The Sidebar Menu (Pro)
The DefectDojo Pro sidebar groups every page in the product into five sections, ordered by how the product is used rather than by how its data is structured. The views you open to find work come first; the record catalogs you drill into sit behind them. This layout is the default on every instance from DefectDojo Pro 3.2.200 onwards. An administrator can switch back to the previous layout at any time (see Switching layouts).
Either way, every page keeps the same URL. Bookmarks, saved links and anything in your own runbooks continue to work regardless of which layout is active.
The five sections
| Section | What it holds |
|---|---|
| Overview | Dashboards, Insights, My Work, Reporting, Calendar |
| Sensei + AI | AppSec, CSPM, Threat Modeling, MCP, AI Model Settings |
| Connect | Upstream, Downstream, Jira, Authorization, Diagnostics, Import |
| Act | Triage Engine, Vulnerability Explorer, Root Causes, Risk Acceptances, PSIRT, Explore |
| Settings | All Settings, plus the eight groups described under The Settings section |
You only ever see the entries your account has permission to open, and a group disappears entirely when none of its pages are available to you.
Three conventions run through the whole menu:
- There are no separate “New” entries. Each list page has a New button that opens the create form, so the menu carries one entry per catalog instead of two. If your account can create a record but not list them, the menu entry takes you straight to the create form.
- Nothing nests more than one level below a section. Reaching a page is at most section, group, page.
- A feature occupies one entry, not one per screen. PSIRT’s nine pages, the Triage Engine’s four and the record catalogs all sit behind a single entry each, instead of spreading across the menu.
- An entry is not repeated inside itself. Where a group already names the thing, its entries do not name it again: Findings holds Active, Mitigated and All rather than “All Findings”, and Attack Surface holds Endpoints and Hosts rather than “All Endpoints”.
Sensei + AI
The AI capabilities sit together in their own section rather than being spread through the dashboards.
AppSec is the Sensei code security capability, and was previously listed simply as Sensei. The page and its URL are unchanged. The name changed because Sensei now covers more than one capability, so the entries beside it name what each one does.
CSPM carries a gold SOON badge. Cloud security posture management is not available yet, so the entry does not open a page. Selecting it explains that the capability is on the way. Nothing needs enabling, and no license unlocks it early. The entry starts working when the capability ships.
Threat Modeling, MCP and AI Model Settings are unchanged apart from where they live. AI Model Settings appears only on on-premise instances, because DefectDojo manages the model credentials on Cloud.
Act
Act holds the work: the things you open to decide what matters, and the records behind them. The Triage Engine, the Vulnerability Explorer, Root Causes, Risk Acceptances and PSIRT come first, and the record catalogs sit behind a single Explore entry. That ordering is deliberate: the Organization to Finding chain is how DefectDojo stores your data, but it is not how most people navigate to the work in front of them.
Triage Engine
One entry covering both rules engines, named for what it does rather than how it does it. It holds Rules, Runs and Deliveries. When both engines are turned on, the classic engine appears as Classic Rules with a LEGACY badge linking to the conversion guide; when only one is on, only its pages are listed and no badge appears.
Risk Acceptances
A top-level entry rather than a page inside Findings. A risk acceptance is a decision with an owner, an expiry and an approval trail, so it is a record in its own right. Risk Accepted, inside Findings, is the separate thing: the state a finding is in once an acceptance covers it.
PSIRT
Product Security Incident Response, with its nine pages in three groups, ordered the way the work is done:
| Group | Pages |
|---|---|
| Sources & Inventory | Import SBOM, Advisory Feeds, Components, Matching Rules |
| Triage | Feed Findings, Cases, Advisories |
| Configuration | SLA Policies, PSIRT Settings |
Setup leads because nothing reaches the triage queue until there is an inventory to match against: import an SBOM, choose the publishers to poll, look at what came in, then tune matching for advisories that publish nothing machine-readable to compare. The entry carries a BETA badge, or a LOCKED one if your licence does not include the PSIRT Advisory Engine. See Menu Badges.
Explore
The record catalogs, behind one entry: Attack Surface, Organizations, Assets, Engagements, Tests, Findings and Surveys.
