Home Import data Introduction Knowledge Check Knowledge Check (Pro) Twenty questions about what Import and Reimport are for in DefectDojo Pro, and how they create, match, close and reopen Findings.
Pick an answer to see whether it’s right and why. Your first pick is the one that counts toward your score, but you can then pick the other options to see where each one would point you. Each explanation links to the page that covers it. Nothing is recorded: your answers stay in your browser and disappear when you leave the page.
1. What happens when you import a scan file into DefectDojo?A.
DefectDojo runs the scanner named in the file against your Asset
B.
The file is attached to the Asset, and someone creates Findings from it by hand
C.
It creates a Test under an Engagement, with a Finding for each vulnerability in the file
D.
It creates a separate Engagement for each vulnerability The import creates a new Test nested under an Engagement, with one Finding per vulnerability. The Test is named after the scan type.
Read more Where to look instead: DefectDojo doesn’t scan. To pull results from your tools automatically, connect them with Upstream Connectors.
Upstream Connectors →
Where to look instead: Findings are created automatically. If your tool’s format isn’t supported, the Universal Parser can map it.
Universal Parser →
Where to look instead: To bundle related Findings together, use the Group By option on import to create Finding Groups.
Import options: Group By →
2. What is Reimport for?A.
Replacing everything in a Test with the contents of a new file
B.
Sending repeated scans of the same target into one Test, so DefectDojo can work out what’s new, fixed, still there or back again
C.
Correcting a mistake in an earlier upload by overwriting its Findings
D.
Exporting Findings back to the scanner that found them Reimport doesn’t replace a Test’s data. It compares the incoming file with what’s there, then creates, leaves untouched, closes or reopens Findings.
Read more Where to look instead: Reimport compares rather than replaces. To keep each scan as its own Test, use Import instead.
Import vs. reimport endpoints →
Where to look instead: To fix Findings directly, edit them, or change many at once with bulk edit.
Editing Findings →
Where to look instead: To get Findings out of DefectDojo, DefectDojo-CLI exports them to JSON or CSV.
DefectDojo-CLI export →
3. When would you call the API’s /import endpoint instead of /reimport?A.
Always first, because /reimport only works on a Test that /import already created
B.
When you want each scan result stored as its own Test, so you can inspect one pipeline run on its own
C.
When the file is very large, because /import is faster
D.
When you want old Findings closed automatically /reimport handles almost everything, including the first upload.
/import suits a pipeline that keeps every run as a separate Test.
Read more Where to look instead: /reimport can create the Test itself, along with its Engagement, Asset and Organization, when Auto Create Context is on.
Import vs. reimport endpoints →
Where to look instead: For large files, keep Process Findings Asynchronously on so the work runs in the background.
Process Findings Asynchronously →
Where to look instead: Both endpoints can close old Findings. Import can also close them across the whole Asset.
Close Old Findings →
4. Your team wants scan results to land in DefectDojo without anyone uploading files by hand. Which of these could do that?A.
Only the Import Scan form, opened on a schedule
B.
Emailing scan files to DefectDojo
C.
The Endpoint Meta Importer
D.
A CI/CD job calling the API, Universal Importer or DefectDojo-CLI, or a Connector Besides the UI, scans can come in through the API, Universal Importer and DefectDojo-CLI, Connectors, and Smart Upload.
Read more Where to look instead: The form is manual. To script uploads from CI or a scheduled job, use Universal Importer or DefectDojo-CLI.
Universal Importer & DefectDojo-CLI →
Where to look instead: There’s no email import. A CI job calling the API’s /reimport endpoint does the same job.
Import from API →
Where to look instead: That one applies tags and custom fields to endpoints from a CSV, not scan results.
Endpoint Meta Importer →
5. What is Smart Upload for?A.
Splitting an infrastructure scan’s Findings across the right Assets, based on the hosts they were found on
B.
Uploading several scan files in one go
C.
Detecting a file’s scan type automatically
D.
Importing faster by skipping deduplication Smart Upload routes Findings from infrastructure scans (Nexpose, NMap, OpenVas, Qualys, Tenable) to Assets by host, once a host has been assigned.
Read more Where to look instead: To upload many files from a script, use Universal Importer or DefectDojo-CLI.
Universal Importer & DefectDojo-CLI →
Where to look instead: You still pick the scan type. For a format with no parser, map it with the Universal Parser.
Universal Parser →
Where to look instead: Deduplication isn’t skipped, but you can choose whether an import waits for it with the deduplication execution mode.
Deduplication execution mode →
6. What does a Test’s Import History show?A.
Who logged in and what they viewed
B.
Older copies of the Test that you can restore
C.
Each import or reimport into the Test, with how many Findings it created, closed, left untouched and reactivated
D.
The original scan files, ready to download again Each import or reimport is one row, with a timestamp, any build, branch, commit and version details, and the created, closed, left untouched and reactivated counts.
Read more Where to look instead: For a record of who did what, use Audit Logs.
