DefectDojo / django-DefectDojo

DevSecOps, ASPM, Vulnerability Management. All on one platform.
https://defectdojo.com
BSD 3-Clause "New" or "Revised" License
3.68k stars 1.55k forks source link

Duplicate findings are closing Actvie,Verified findings from previous scan with "close_old_findings = true" #8123

Closed QuaiGoner closed 1 year ago

QuaiGoner commented 1 year ago

Be informative I am exporting Nessus scans in nessus format via python script and importing them to Engagements (per scan). Initial first import works as intended (all finding active and verified), but scan from the next day (with all previous findings +1 new) closes all findings from previous scan, while marking them in the new scan as duplicates.

curl line which imports scan: curl --location --request POST 'http://localhost:8080//api/v2/import-scan/' --header 'Authorization: Token bf878b1819f1b882b23230482ea733d6c501177a' --form 'engagement="2"' --form 'verified="true"' --form 'active="true"' --form 'tags="nessus"' --form 'scan_type="Nessus Scan"' --form 'minimum_severity="Medium"' --form 'test_title="White Networks Scan (IP)"' --form 'skip_duplicates="true"' --form 'close_old_findings="true"' --form 'file=@"white_networks_scan.nessus"' --form 'auto_create_context="true"'

Steps to reproduce Steps to reproduce the behavior:

  1. Import Initial Scan and get 5 Active Verified Findings
  2. Import New Scan with 6 active Verified Findings
  3. Deduplication marks 5 Findings from new scan as duplicates and closes 5 from Initial scan, leaving 1 active verified finding from new scan

Expected behavior

  1. Import Initial Scan and get 5 Active Verified Findings
  2. Import New Scan with 6 active Verified Findings
  3. Deduplication marks 5 Findings from new scan as duplicates and DOES NOT closes 5 from Initial scan, leaving 1 active verified finding from new scan, and 5 from previous

Deployment method (select with an X)

Environment information

Screenshots image 1 finding for some reason stays Active .

QuaiGoner commented 1 year ago

Fixed with importing Test via /reimport-scan