Attack Surface gathers the three entries that used to answer the same question, which is where a finding lives. It holds Components, plus either the endpoint pages or the location pages depending on whether your instance uses Locations.
Connect
Connect answers what is connected to this instance and whether it is working. Upstream and Downstream are the connectors; Import now sits at the bottom, holding Add Findings, Smart Upload, Unassigned Findings, the Universal Importer and the Universal Parser. These were previously a separate Import section, which split scanning tools across two places depending on whether findings arrived by connector or by upload. It sits last because the connectors are the standing, automatic path, and a manual upload through the browser is the exception.
Smart Upload and Unassigned Findings can be removed from this group with the Smart Upload feature flag, which is on by default. Turning it off hides both entries and changes nothing else; findings already imported through Smart Upload are unaffected.
The Settings section
Settings is divided into eight groups, named for what you are trying to do rather than for the part of the system involved.
| Group | What it holds |
|---|---|
| System | System Settings, Appearance, Announcement Banner, Login Banner, E-mail |
| UI Defaults | Form Configuration, Layout Defaults |
| Users & Permissions | Users, Groups, Roles |
| Finding Workflow | The three Deduplication pages, Finding Enrichment, Service Level Agreements, Prioritization Engines, Mitigation Policies |
| Configuration | Environments, Regulations, Note Types, Test Types, CI/CD Infrastructure, Tool Types, Tool Configurations |
| Notifications | Notification Events, Notification Webhooks |
| Operations | Audit Logs, Usage Logs, Schedules, Celery Status, and on DefectDojo Cloud, Message Portal, Firewall Rules, Maintenance Windows |
| License & Support | License Manager, Version Manager, Contact Support |
Feature Flags sits above the groups, directly under All Settings, rather than inside any of them. It is the page administrators open most often, and it reads alongside All Settings: one lists what exists, the other controls what is switched on. It is still filed under System in the All Settings directory.
All Settings
The first entry in the section, All Settings, opens a directory of every settings page your account can reach, arranged in the same groups as the menu and searchable by name or by what the page does. Searching deduplication finds the three deduplication pages and System Settings, because System Settings holds deduplication options too.
The last category, Elsewhere in the app, lists pages that configure DefectDojo but live in other sidebar sections: the authorization providers, Login and MFA settings, Jira instances, the Upstream and Downstream connectors, and the Universal Parser. Each tile is chipped with the section it belongs to.
UI Defaults
The UI Defaults group collects the settings that control how much of the interface each person can tailor:
- Form Configuration: choose which fields the create and edit forms show and require, and whether the Optional Fields panel starts expanded.
- Layout Defaults: the Restrict Layout Customization switch, plus the global defaults designated for dashboards, page layouts, and table views. With the switch on, only superusers can create or change dashboards, page layouts, and table views; everyone else is shown the designated defaults, or the built-in defaults when none are chosen. Personal layouts saved earlier are kept and reappear if the switch is turned back off. You choose each default from a dropdown of the layouts an administrator has shared, or designate one in context (a shared dashboard’s Manage dialog, a view page’s layout menu, or a table’s Views menu).
