Upgrading to DefectDojo Version 3.5.200

Trufflehog Scan findings carry a stable unique_id_from_tool#

The Trufflehog Scan parser now sets unique_id_from_tool on every finding from a version 3 report: a one-way digest of the detector, the repository, the file path and the raw secret. The commit, the line and the verification data are not part of it, so a secret that shows up in a later commit keeps its identity, and a rotated secret at the same path is a new finding. The DefectDojo Pro TruffleHog connector sets the same ID.

The scan type keeps deduplicating on Hash Code (title, description, line) by default, so an instance on default settings sees no change: findings import, match and reimport exactly as before.

What you need to do#

Nothing, unless a weekly reimport keeps closing and reopening the same secrets because they moved to another commit. In that case switch the scan type to the new ID:

DD_DEDUPLICATION_ALGORITHM_PER_PARSER='{"Trufflehog Scan": "unique_id_from_tool"}'

Findings imported before this release have no ID, so the first reimport after the switch closes each of them as no longer present and creates its successor, once. Age, SLA dates and risk acceptances start over on the new findings; from then on they stay matched across commits. Plan the switch for a moment when that one-time reset is acceptable.

New setting: DD_TRUFFLEHOG_FOLD_COMMITS#

Within one report the parser folds repeats of a detection into one finding. The fold key has always included the commit, so a secret present in several commits of the same report is several findings. Set DD_TRUFFLEHOG_FOLD_COMMITS=True to fold on the unique ID instead: one finding per secret per file, with every commit listed in the description. It is off by default, and it belongs with the “Unique ID from tool” algorithm above: on an instance that deduplicates on Hash Code, turning it on changes the identity of the affected findings.

For more information, check the Release Notes.