Skip to content
This repository was archived by the owner on Apr 21, 2026. It is now read-only.

Commit deb6738

Browse files
author
dpatanin
committed
add markdown pages for persistence provider
1 parent 57906ba commit deb6738

2 files changed

Lines changed: 152 additions & 0 deletions

File tree

‎src/pages/integrations/persistence-provider/defectDojo.md‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
---
2+
title: "DefectDojo"
3+
path: "persistence-provider/defectDojo"
4+
category: "presistence provider"
5+
6+
---
7+
8+
# Defect Dojo
9+
10+
## About
11+
12+
DefectDojo is a OpenSource Tools for importing and managing findings of security scanners. The DefectDojo Persistence Provider can be used to create new Engagment for SecurityTest run via the secureCodeBox and import all findings which were identified.
13+
14+
Tools which are supported by the secureCodeBox and DefectDojo (OWASP ZAP, Arachni & Nmap) this is done by importing the raw scan report into DefectDojo. Findings by other secureCodeBox supported scanners are currently not directly supported by DefectDojo. These findings are improted via a generic finding api of defectdojo, which might cause some loss of imformation about the findings.
15+
16+
To learn more about DefectDojo visit [defectdojo.io].
17+
18+
## Configuration
19+
20+
### Setting the Persistence Provider
21+
22+
The engine supports multiple different persistence providers. Each of the prepackaged persistence providers can be toggle on by using environment variables.
23+
24+
The currently availible persistence providers are:
25+
26+
| Name | Environment Variable | Default Value |
27+
| ------------- | ------------------------------------------------- | ------------- |
28+
| Elasticsearch | `SECURECODEBOX_PERSISTENCE_ELASTICSEARCH_ENABLED` | `"false"` |
29+
| DefectDojo | `SECURECODEBOX_PERSISTENCE_DEFECTDOJO_ENABLED` | `"false"` |
30+
| S3 | `SECURECODEBOX_PERSISTENCE_S3_ENABLED` | `"false"` |
31+
| None | `SECURECODEBOX_PERSISTENCE_NONE_ENABLED` | `"false"` |
32+
33+
To activate the persistence providers the `enabled` variable must be set to `"true"`.
34+
35+
> **Note**: Most PersistenceProviders require additional configuration to set the location and access credentials. These are documented in the sections for the individual persistence providers below.
36+
37+
The corresponding PersistenceProvider-implementation class must have a matching `@ConditionalOnProperty` annotation, e.g. `@ConditionalOnProperty(name = "securecodebox.persistence.elasticsearch.enabled", havingValue = "true")` for Elasticsearch.
38+
39+
#### Enabling DefectDojo as Persistence Provider
40+
41+
To use DefectDojo for persistence set `securecodebox.persistence.defectdojo.enabled` or the corresponding environment variable to `"true"`.
42+
43+
#### Properties / Environment Variables
44+
45+
| Property | Example Value | Mandatory |
46+
| ---------------------------------------------- | ---------------------------------------- | --------- |
47+
| securecodebox.persistence.defectdojo.url | http://localhost:8000 | yes |
48+
| securecodebox.persistence.defectdojo.auth.key | 7fd7eac6fed567b19928f7928a7ddb86f0497e4e | yes |
49+
| securecodebox.persistence.defectdojo.auth.name | admin | yes |
50+
51+
Alternatively the corresponding environment variables, e.g. `SECURECODEBOX_PERSISTENCE_DEFECTDOJO_URL` can be used.
52+
53+
#### Runtime Security Test Config
54+
55+
The DefectDjojo Persistence Provider requries some additional configuration for every securityTest.
56+
This configuration has only one **mandatory** parameter, which is the **context** of the security scan. This has to be the same as the product name inside DefectDojo related to the scan. Once the scan is finished a new engagment for the product and all findings are getting imported.
57+
58+
Other than the context, there are also a number of optional params, which are used to populate other fields of the DefectDojo engagment.
59+
These can be set by passing them in the `metaData` param of the securityTest.
60+
61+
| Meta Field |  Description | Example Value | Mandatory |
62+
| ---------------------- | ---------------------------------------------------------------------------------------------------- | --------------------------------- | --------- |
63+
| `DEFECT_DOJO_USER` | Username of the DefectDojo user responsible for the scan. Defaults to username of the technical user | john_doe | no |
64+
| `SCB_BRANCH` | Tag or branch of the product the engagement tested | develop | no |
65+
| `SCB_BUILD_ID` | Build ID of the product the engagement tested | 1.0 | no |
66+
| `SCB_COMMIT_HASH` | Commit hash from repo | 9a03412 | no |
67+
| `SCB_TRACKER` | Link to epic or ticket system with changes to version | http://your-ticket-system.com | no |
68+
| `SCB_REPO` | Repository | http://your-remote-repository.com | no |
69+
| `SCB_BUILD_SERVER` | Build server responsible for CI/CD test | http://your-build-server.com | no |
70+
| `SCB_SCM_SERVER` | Source code server for CI/CD test | http://your-scm-server.com | no |
71+
| `SCB_ENGAGEMENT_TITLE` | Title for the engagement. Defaults to name of the supported scanner or "Generic Findings Import" | Engagement No.1337 | no |
72+
73+
An example security test with these values set would look like this:
74+
75+
```json
76+
[
77+
{
78+
"name": "nmap",
79+
"context": "product-1",
80+
"target": {
81+
"name": "Test Server",
82+
"location": "10.11.11.11",
83+
"attributes": {
84+
"NMAP_PARAMETER": "-Pn"
85+
}
86+
},
87+
"metaData": {
88+
"DEFECT_DOJO_USER": "john_doe",
89+
"SCB_BRANCH": "develop",
90+
"SCB_BUILD_ID": "1.0",
91+
"SCB_COMMIT_HASH": "9a03412",
92+
"SCB_TRACKER": "http://your-ticket-system.com",
93+
"SCB_REPO": "http://your-remote-repository.com",
94+
"SCB_BUILD_SERVER": "http://your-build-server.com",
95+
"SCB_SCM_SERVER": "http://your-scm-server.com",
96+
"SCB_ENGAGEMENT_TITLE": "Engagement No.1337"
97+
}
98+
}
99+
]
100+
```
101+
102+
[defectdojo.io]:https://defectdojo.readthedocs.io/en/latest/