Audit Logs →
Where to look instead: Import History records changes, not snapshots. For a record of how objects changed, use Audit Logs.
Audit Logs →
Where to look instead: Import History doesn’t keep files. To get Findings out, use DefectDojo-CLI’s export.
DefectDojo-CLI export →
7. What is the Do Not Reactivate option for?A.
Keeping risk-accepted Findings closed
B.
Scanners that report everything every time, so DefectDojo stays the source of truth for triage instead of reopening Findings your team already closed
C.
Stopping a Test from accepting any more reimports
D.
Preventing duplicate Findings Triage-less scanners such as tfsec flag everything on every run. Do Not Reactivate stops each import from reopening Findings you’ve already closed.
Read more Where to look instead: Risk-accepted Findings already stay inactive on reimport. Manage them with Risk Acceptance.
Risk Acceptance →
Where to look instead: Imports go wherever they’re sent. To pause a Connector’s automatic syncs, manage its operations.
Connector operations →
Where to look instead: Duplicates are handled by Deduplication, which you can tune per tool.
Deduplication Tuning →
8. Do you need to create the Organization, Asset and Engagement before importing?A.
Yes, always
B.
No, but anything created at import time can’t be moved later
C.
No, DefectDojo puts every import into one default Asset
D.
No. You can pick existing ones, or create new ones as you import, in the Add Findings form or through the API Every upload method can create the hierarchy at import time. In the Add Findings form, just type the names of the Organization, Asset or Engagement you want created.
Read more Where to look instead: The Add Findings form can create them as you fill it in, and the API’s Auto Create Context option does the same.
Add Findings form options →
Where to look instead: The hierarchy can be reorganized whenever you need.
You can reorganize later →
Where to look instead: To send Findings to the right Asset automatically, use Smart Upload.
Smart Upload →
9. You reimport a file that contains a vulnerability already open as a Finding in the Test. What happens?A.
A new Finding is created and marked as a duplicate
B.
The existing Finding is overwritten with the new data
C.
The incoming copy is discarded, and the existing Finding is counted as Left Untouched
D.
The reimport fails with a conflict Matches are discarded rather than recorded as duplicates, and the Test page shows them as Left Untouched.
Read more Where to look instead: That’s what Same-Tool Deduplication does across separate Tests.
How duplicates work →
Where to look instead: Only fix_available and fix_version are updated. To change other fields, edit the Finding.
Editing Findings →
Where to look instead: Reimport never fails on a match. Check what it did in Import History.
Import History →
10. Through the API, you reimport a file that no longer contains one of the Test’s open Findings, without setting close_old_findings. What happens to that Finding?A.
It’s closed (made inactive and mitigated), because close_old_findings defaults to true on reimport
B.
Nothing, because Findings are only closed when you ask
C.
It’s deleted
D.
It’s marked as a false positive On the reimport endpoint
close_old_findings is true by default, so Findings missing from the file are closed and shown as Closed.
Read more Where to look instead: To keep Findings open on reimport, set close_old_findings to false.
Close Findings →
Where to look instead: Reimport never deletes Findings. To remove duplicates automatically, see Delete Deduplicate Findings.
Delete Deduplicate Findings →
Where to look instead: To mark matching Findings as false positives automatically, use False Positive History.
False Positive History →
11. A Finding was closed, and the vulnerability shows up again in the next reimport. What happens by default?A.
It stays closed and a new Finding is created
B.
It’s reopened and counted as Reactivated
C.
It’s reopened as a new Finding in a new Test
D.
It’s ignored Reimport assumes the vulnerability came back despite the fix, reopens it, and counts it as Reactivated.
Read more Where to look instead: To keep closed Findings closed, turn on Do Not Reactivate .
Reopen Findings →
Where to look instead: New Tests per run only happen with /import.
Import vs. reimport endpoints →
Where to look instead: To ignore a recurring issue on purpose, accept the risk or mark it a false positive.
Risk Acceptance →
12. You reimport with Force Active on. One matched Finding is Risk Accepted. What happens to it?A.
It becomes Active, and its Risk Acceptance is removed
B.
It becomes Active but stays Risk Accepted
C.
It’s closed as mitigated
D.
It stays Risk Accepted and inactive Force Active reopens mitigated Findings but never overrides an explicit decision: Risk Accepted, Duplicate, False Positive or Out of Scope.
Read more Where to look instead: Removing the Risk Acceptance is your call. Do that first, and the Finding can then be reactivated.
Risk Acceptance →
Where to look instead: Explicit triage decisions win over Force Active. The full list of statuses it won’t override is in the reimport guide.
Force Active behavior →
Where to look instead: Closing only applies to Findings missing from the file.
Close Findings →
13. You reimport into Test A with Close Old Findings on. A Finding missing from the file exists only in Test B, in the same Engagement. What happens to it?A.
Nothing, because Reimport only ever closes Findings in its target Test
B.
It’s closed, because Close Old Findings covers the whole Engagement
C.
