PSIRT on DefectDojo Documentation

Advisory Feeds

Mon, 01 Jan 0001 00:00:00 +0000

PSIRT’s advisory feeds bring publisher security advisories (CISA, NVD, Red Hat, Debian, EUVD, and more) directly into your DefectDojo Pro instance, where they are matched against your software inventory to answer one question: am I vulnerable to this new advisory?

Import SBOM

Mon, 01 Jan 0001 00:00:00 +0000

PSIRT answers “am I vulnerable to this advisory?” by comparing each advisory’s affected version ranges against your dependency inventory. That inventory comes from SBOMs, so getting them in is the first step.

Components

Mon, 01 Jan 0001 00:00:00 +0000

Components is the software inventory as PSIRT reads it: one row for each component in each asset that carries it. The rows come from the SBOMs you import — this page does not create inventory, it annotates it.

Feed Rules

Mon, 01 Jan 0001 00:00:00 +0000

A busy set of feeds produces tens of thousands of advisories, and on a new instance none of them have matched anything yet. Column filters sort what you can already describe; they cannot say “from now on, anything claiming active exploitation goes to the top”. Feed Rules is where you say that once.

Matching Rules

Mon, 01 Jan 0001 00:00:00 +0000

Most matching needs no configuration. When an advisory publishes machine-readable affected-version ranges, PSIRT compares them against your inventory on its own, and the match it produces carries that comparison as evidence.

Feed Findings

Mon, 01 Jan 0001 00:00:00 +0000

PSIRT → Feed Findings is the queue of advisories your enabled feeds have brought in, and the place each one gets its answer.

Cases and SLA

Mon, 01 Jan 0001 00:00:00 +0000

A match is an observation. A case is the work: several matches about the same problem, grouped, prioritised and carried to a conclusion. Matching a busy feed set produces thousands of matches; cases are what turn that into a queue somebody can finish.

Advisories

Mon, 01 Jan 0001 00:00:00 +0000

Everything else in PSIRT is about what other people published. This page is about what you publish: a security advisory about your own product, written by your team, reviewed, and sent to the customers it affects.

PSIRT dashboard

Mon, 01 Jan 0001 00:00:00 +0000

PSIRT ships a dashboard template. Add it from Dashboard → Shared Templates → PSIRT, which clones it into your own dashboard so you can rearrange or remove anything.

SLA Policies

Mon, 01 Jan 0001 00:00:00 +0000

SLA Policies is where you set how much time each severity tier gets. It is the tuning surface for the clocks described in Cases and SLA — that page explains what a clock is and how pausing works; this one is about changing the numbers.