‎src/pages/integrations/persistence-provider/elasticsearch.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
title: "Elasticsearch"
3+
path: "persistence-provider/elasticsearch"
4+
category: "persistence provider"
5+
---
6+
7+
# Elasticsearch
8+
9+
## About
10+
11+
The ElasticSearch PersistenceProvider saves all findings and reports into the configured ElasticSearch index. This allows for some easy searching and visualisation of the findings. To learn more about Elasticsearch visit [elastic.io].
12+
13+
## Configuration
14+
15+
### Setting the Persistence Provider
16+
17+
The engine supports multiple different persistence providers. Each of the prepackaged persistence providers can be toggle on by using environment variables.
18+
19+
The currently availible persistence providers are:
20+
21+
| Name | Environment Variable | Default Value |
22+
| ------------- | ------------------------------------------------- | ------------- |
23+
| Elasticsearch | `SECURECODEBOX_PERSISTENCE_ELASTICSEARCH_ENABLED` | `"false"` |
24+
| DefectDojo | `SECURECODEBOX_PERSISTENCE_DEFECTDOJO_ENABLED` | `"false"` |
25+
| S3 | `SECURECODEBOX_PERSISTENCE_S3_ENABLED` | `"false"` |
26+
| None | `SECURECODEBOX_PERSISTENCE_NONE_ENABLED` | `"false"` |
27+
28+
To activate the persistence providers the `enabled` variable must be set to `"true"`.
29+
30+
> **Note**: Most PersistenceProviders require additional configuration to set the location and access credentials. These are documented in the sections for the individual persistence providers below.
31+
32+
The corresponding PersistenceProvider-implementation class must have a matching `@ConditionalOnProperty` annotation, e.g. `@ConditionalOnProperty(name = "securecodebox.persistence.elasticsearch.enabled", havingValue = "true")` for Elasticsearch.
33+
34+
## Specific Settings
35+
36+
#### Enabling Elasticsearch as Persistence Provider
37+
38+
To use Elasticsearch for persistence set `securecodebox.persistence.elasticsearch.enabled` or the corresponding environment variable to `"true"`.
39+
40+
#### Properties / Environment Variables
41+
42+
| Property | Example Value | Mandatory |
43+
| ---------------------------------------------------- | ------------- | --------- |
44+
| securecodebox.persistence.elasticsearch.host | elasticsearch | yes |
45+
| securecodebox.persistence.elasticsearch.port | 9200 | yes |
46+
| securecodebox.persistence.elasticsearch.index.prefix | securecodebox | yes |
47+
48+
Alternatively the corresponding environment variables, e.g. `SECURECODEBOX_PERSISTENCE_ELASTICSEARCH_HOST` can be used.
49+
50+
[elastic.io]: https://www.elastic.co/products/elasticsearch

0 commit comments

Comments
 (0)