DefectDojo Project
summary
Open source vulnerability management that consolidates scanner output, tracks products→engagements→tests→findings, and performs deduplication so repeated scans don’t reopen handled issues. Integrations include Secure Code Box and a cluster image scanner feeding SCA and DAST results via the API; monthly releases and Kubernetes deployment are recommended. Features: fine‑grained auth, component tracking, PDF/CSV reports, metrics for SLAs, and CI gating advice (query DefectDojo for unhandled criticals before deploy).
AI-written summary · about
chapters (16)
- 0:00DefectDojo project intro
- 1:09Presenters and overview
- 2:14Vulnerability management
- 3:39DefectDojo structure
- 7:34Tools feeding findings
- 9:21Enterprise features and API
- 11:30DefectDojo dashboard
- 12:55Product security metrics
- 16:12Findings vs vulnerabilities
- 19:23Vulnerability management
- 22:26Resources and community
- 24:15Contributing and bug reporting
- 25:20Enterprise deployment
- 26:25Scanner output formats
- 27:29Blocking critical vulns
- 30:03Q&A
related talks
27mOWASP DefectDojo
31mDefectDojo
40mMaking Vulnerability Management Less Painful with OWASP DefectDojo
29mFlagship Projects: DefectDojo
47mSecurity Gate: Building a Homegrown SAST Orchestration Platform
30mSecuring DevOps using OWASP DevSecOps Tools
50mBuilding Your Application Security Data Hub: The Imperative for Structured Vulnerability Information
43mBuilding a Secure DevOps Pipeline