What moved
If you are used to the previous layout:
| Previously | Now |
|---|---|
| Dashboards | Overview |
| Dashboards β Sensei | Sensei + AI β AppSec |
| Dashboards β Threat Modeling / MCP / AI Model Settings | Sensei + AI |
| Dashboards β PSIRT Feeds, and the eight other PSIRT entries | The PSIRT section |
| Dashboards β Metrics | Overview β Insights |
| Dashboards β Reporting β Report Templates β All / New | Overview β Reporting β Report Templates |
| Import β (whole section) | Connect β Import (last entry) |
| Import β Smart Upload β Add Findings | Connect β Import β Smart Upload |
| Manage | Act |
| Manage β Endpoints / Locations / Components | Act β Explore β Attack Surface |
| Manage β Organizations / Assets / Engagements / Tests / Findings / Surveys | Act β Explore |
| Manage β Risk Acceptances | Act β Risk Acceptances |
| Manage β Root Causes / Vulnerability Explorer | Act (unchanged, now near the top) |
| Manage β Rules Engine and Rules Engine 2.0 | Act β Triage Engine |
| Manage β (any) β New (record) | The New button on the matching list page |
| Dashboards β Home | Overview β Dashboards (when Dashboards 2.0 is on) |
| Settings β (top level) β Feature Flags | Unchanged β still at the top level, below All Settings |
| Settings β Pro Settings β System Settings | Settings β System β System Settings |
| Settings β Pro Settings β Appearance | Settings β System β Appearance |
| Settings β Pro Settings β Banner Settings β Announcement Banner Settings | Settings β System β Announcement Banner |
| Settings β Pro Settings β Banner Settings β Login Banner Settings | Settings β System β Login Banner |
| Settings β Pro Settings β E-mail Settings | Settings β System β E-mail |
| Settings β Users β All Users / New User | Settings β Users & Permissions β Users |
| Settings β Users β All Groups / New Group | Settings β Users & Permissions β Groups |
| Settings β Users β Roles | Settings β Users & Permissions β Roles |
| Settings β Pro Settings β Deduplication Settings β (three pages) | Settings β Finding Workflow β Same Tool / Cross Tool / Reimport Deduplication |
| Settings β Pro Settings β Finding Enrichment Settings | Settings β Finding Workflow β Finding Enrichment |
| Settings β Configuration β Service Level Agreements | Settings β Finding Workflow β Service Level Agreements |
| Settings β Configuration β Prioritization Engines | Settings β Finding Workflow β Prioritization Engines |
| Settings β Configuration β Mitigation Policies | Settings β Finding Workflow β Mitigation Policies |
| Settings β Configuration β (reference-data catalogs) | Settings β Configuration β (unchanged) |
| Settings β Pro Settings β Notification Settings | Settings β Notifications |
| Settings β Configuration β Audit Logs | Settings β Operations β Audit Logs |
| Settings β Configuration β Usage log | Settings β Operations β Usage Logs |
| Settings β Configuration β All Schedules | Settings β Operations β Schedules |
| Settings β Pro Settings β Celery Status | Settings β Operations β Celery Status |
| Settings β Cloud Manager β (cloud pages) | Settings β Operations |
| Settings β License Manager / Version Manager / Contact Support | Settings β License & Support |
The group that was named after your license package, Pro Settings on a Pro instance and Enterprise Settings on an Enterprise one, no longer exists. Its pages are distributed across System, Finding Workflow, Notifications and Operations.
Turning entries off
Three sidebar entries can be removed from Feature Flags by an administrator. All three are on by default, and turning one off removes the entry without changing any data behind it.
| Flag | Removes |
|---|---|
| Calendar | Calendar, from Overview |
| Smart Upload | Smart Upload and Unassigned Findings, from Connect > Import |
| PSIRT | the whole PSIRT section |
The Calendar toggle used to be Enable Calendar in System Settings. It moved so that the switches which add or remove a menu entry sit together in one place. Your existing choice is carried across on upgrade: an instance that had the calendar switched off keeps it off, and the System Settings checkbox disappears once the reorganized menu is on. Instances still on the previous layout keep using that checkbox.
Switching layouts
Menu 2.0 on the Feature Flags page controls which layout is active. Turning it on or off reshapes the sidebar immediately; no restart is needed and nothing else about your instance changes.
Menu 2.0 is on by default everywhere as of DefectDojo Pro 3.2.200. An instance that turned it off earlier keeps that choice through upgrades, and the toggle stays available if your team prefers the previous layout.
While it is off, the All Settings page is unavailable and its URL returns Not Found.
Menu 2.0 becomes the standard in the 3.3.0 release (September 8, 2026). That release removes the classic sidebar and this toggle, so every instance moves to Menu 2.0. An instance still on the classic layout switches automatically on upgrade; turn Menu 2.0 on beforehand if you would rather move on your own schedule. In the patch releases leading up to 3.3.0, a banner in the app reminds anyone still on the classic layout.
Related
- Menu Badges: what the
NEW,BETA,SOON,LEGACYandDEPRECATEDtags mean - Feature Flags: turning optional features on and off