Locations on DefectDojo Documentation

Locations Overview

Mon, 01 Jan 0001 00:00:00 +0000

Locations are a new asset-modelling tool in DefectDojo Pro. They replace the legacy Endpoints model and absorb the previous Components (library) data, giving DefectDojo a single, polymorphic way to describe where a Finding lives — whether that’s a URL, a software dependency from an SBOM, or, in the future, a cloud resource ID, container image, or code repository.

Migrating from Endpoints

Mon, 01 Jan 0001 00:00:00 +0000

When you enable Locations on an existing DefectDojo Pro instance, the data already stored as Endpoints needs to be carried forward into the new Locations model. This page describes migration, what it preserves, and how the legacy Endpoint API behaves once the migration has run.

Working with URLs

Mon, 01 Jan 0001 00:00:00 +0000

URL Locations are the functional replacement for the legacy Endpoints model. They store the same URL-shaped fields you are used to — protocol, host, port, path, query, fragment — and serve the same role: identifying where a web-application Finding lives.

Working with SBOMs

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro models software libraries as Dependency Locations. A Dependency is a Location subtype identified by a Package URL (pURL) and intended to represent a single library or package — org.apache.logging.log4j:log4j-core@2.17.0, pypi/django@5.0.2, npm/react@18.2.0, and so on.