It’s marked as a duplicate
D.
It’s closed only if Test B used the same scan type Unlike Import, Reimport never looks at other Tests when deciding what to close.
Read more Where to look instead: That’s Import’s scope. To close across the Engagement, use Import with Close Old Findings.
Close Old Findings →
Where to look instead: Duplicates come from Deduplication, which runs on the Findings a reimport creates.
Reimport Deduplication →
Where to look instead: Scan type matters for Import’s closing scope, which Close Old Findings Within This Asset widens to the whole Asset.
Close scope: Engagement vs. Asset →
14. Close Old Findings is on. A Finding missing from the file has a different service value from the one set on this import. Is it closed?A.
Yes, because the service value is ignored
B.
Only if it’s older than 30 days
C.
No. Only Findings with the same service value, or none if none was set, are considered
D.
Only if Force Active is also on Close Old Findings respects the service field, so separate services in one Test don’t close each other’s Findings.
Read more Where to look instead: Service matters to deduplication too, since it can change a Finding’s hash.
Service field and its impact →
Where to look instead: For age-based closing, a Triage Engine rule can match on older_than_days.
Triage Engine conditions →
Where to look instead: Force Active is about reopening matched Findings, not closing missing ones.
Force Active behavior →
15. What does Close Old Findings Within This Asset change?A.
It closes Findings of any scan type in the Asset
B.
It works on its own, without Close Old Findings
C.
It widens closing from the Engagement to every Finding of the same scan type in the Asset, on Import only
D.
It applies to Reimport as well close_old_findings_product_scope widens Import’s closing to the whole Asset. It needs
close_old_findings and has no effect on reimport.
Read more Where to look instead: It still only matches the same scan type. To close Findings by other criteria, use a Triage Engine rule.
Triage Engine →
Where to look instead: It needs Close Old Findings on as well; on its own it has no effect.
Close scope: Engagement vs. Asset →
Where to look instead: Reimport is always limited to its Test. To consolidate runs, reimport them into one Test.
Reimport →
16. The report sets its own dates, and you also set Scan Date when importing. Which date do the Findings get?A.
The date in the report
B.
The date of the import
C.
Whichever of the two is earlier
D.
The Scan Date you set A Scan Date set at import always wins. Without one, the report’s date is used, and failing that, the import date.
Read more Where to look instead: To keep the report’s dates, leave Scan Date empty.
Scan Date →
Where to look instead: That’s only when neither the report nor Scan Date sets one.
Scan Date →
Where to look instead: Finding dates matter because SLAs are calculated from them.
Priority, Risk and SLAs →
17. You want to upload a file of a different scan type to an existing Test. What do you do?A.
Open Re-Import Findings and pick the new scan type
B.
Use the Add Findings form, which creates a new Test for it
C.
Change the Test’s scan type first, then reimport
D.
Reimport through the API, which converts the Test The Re-Import form won’t let you change the scan type or destination. For either, use the Add Findings form.
Read more Where to look instead: The reimport form can’t change the scan type or destination.
The reimport form →
Where to look instead: Engagements hold Tests from many tools, so import the new type into the same Engagement.
Add Findings form →
Where to look instead: Reimport never converts a Test. With Auto Create Context it creates a new one instead.
Import vs. reimport endpoints →
18. After every reimport, Findings are closed and recreated just because a line number moved. What fixes this?A.
Tune Reimport Deduplication for that tool to a stable identifier such as Unique ID From Tool, or turn on Location Drift Matching
B.
Turn on Do Not Reactivate
C.
Turn off Close Old Findings and delete the extra Findings by hand
D.
Switch to /import so each run gets its own Test Reimport matching uses its own deduplication settings. Location Drift Matching recognizes a moved Finding as the same one.
Read more Where to look instead: That stops closed Findings from reopening; it doesn’t change how matches are found.
Reopen Findings →
Where to look instead: To clean up duplicates automatically, use Delete Deduplicate Findings.
Delete Deduplicate Findings →
Where to look instead: Separate Tests rely on Same-Tool Deduplication instead, which you can tune per tool.
Deduplication Tuning →
19. You import with Minimum Severity set to High. What happens to the Medium vulnerabilities in the file?A.
They’re imported as inactive
B.
They’re imported as High
C.
They’re ignored, and no Findings are created for them
D.
They’re grouped into one Finding Anything below the minimum severity is ignored and never becomes a Finding.
Read more Where to look instead: To import everything but control its status, use the Active option instead.
Import options →
Where to look instead: To change severities automatically, use a Set Severity node in a Triage Engine rule.
Set Severity node →
Where to look instead: To group Findings, use Group By on import to create Finding Groups.
Import options: Group By →
20. Through the API, you import with Process Findings Asynchronously turned off. When does the API respond?A.
Immediately, while Findings are created in the background
B.
Only after deduplication has finished as well
C.
Never, because the API requires asynchronous processing
D.
Only after all Findings have been created
