Source object, line number, and file path of the attack vector.
• SAST sink object: Sink object of the attack vector.
• Number of occurrences: Number of occurrences in the source tool when several vulnerabilities were found and aggregated by the scanner.
• Publish date: Date on which the Finding was published.
• Service: Connected Services (self-contained pieces of functionality within an Asset) that are affected by the selected Finding. When populated, this field is included in deduplication matching (i.e., Findings with identical Service fields will deduplicate).
• Planned remediation date and version: The date on which the Finding is planned to be remediated, and the version of the affected component in which the fix will be implemented.
• Effort for fixing: The level of effort involved in fixing the Finding (e.g., Low, Medium, or High).
• Tags: Any tags that have been added to the Finding.

The exact metadata available will depend on the parser/scanner that revealed the Finding. Some provide only basic information such as title and severity, while others include CVSS vectors, vulnerable components, endpoints, request/response pairs, and other scanner-specific metadata.

This metadata improves filtering, reporting, and prioritization across your security program, enabling long-term tracking and trend analysis.

Deduplication

DefectDojo includes deduplication capabilities that help identify and manage Findings representing the same underlying vulnerability. As scan results are imported from one or more tools, DefectDojo uses configurable matching logic to identify Findings that represent the same vulnerability.

Deduplication prevents the same vulnerability from appearing multiple times when discovered repeatedly by the same or different scanners, allowing remediation history to remain attached to a single Finding.

Reimport

DefectDojo’s Reimport function allows Findings to be updated as new scan results are imported. When a scan is reimported, DefectDojo compares the incoming results against existing Findings and updates matching records instead of creating entirely new ones. This preserves valuable context such as status changes, remediation history, comments, and ownership information, providing a continuous record of a Finding’s lifecycle across multiple testing cycles.

Risk Acceptances

Risk Acceptances are a special status that can be applied to Findings to formally document and operationalize the decision to acknowledge them without immediately remediating them.

Statuses

Each Finding created in DefectDojo has a Status that communicates relevant information and helps your team keep track of their progress in resolving issues.

Working with Findings

Creating Findings

While most Findings are generated automatically through scan imports and integrations, DefectDojo also supports the manual creation of Findings. Manual Findings are useful for tracking vulnerabilities and security concerns identified through penetration testing, architecture reviews, compliance assessments, bug bounty programs, consultant engagements, or other activities that do not produce scanner output.

To create a Finding manually:

1. Navigate to the Test in which you wish to manually add the Finding, click the + Plus sign, and then click New Finding.

2. This opens the New Finding form, which you can fill out with any relevant information about your Finding.

3. Select either Add Another Finding to manually add another Finding, or Finished to finish the manual Finding creation process.

Editing Findings

⋮ Kebab Menu

The ⋮ kebab menu next to Findings contains the following functions:

• View: Open and view the Finding.
• Edit: Edit the Finding.
• Copy: Create a copy of the Finding. The Copy can be saved to any of the Tests contained within the corresponding Engagement.
• Request Peer Review: Initiates the Peer Review process and changes the Finding’s status to “Under Review.”
• Touch Finding: Will log interactivity with the Finding in the Finding’s history.
• Make Finding a Template: Will automatically create a Finding Template based on the selected Finding.
• Apply Template to Finding: Will allow a pre-existing Finding Template to be applied to a Finding.
• Close Finding: Will initiate the process of closing the Finding.
• Add Risk Acceptance: Will initiate the Risk Acceptance process.
• View History: Reveals the history of the selected Finding.
• Delete: Deletes the selected Finding.

Attaching Files to Findings

You can attach files to any Finding to provide visual context — for example, a screenshot of a vulnerability in action or a proof-of-concept image.

Supported file types include:

.txt  .pdf  .json  .xml  .csv  .yml  .png  .jpeg
.sarif  .xlsx  .doc  .html  .js  .nessus  .zip  .fpr

To attach a file to a Finding:

1. Open the Finding you want to attach a file to.

2. Open the actions menu (the ☰ button in the top-right of the Finding) and click Manage Files.

3. On the Add files page, enter a Title for the file and choose the file from your computer. You can add up to three files at a time; save and return to add more if needed.

4. Click Save.

Bulk Edit Findings

Findings can be edited in bulk from a Finding List, such as the table of All Findings accessible from the sidebar, or from the table of Findings within a specific Test.

Closing Findings

Once the work on a Finding is complete, you can manually close it by clicking Close Finding within the Finding’s ⋮ kebab menu or ☰ action menu.

Deleting Findings

Deleting a Finding can be done from the Finding’s ⋮ kebab menu or ☰ action menu. This action can’t be undone.

Finding Groups

Finding Groups allow you to treat multiple related Findings as a single logical unit for triage, reporting, and remediation coordination.

Accessing Finding Groups

Finding Groups can be accessed via the sidebar. The submenu provides access to Open and Closed Finding Groups as well as All Finding Groups (regardless of Open status).

Creating Finding Groups

Finding Groups can be created either manually or automatically.

Manual Finding Groups

To manually perform Finding Group actions:

1. Navigate to a list of Findings within a Test.
2. Select the Finding(s) you wish to add to a Finding Group by clicking the corresponding checkbox.
3. Click the Group checkbox.
4. Click the corresponding action you wish to complete.
5. Click Submit.

Automatic Finding Groups

When importing a scan, the “Group By” feature can automatically create Finding Groups based on a chosen grouping method.

Finding Templates

Findings Templates allow Users to create reusable templates for commonly reported vulnerabilities and security issues.

Accessing Finding Templates

Finding Templates are found within the Findings submenu in the sidebar.

Creating Finding Templates

Finding Templates can be created by clicking the + Plus button at the top right of the Finding Templates view.

Applying Finding Templates

Finding Templates can be applied to Findings by clicking the Apply Template to Finding button within the ⋮ kebab menu of the selected Finding.

Reporting

DefectDojo’s report builder lets you assemble a custom report from a set of content widgets, run it, and export the result (for example, by printing it to PDF). Custom reports can summarize the Findings or Endpoints you want to share with an external audience, and can include branding and boilerplate text.