Defect Dojo integration

[37b]

I just tested the Defect Dojo integration with one DTrack project and though the set up was easy, the behavior was unexpected.

The Synchronization step creates a new Test in the Engagement for every cadence iteration. This behavior would lead to an unusably large number of tests.

@alitheg --
I propose instead of the integration using an Engagement ID it uses a provisioned Test ID and Defect Dojo's reimport API so the results of the single test are simply updated, rather than a new test created each time the synchronizer runs.

It's been a while since I've coded java but I'd be happy to take a stab at it if everyone agrees to the change.

[alitheg]

Maybe I've been using DefectDojo wrong (I'm still setting it up properly) - I thought it was the intention to have individual assessments as individual tests, but to have the findings deduplicated by DefectDojo so that when you view the product as a whole you have a concrete list of findings? Please do tell me if I'm wrong!

I can see the sense in wanting to reduce the number of tests if you review them individually. It could potentially also provision a test as it does now, but then store that ID on the project properties and use reimport if the ID is present.

[37b]

You're probably right about typical usage, but the de-duplication strategy doesn't work for me so I have not enabled it. I'm less worried about point-in-time results than current results if that makes sense.

[damiencarol]

You're right both. The 2 strategies are ok. I mean users use both and DefectDojo support both use cases.
Now for @37b situation, as you don't want to use the de-duplication feature, you need to use the re-import feature with the same engagement+test every time.
This could also be more clear to understand/analyze what DefectDojo do since some PR added UI to see what was added/removed/modified during a re-import (see DefectDojo/django-DefectDojo#3748 for ex)
If we could have an option to switch from one mode (create a new test every time) to another (re-import) it will be perfect.
Now I know that it will be more code to maintain/test.
Last thing, it depend on what you want to track. Having more than one test could be good to track some details like the version you're scanning or to keep some metadata across all findings as tags, etc...